CVE-2026-111232
Received Received - Intake

Stored XSS in Netgate pfSense WebGUI via Separator Color Field

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description
Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field. Attackers can submit a crafted separator[] color value that display_separator() renders unencoded into class attributes, executing in administrators' browsers to perform WebGUI actions with their privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-16
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-111232
EUVD
EUVD-2026-102344

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Netgate pfSense CE 2.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Netgate pfSense CE versions 2.3.0 through 2.9.0. Authenticated users with specific privileges can inject malicious scripts via the separator color field. The vulnerability occurs because the display_separator() function renders user input unencoded into class attributes, allowing scripts to execute in administrators' browsers.

Detection Guidance

To detect this vulnerability, inspect pfSense firewall rules or NAT port forwarding configurations for unusual separator color values. Check the WebGUI for any injected scripts in the separator color field. No specific commands are provided in the context.

Impact Analysis

An attacker with Firewall: Rules or NAT: Port Forward privileges could exploit this to execute actions in an administrator's browser session. This could lead to unauthorized changes in firewall rules, port forwarding, or other WebGUI settings, potentially compromising the security of the pfSense system.

Compliance Impact

This vulnerability could lead to unauthorized access or modifications, violating compliance requirements for data protection and system integrity. For GDPR, it may risk unauthorized data access or processing. For HIPAA, it could compromise protected health information integrity or confidentiality.

Mitigation Strategies

Update pfSense to the latest version to patch the vulnerability. Restrict Firewall: Rules or NAT: Port Forward privileges to trusted users only. Monitor WebGUI activity for unauthorized changes or script injections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111232. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart