Is CVE-2026-38961 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-38961 being exploited in the wild.

How severe is CVE-2026-38961?

Medium severity, with a CVSS score of 5.4, published 4 September 2026.

Which products and versions are affected?

Netgate pfSense Community Edition 2.8.1 and earlier; Netgate Pfsense Plus 26.03 and earlier.

Is there a fix for CVE-2026-38961?

A patch was published on 2026-03-31: Fix committed to pfSense Plus master (26.07) and pfSense CE master (2.9.0) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-38961 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-38961?

Check whether you run Netgate pfSense Community Edition or Netgate Pfsense Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-38961: Netgate pfSense RSS widget stored XSS in feed titles

CVE-2026-38961 · Severity: medium · CVSS 5.4 · Published 2026-09-04

pfSense is a widely-deployed open-source firewall that protects networks via a web-based management interface. The RSS widget on the firewall's dashboard can display news feeds, but insufficient sanitization of feed post titles allows a malicious RSS feed to inject JavaScript code that executes in the browser of any authenticated user viewing the dashboard. An attacker controlling an RSS feed could steal session cookies or perform actions on behalf of administrators.

Technologies: Netgate Pfsense Plus. Vendors: Netgate.

Quick answers

Is CVE-2026-38961 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-38961 being exploited in the wild.
How severe is CVE-2026-38961?: Medium severity, with a CVSS score of 5.4, published 4 September 2026.
Which products and versions are affected?: Netgate pfSense Community Edition 2.8.1 and earlier; Netgate Pfsense Plus 26.03 and earlier.
Is there a fix for CVE-2026-38961?: A patch was published on 2026-03-31: Fix committed to pfSense Plus master (26.07) and pfSense CE master (2.9.0) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-38961 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-38961?: Check whether you run Netgate pfSense Community Edition or Netgate Pfsense Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the rss.widget.php component of pfSense Plus and pfSense Community Edition. The RSS widget failed to sanitize or encode feed post titles before rendering them in HTML, allowing arbitrary JavaScript injection via specially crafted RSS feed content. Attack requires: (1) an authenticated user with the RSS widget active on their dashboard, (2) the widget configured to pull from an attacker-controlled or compromised RSS feed. The injected script executes in the victim's browser with their session privileges. The fix, committed on 2026-03-31, adds HTML encoding and tag stripping via htmlspecialchars(strip_tags()) to the title rendering logic.

Affected products

Netgate pfSense Plus 26.03 and earlier
Netgate pfSense Community Edition 2.8.1 and earlier

Timeline

2026-04-01: disclosed: Initial security advisory published
2026-03-31: patched: Fix committed to pfSense Plus master (26.07) and pfSense CE master (2.9.0)
2026-09-03: other: CVE-2026-38961 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.