CVE-2026-56128
Received Received - Intake

Stored XSS in pfSense Firewall Schedules

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an HTML attribute value in /firewall_rules.php with only single-quote escaping applied, permitting double-quote breakout. The payload executes in the browser of any user with the Firewall: Rules privilege who views the rules list with the affected schedule attached.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-56128
EUVD
EUVD-2026-70498

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
netgate pfsense_plus to 26.07 (exc)
netgate pfsense_ce to 2.9.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-56128 is a stored Cross-Site Scripting (XSS) vulnerability in pfSense. It allows authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the 'descr' parameter in /firewall_schedule_edit.php. The injected script is stored without HTML sanitization and later inserted into an HTML attribute in /firewall_rules.php, where only single-quote escaping is applied. This enables double-quote breakout, allowing the payload to execute in the browsers of users with the Firewall: Rules privilege when they view the rules list.

Detection Guidance

Check pfSense versions for affected releases (Plus before 26.07 or CE before 2.9.0). Inspect firewall_schedule_edit.php and firewall_rules.php for unsanitized 'descr' parameter inputs. Review browser console logs for unexpected JavaScript execution when viewing firewall rules with schedules.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary JavaScript in the browsers of users with the Firewall: Rules privilege. This may lead to session hijacking, theft of sensitive information like cookies or credentials, or other malicious actions depending on the user's privileges. The attack requires user interaction and is limited to users with specific administrative access.

Mitigation Strategies

Upgrade pfSense to Plus 26.07+ or CE 2.9.0+. Restrict Firewall: Schedules: Edit and Firewall: Rules privileges to trusted users only. Avoid using the same browser for admin and non-admin tasks. Apply patches via System Patches package if upgrading is not possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56128. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart