Is CVE-2026-78902 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78902 being exploited in the wild.

How severe is CVE-2026-78902?

Medium severity, with a CVSS score of 6.1, published 25 September 2026.

Which products and versions are affected?

Netgate pfSense 26.03.1-RELEASE.

Is there a fix for CVE-2026-78902?

A patch was published on 2026-09-22: Fix provided by Netgate within hours of vulnerability details Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-78902 attacked?

It is attacked over the network or from the adjacent network, in a network appliance.

Am I affected by CVE-2026-78902?

Check whether you run Netgate pfSense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78902: Netgate pfSense XSS to RCE in pfBlockerNG via DNS reply logging

CVE-2026-78902 · Severity: medium · CVSS 6.1 · Published 2026-09-25

Netgate pfSense is a widely-deployed firewall appliance; pfBlockerNG is a popular package that adds DNS-based threat intelligence blocking. A cross-site scripting (XSS) vulnerability in pfBlockerNG's DNS reply logging feature allows an attacker to inject malicious JavaScript into the firewall's web management interface. If an administrator views the affected page, the attacker can execute arbitrary code with root privileges on the firewall, giving an internal attacker complete control over this critical network edge device.

Vendors: Netgate.

Quick answers

Is CVE-2026-78902 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78902 being exploited in the wild.
How severe is CVE-2026-78902?: Medium severity, with a CVSS score of 6.1, published 25 September 2026.
Which products and versions are affected?: Netgate pfSense 26.03.1-RELEASE.
Is there a fix for CVE-2026-78902?: A patch was published on 2026-09-22: Fix provided by Netgate within hours of vulnerability details Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-78902 attacked?: It is attacked over the network or from the adjacent network, in a network appliance.
Am I affected by CVE-2026-78902?: Check whether you run Netgate pfSense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored XSS vulnerability exists in pfBlockerNG's pfb_unbound.py module when DNS reply logging is enabled in Unbound Python mode. The convert_other() function passes through printable ASCII bytes (including <, >, quotes, and =) without sanitization, and the resulting DNS response data is written to CSV logs and later rendered without escaping in pfblockerng_alerts.php. An attacker able to trigger a DNS request from the target network can inject JavaScript that executes in the administrator's browser, loading additional payloads from an external server and achieving RCE.

Affected products

Netgate pfSense 26.03.1-RELEASE

Timeline

2026-09-25: disclosed
2026-09-22: patched: Fix provided by Netgate within hours of vulnerability details

References

https://www.netspi.com/blog/technical-blog/web-application-pentesting/cve-2026-78902-xss-to-rce-in-pfsense-with-one-dns-request/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.