Is CVE-2026-56126 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56126 being exploited in the wild.

How severe is CVE-2026-56126?

Medium severity, with a CVSS score of 5.4, published 3 September 2026.

Which products and versions are affected?

Netgate Pfsense Ce before 2.9.0; Netgate Pfsense Plus before 26.07.

Is there a fix for CVE-2026-56126?

A patch was published on 2026-06-30: pfSense-Status_Monitoring v1.9 released for Plus 26.10 and CE 2.9.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56126 attacked?

It is attacked over the network.

Am I affected by CVE-2026-56126?

Check whether you run Netgate Pfsense Ce or Netgate Pfsense Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56126: Netgate pfSense stored XSS in Status Monitoring

CVE-2026-56126 · Severity: medium · CVSS 5.4 · Published 2026-09-03

pfSense is a network firewall used to protect corporate networks and manage traffic. A stored cross-site scripting (XSS) vulnerability in the Status Monitoring feature allows authenticated users with monitoring privileges to inject malicious JavaScript that executes when any user visits the page, potentially compromising session cookies or stealing sensitive information.

Technologies: Netgate Pfsense Ce, Netgate Pfsense Plus. Vendors: Netgate.

Quick answers

Is CVE-2026-56126 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56126 being exploited in the wild.
How severe is CVE-2026-56126?: Medium severity, with a CVSS score of 5.4, published 3 September 2026.
Which products and versions are affected?: Netgate Pfsense Ce before 2.9.0; Netgate Pfsense Plus before 26.07.
Is there a fix for CVE-2026-56126?: A patch was published on 2026-06-30: pfSense-Status_Monitoring v1.9 released for Plus 26.10 and CE 2.9.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56126 attacked?: It is attacked over the network.
Am I affected by CVE-2026-56126?: Check whether you run Netgate Pfsense Ce or Netgate Pfsense Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored XSS vulnerability exists in status_monitoring.php where graph configuration parameters (graph-left, graph-right, time-period, resolution, start-date, end-date, start-time, end-time, graph-type, invert, refresh-interval) are concatenated and written to the global pfSense XML configuration without sanitization. These unsanitized values are then echoed into a JavaScript string context on page render without proper encoding. The attack requires authentication with Status: Monitoring privilege and affects pfSense Plus before 26.07 and CE before 2.9.0. The payload persists in the global configuration and executes in the browser of every user visiting the Status Monitoring page. Patches are available in pfSense-Status_Monitoring v1.9 (Plus) and v1.8_10 (CE 2.8.1).

Affected products

Netgate pfSense Plus before 26.07
Netgate pfSense CE before 2.9.0

Timeline

2026-08-13: disclosed: Security advisory published
2026-06-30: patched: pfSense-Status_Monitoring v1.9 released for Plus 26.10 and CE 2.9.0
2026-07-01: patched: Patches released for Plus 26.07, 26.03.1, and CE 2.8.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.