CVE-2026-67189 Netgate CVE debrief

Who should care

System administrators and security teams responsible for pfSense Plus and pfSense CE deployments should assess exposure and prioritize remediation to prevent potential exploitation of this stored cross-site scripting vulnerability.

Why it matters

CVE-2026-67189 is a stored cross-site scripting vulnerability in pfSense Plus and pfSense CE that could allow an attacker to execute arbitrary JavaScript in an administrator's browser, potentially leading to account creation and OS command execution. Defenders should prioritize verifying exposure and applying patches or updates.

• An attacker could execute arbitrary JavaScript in an administrator's browser, gaining access to the authenticated session context and same-origin access to the firewall management interface.
• This could enable account creation and arbitrary OS command execution.
• Defenders should verify exposure of pfSense Plus and pfSense CE deployments to this vulnerability.
• Remediation priority is high for deployments with publicly accessible administrator interfaces.

Technical summary

pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature. An attacker who controls a PTR record and generates sufficient traffic to appear as a top talker can execute arbitrary JavaScript in an administrator's browser. This vulnerability could allow an attacker to gain access to the authenticated session context and same-origin access to the firewall management interface, potentially leading to account creation and arbitrary OS command execution. The vulnerability is due to insufficient sanitization of PTR records returned by reverse DNS lookups, which are incorporated into AJAX responses and rendered as HTML through a

Defensive priority

Defenders should prioritize verifying exposure of pfSense Plus and pfSense CE deployments to this stored cross-site scripting vulnerability, especially those with publicly accessible administrator interfaces.

Recommended defensive actions

• Verify pfSense Plus and pfSense CE deployments for exposure to this vulnerability, especially those with publicly accessible administrator interfaces.
• Review and apply vendor-provided patches or updates to address the stored cross-site scripting vulnerability.
• Monitor traffic graphs and top-talkers feature for suspicious activity.
• Implement additional security measures to prevent exploitation, such as restricting access to the administrator interface.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the stored cross-site scripting vulnerability in pfSense Plus and pfSense CE. However, the scope of affected versions and potential impact require verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.