# CVE-2026-78849: Netgate pfSense stored cross-site scripting in Captive Portal widget

Source: https://junglewise.ai/threats/cve-2026-78849-netgate-pfsense-stored-cross-site-scripting-in-captive-portal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-78849 · Severity: medium · CVSS 5.4 · Published 2026-09-04

pfSense is a network firewall used to protect and control traffic on corporate and home networks. A vulnerability in the Captive Portal dashboard widget allows an attacker on a local network to inject malicious code that executes in an administrator's browser when they view the dashboard, potentially compromising their session, stealing credentials, or gaining unauthorized access to firewall configuration.

Technologies: [Netgate Pfsense Ce](https://junglewise.ai/threats/technologies/pfsense-ce), [Netgate Pfsense Plus](https://junglewise.ai/threats/technologies/pfsense-plus). Vendors: [Netgate](https://junglewise.ai/threats/vendors/netgate).

## Quick answers

**Is CVE-2026-78849 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78849 being exploited in the wild.

**How severe is CVE-2026-78849?** Medium severity, with a CVSS score of 5.4, published 4 September 2026.

**Which products and versions are affected?** Netgate Pfsense Ce 2.8.1 and earlier; Netgate Pfsense Plus 26.03 and earlier.

**Is there a fix for CVE-2026-78849?** A patch was published on 2026-04-07: Fix committed to pfSense Plus master (26.07) and pfSense CE master (2.9.0) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78849 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-78849?** Check whether you run Netgate Pfsense Ce or Netgate Pfsense Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in captive_portal_status.widget.php when Captive Portal is configured with no authentication (authentication type "None"). An attacker on the local network can send a specially crafted XSS payload in the auth_user parameter; the Captive Portal accepts and stores the malicious username without validation. When an authenticated administrator views the Captive Portal widget on the dashboard, the username is rendered without HTML encoding, causing the JavaScript payload to execute in their browser session. An attacker can thus steal session cookies or hijack the administrator's session to compromise the firewall. The vulnerability is fixed in pfSense Plus 26.07+ and pfSense CE 2.9.0+; patches are available for earlier versions.

## Affected products

- Netgate pfSense Plus 26.03 and earlier
- Netgate pfSense CE 2.8.1 and earlier

## Timeline

- 2026-04-29: disclosed: Security advisory published (initial draft)
- 2026-04-07: patched: Fix committed to pfSense Plus master (26.07) and pfSense CE master (2.9.0)
- 2026-09-03: advisory: CVE ID CVE-2026-78849 added to advisory

## References

- [https://docs.netgate.com/downloads/pfSense-SA-26_05.webgui.asc](https://docs.netgate.com/downloads/pfSense-SA-26_05.webgui.asc)
- [https://redmine.pfsense.org/issues/16773](https://redmine.pfsense.org/issues/16773)

## Related threats

- [Netgate pfSense CE reflected XSS in firewall_rules.php](https://junglewise.ai/threats/cve-2026-111233-netgate-pfsense-ce-2-7-1-through-2-9-0-contains-a-reflected)
- [Netgate pfSense CE stored cross-site scripting in firewall rules](https://junglewise.ai/threats/cve-2026-111232-netgate-pfsense-ce-2-3-0-through-2-9-0-contains-a-stored-cross)
- [Netgate pfSense CE authorization bypass in config restore](https://junglewise.ai/threats/cve-2026-111231-netgate-pfsense-ce-through-2-9-0-contains-an-authorization)
- [Netgate pfSense CE local file read via Dynamic DNS](https://junglewise.ai/threats/cve-2026-111230-netgate-pfsense-ce-through-2-9-0-contains-a-local-file-read)
- [pfSense CE command injection in captive portal HA sync](https://junglewise.ai/threats/cve-2026-111229-pfsense-ce-2-7-0-through-2-9-0-contains-a-command-injection)