# CVE-2026-56128: Netgate pfSense stored XSS in firewall rule schedules

Source: https://junglewise.ai/threats/cve-2026-56128-netgate-pfsense-stored-xss-in-firewall-rule-schedules  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-56128 · Severity: medium · CVSS 5.4 · Published 2026-09-03

pfSense is a widely-used open-source firewall that protects networks using FreeBSD and a web-based management interface. An authenticated user with schedule-editing privileges can inject malicious JavaScript into firewall schedule descriptions. This script executes in the browser of any administrator viewing the firewall rules list, potentially allowing session hijacking or credential theft.

Technologies: [Netgate Pfsense Ce](https://junglewise.ai/threats/technologies/pfsense-ce), [Netgate Pfsense Plus](https://junglewise.ai/threats/technologies/pfsense-plus). Vendors: [Netgate](https://junglewise.ai/threats/vendors/netgate).

## Quick answers

**Is CVE-2026-56128 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56128 being exploited in the wild.

**How severe is CVE-2026-56128?** Medium severity, with a CVSS score of 5.4, published 3 September 2026.

**Which products and versions are affected?** Netgate Pfsense Ce before 2.9.0; Netgate Pfsense Plus before 26.07.

**Is there a fix for CVE-2026-56128?** A patch was published on 2026-07-01: Patches committed to pfSense Plus 26.07, pfSense Plus 26.10, and pfSense CE master (2.9.0) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56128 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-56128?** Check whether you run Netgate Pfsense Ce or Netgate Pfsense Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored Cross-Site Scripting (XSS) flaw in /firewall_rules.php caused by improper output encoding of schedule descriptions. Schedule descriptions are stored without HTML sanitization in /firewall_schedule_edit.php and later rendered into an HTML attribute value with only single-quote escaping, enabling a double-quote breakout attack. An authenticated user with the "Firewall: Schedules: Edit" privilege can craft a malicious description; the payload persists and executes whenever a user with "Firewall: Rules" privilege views the firewall rules list if the affected schedule is attached to a rule. The fix was applied in pfSense Plus 26.07 and later, and pfSense CE 2.9.0 and later.

## Affected products

- Netgate pfSense Plus before 26.07
- Netgate pfSense CE before 2.9.0

## Timeline

- 2026-08-13: disclosed: Security advisory published
- 2026-07-01: patched: Patches committed to pfSense Plus 26.07, pfSense Plus 26.10, and pfSense CE master (2.9.0)

## References

- [https://github.com/getformwork/formwork](https://github.com/getformwork/formwork)
- [https://docs.netgate.com/downloads/pfSense-SA-26_11.webgui.asc](https://docs.netgate.com/downloads/pfSense-SA-26_11.webgui.asc)

## Related threats

- [Netgate pfSense CE reflected XSS in firewall_rules.php](https://junglewise.ai/threats/cve-2026-111233-netgate-pfsense-ce-2-7-1-through-2-9-0-contains-a-reflected)
- [Netgate pfSense CE stored cross-site scripting in firewall rules](https://junglewise.ai/threats/cve-2026-111232-netgate-pfsense-ce-2-3-0-through-2-9-0-contains-a-stored-cross)
- [Netgate pfSense CE authorization bypass in config restore](https://junglewise.ai/threats/cve-2026-111231-netgate-pfsense-ce-through-2-9-0-contains-an-authorization)
- [Netgate pfSense CE local file read via Dynamic DNS](https://junglewise.ai/threats/cve-2026-111230-netgate-pfsense-ce-through-2-9-0-contains-a-local-file-read)
- [pfSense CE command injection in captive portal HA sync](https://junglewise.ai/threats/cve-2026-111229-pfsense-ce-2-7-0-through-2-9-0-contains-a-command-injection)