CVE-2026-56128

Medium

Description

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an HTML attribute value in /firewall_rules.php with only single-quote escaping applied, permitting double-quote breakout. The payload executes in the browser of any user with the Firewall: Rules privilege who views the rules list with the affected schedule attached.

SeverityMedium

CVSS5.4

Exploit probability—

ProductpfSense Plus

PublishedSep 3, 2026

First seenSep 3, 2026

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update

Netgate pfSense Plus26.07 or later
Netgate pfSense CE2.9.0 or later

Patches

docs.netgate.com/downloads/pfSense-SA-26_11.webgui.asc

Vendor advisories

Affected products

Product	Affected versions	Fixed in
Netgate pfSense Plus	v < 26.07	26.07
Netgate pfSense CE	v < 2.9.0	2.9.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.