CVE-2026-56128 Netgate CVE debrief

Who should care

Defenders responsible for pfSense Plus and CE deployments, especially those with users having the Firewall: Schedules: Edit privilege, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-56128 is a stored XSS vulnerability in pfSense Plus and CE that allows authenticated users to inject JavaScript, potentially leading to unauthorized actions or disruption of firewall operations. Defenders should prioritize verification and remediation, especially in environments with users having the Firewall: Schedules: Edit privilege.

• Execution of arbitrary JavaScript in the context of users viewing the firewall rules list.
• Potential for unauthorized actions within the firewall configuration.
• Possible disruption of firewall operations or visibility into network traffic.
• Verification of user privileges and access controls is necessary.

Technical summary

The vulnerability exists in the descr parameter of /firewall_schedule_edit.php, allowing authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript. The payload is executed in the browser of any user with the Firewall: Rules privilege who views the rules list with the affected schedule attached. This stored cross-site scripting (XSS) vulnerability affects pfSense Plus before 26.07 and CE before 2.9.0, potentially leading to unauthorized actions or disruption of firewall operations. Defenders should prioritize verifying and remediating this vulnerability, especially in environments where users have the Firewall: Schedules: Edit privilege, by reviewing official advisories and applying patches or mitigations as recommended by the vendor. The vulnerability is confirmed by the CVE Program and NVD records, but details about exploitation and affected versions require verification from official sources. The payload executes in the browser of any user with the Firewall: Rules privilege who views the rules list with the affected schedule attached, emphasizing the need for defenders to restrict the Firewall: Schedules: Edit privilege to only necessary users and monitor for suspicious activity on the firewall rules list. The vulnerability allows authenticated users to inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php, which is stored without HTML sanitization and subsequently inserted into an HTML attribute value in /firewall_rules.php with only single-quote escaping applied, permitting double-quote breakout. This could lead to execution of arbitrary JavaScript in the context of users viewing the firewall rules list, potential for unauthorized actions within the firewall configuration, and possible disruption of firewall operations or visibility into network traffic. Verification of user privileges and access controls is necessary to mitigate this vulnerability. The CVE record was published on 2026-09-03T15:17:30.953Z and has not been modified since then, indicating a need for immediate assessment and remediation by defenders responsible for pfSense Plus and CE deployments. The vulnerability's impact on a

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability, especially in environments where users have the Firewall: Schedules: Edit privilege.

Recommended defensive actions

• Verify and apply the latest security patches for pfSense Plus and CE.
• Restrict the Firewall: Schedules: Edit privilege to only necessary users.
• Monitor for suspicious activity on the firewall rules list.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is confirmed by the CVE Program and NVD records. However, details about exploitation and affected versions require verification from official sources. Defenders should verify the official advisory or CVE record to validate affected scope, severity, and vendor guidance. The payload executes in the browser of any user with the Firewall: Rules privilege who views the rules list with the affected schedule attached. This stored cross-site scripting (XSS) vulnerability affects pfSense Plus before 26.07 and CE before 2.9.0, potentially leading to unauthorized actions or disruption of firewall operations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.