Skip to content
OpenAdvisories
High WID-SEC-2026-2836 5 CVEs

Netgate pfSense: Mehrere Schwachstellen

Published Aug 13, 2026 · Updated Oct 14, 2026 · Revision 5 · de-DE

Vendor: Netgate Product: pfSense

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Netgate pfSense ausnutzen, um beliebigen Programmcode auszuführen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.

Product

pfSense ist eine Software-Edge-Firewall mit Router- und VPN-Funktionalität.

Vulnerabilities 5

  • High 8.5
    CVE-2026-97730

    In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Das…

    Netgate pfSense CE pfSense Plus
  • Medium 6.1
    CVE-2026-67189

    pfSense Plus/CE Stored XSS via Traffic Graphs PTR Record

    pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature, where PTR records returned by reverse DNS lookups are incorporated without sanitization into AJAX responses a…

    Netgate pfSense CE pfSense Plus
  • Medium 5.4
    CVE-2026-56126

    pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php

    pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /status_monitoring.php. Multiple POST parameters including graph-left, graph-rig…

    Netgate pfSense CE pfSense Plus
  • Medium 5.4
    CVE-2026-56127

    pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php

    pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_rules_edit.php. The firewall rule description is stored in the pfSense XML con…

    Netgate pfSense CE pfSense Plus
  • Medium 5.4
    CVE-2026-56128

    pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php

    pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The schedule description is stored without HTML sanitiz…

    Netgate pfSense CE pfSense Plus

Revision history

  1. #5

    Korrektur

  2. #4

    Referenz(en) aufgenommen: CVE-2026-97730, EUVD-2026-86509

  3. #3

    Referenz(en) aufgenommen: EUVD-2026-70496, EUVD-2026-70498, EUVD-2026-70495

  4. #2

    Referenz(en) aufgenommen: EUVD-2026-62699

  5. #1

    Initiale Fassung

References