Skip to main content

pfSense CVE-2026-67189

| EUVDEUVD-2026-62699 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-08-19 VulnCheck GHSA-gfrq-49j2-vmv3
Command Injection XSS Pfsense Plus Pfsense Ce
5.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.0 HIGH

AC:H for required PTR control and top-talker traffic threshold; S:C and C:H/I:H reflect full session takeover enabling OS command execution on the firewall.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

3
Analysis Generated
Aug 19, 2026 - 20:55 vuln.today
Patch available
Aug 19, 2026 - 20:03 EUVD
CVE Published
Aug 19, 2026 - 19:18 cve.org
MEDIUM 5.3

DescriptionCVE.org

pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature, where PTR records returned by reverse DNS lookups are incorporated without sanitization into AJAX responses and rendered as HTML through a DOM sink in the administrator interface. An attacker who controls a PTR record and generates sufficient traffic to appear as a top talker can execute arbitrary JavaScript in an administrator's browser, gaining access to the authenticated session context and same-origin access to the firewall management interface, enabling account creation and arbitrary OS command execution.

AnalysisAI

Stored cross-site scripting in pfSense Plus (before 26.07) and pfSense CE (through 2.8.1) allows an external attacker who controls a DNS PTR record to execute arbitrary JavaScript in an administrator's browser by engineering top-talker visibility in the Traffic Graphs feature, ultimately enabling account creation and OS command execution on the firewall. The attack chain bridges an unauthenticated DNS-layer injection through an unsanitized DOM sink in AJAX responses to full authenticated control of the management interface. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Install
technique details hidden
C2
technique details hidden
Execute
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Three specific conditions must be simultaneously satisfied. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Despite the vendor-assigned CVSS 4.0 score of 5.3, real-world impact is substantially higher than the score implies. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade pfSense Plus to version 26.07 or later, and pfSense CE to version 2.9.0 or later; release notes are available at https://docs.netgate.com/pfsense/en/latest/releases/26-07.html and https://docs.netgate.com/pfsense/en/latest/releases/2-9-0.html respectively. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Pfsense Plus

View all
CVE-2023-48795 MEDIUM POC
5.9 Dec 18

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
CVE-2023-27100 CRITICAL POC
9.8 Mar 22

Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22
CVE-2024-57273 MEDIUM POC
5.4 May 14

Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross-site scripting (XS
CVE-2023-48123 HIGH
8.8 Dec 06

An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitra
CVE-2023-42326 HIGH
8.8 Nov 14

An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the inte
CVE-2022-26019 HIGH
8.8 Mar 31

Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pf
CVE-2022-24299 HIGH
8.8 Mar 31

Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and

CVE-2026-56128 MEDIUM
5.1 Sep 03

Stored cross-site scripting in pfSense Plus before 26.07 and CE before 2.9.0 allows an authenticated attacker holding th
CVE-2026-56127 MEDIUM
5.1 Sep 03

Stored cross-site scripting in pfSense Plus and pfSense CE allows an authenticated attacker holding the 'Firewall: Rules
CVE-2026-56126 MEDIUM
5.1 Sep 03

Stored XSS in pfSense Plus before 26.07 and pfSense CE before 2.9.0 allows an authenticated user holding only the Status
CVE-2024-54780 HIGH POC
8.8 May 14

Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in th
CVE-2024-54779 MEDIUM POC
5.4 May 14

Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross Site Scripting (XS

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Share

CVE-2026-67189 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy