EUVD-2026-62699
GHSA-gfrq-49j2-vmv3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H for required PTR control and top-talker traffic threshold; S:C and C:H/I:H reflect full session takeover enabling OS command execution on the firewall.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature, where PTR records returned by reverse DNS lookups are incorporated without sanitization into AJAX responses and rendered as HTML through a DOM sink in the administrator interface. An attacker who controls a PTR record and generates sufficient traffic to appear as a top talker can execute arbitrary JavaScript in an administrator's browser, gaining access to the authenticated session context and same-origin access to the firewall management interface, enabling account creation and arbitrary OS command execution.
AnalysisAI
Stored cross-site scripting in pfSense Plus (before 26.07) and pfSense CE (through 2.8.1) allows an external attacker who controls a DNS PTR record to execute arbitrary JavaScript in an administrator's browser by engineering top-talker visibility in the Traffic Graphs feature, ultimately enabling account creation and OS command execution on the firewall. The attack chain bridges an unauthenticated DNS-layer injection through an unsanitized DOM sink in AJAX responses to full authenticated control of the management interface. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three specific conditions must be simultaneously satisfied. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Despite the vendor-assigned CVSS 4.0 score of 5.3, real-world impact is substantially higher than the score implies. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade pfSense Plus to version 26.07 or later, and pfSense CE to version 2.9.0 or later; release notes are available at https://docs.netgate.com/pfsense/en/latest/releases/26-07.html and https://docs.netgate.com/pfsense/en/latest/releases/2-9-0.html respectively. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Pfsense Ce
View allThe SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross-site scripting (XS
Stored cross-site scripting in pfSense Plus before 26.07 and CE before 2.9.0 allows an authenticated attacker holding th
Stored cross-site scripting in pfSense Plus and pfSense CE allows an authenticated attacker holding the 'Firewall: Rules
Stored XSS in pfSense Plus before 26.07 and pfSense CE before 2.9.0 allows an authenticated user holding only the Status
Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in th
Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross Site Scripting (XS
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today