# CVE-2026-56127: Netgate pfSense stored XSS in firewall log descriptions

Source: https://junglewise.ai/threats/cve-2026-56127-netgate-pfsense-stored-xss-in-firewall-log-descriptions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-56127 · Severity: medium · CVSS 5.4 · Published 2026-09-03

pfSense is a network firewall that protects corporate and ISP networks. An authenticated firewall administrator can inject malicious JavaScript code into firewall rule descriptions, which then executes in the browsers of other administrators viewing firewall logs. This could lead to session hijacking, credential theft, or other attacks against administrative users.

Technologies: [Netgate Pfsense Ce](https://junglewise.ai/threats/technologies/pfsense-ce), [Netgate Pfsense Plus](https://junglewise.ai/threats/technologies/pfsense-plus). Vendors: [Netgate](https://junglewise.ai/threats/vendors/netgate).

## Quick answers

**Is CVE-2026-56127 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56127 being exploited in the wild.

**How severe is CVE-2026-56127?** Medium severity, with a CVSS score of 5.4, published 3 September 2026.

**Which products and versions are affected?** Netgate Pfsense Ce before 2.9.0; Netgate Pfsense Plus before 26.07.

**Is there a fix for CVE-2026-56127?** A patch was published on 2026-07-01: pfSense Plus 26.07 and 26.10, pfSense CE 2.9.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56127 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-56127?** Check whether you run Netgate Pfsense Ce or Netgate Pfsense Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in status_logs_filter.php where firewall rule descriptions are rendered without HTML encoding in the firewall log table. The root cause is that descriptions are stored in the XML configuration with only backslash-escaping and no sanitization, then displayed unsanitized when inline rule descriptions are enabled in logs. An authenticated attacker with the "Firewall: Rules: Edit" privilege can inject arbitrary JavaScript via the descr parameter in /firewall_rules_edit.php. The payload executes in the browser context of any user with "Status: Logs: Firewall" privilege who views the affected log entries, potentially compromising session tokens and sensitive data. Fixes are available in pfSense Plus 26.07+, pfSense CE 2.9.0+, or via System Patches on earlier versions.

## Affected products

- Netgate pfSense Plus before 26.07
- Netgate pfSense CE before 2.9.0

## Timeline

- 2026-08-13: disclosed
- 2026-07-01: patched: pfSense Plus 26.07 and 26.10, pfSense CE 2.9.0

## References

- [https://github.com/getformwork/formwork](https://github.com/getformwork/formwork)
- [https://docs.netgate.com/downloads/pfSense-SA-26_10.webgui.asc](https://docs.netgate.com/downloads/pfSense-SA-26_10.webgui.asc)

## Related threats

- [Netgate pfSense CE reflected XSS in firewall_rules.php](https://junglewise.ai/threats/cve-2026-111233-netgate-pfsense-ce-2-7-1-through-2-9-0-contains-a-reflected)
- [Netgate pfSense CE stored cross-site scripting in firewall rules](https://junglewise.ai/threats/cve-2026-111232-netgate-pfsense-ce-2-3-0-through-2-9-0-contains-a-stored-cross)
- [Netgate pfSense CE authorization bypass in config restore](https://junglewise.ai/threats/cve-2026-111231-netgate-pfsense-ce-through-2-9-0-contains-an-authorization)
- [Netgate pfSense CE local file read via Dynamic DNS](https://junglewise.ai/threats/cve-2026-111230-netgate-pfsense-ce-through-2-9-0-contains-a-local-file-read)
- [pfSense CE command injection in captive portal HA sync](https://junglewise.ai/threats/cve-2026-111229-pfsense-ce-2-7-0-through-2-9-0-contains-a-command-injection)