CVE-2026-56128
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php
CVE-2026-56128: pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary…
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
CVE-2026-56128 at a glance
- CISA KEV
- Not listed (catalog checked )
- Highest advisory severity
- Medium
- CVSS base score
- 5.4 (Red Hat), 5.1 (pfSense)
- Weakness
- CWE-79
- Fixed releases
- pfSense: 26.07, 2.9.0
- VulniPulse record
- Published · Updated
Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-56128; bulletin-wide values are not repeated here.
Is CVE-2026-56128 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2026-56128 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2026-56128?
Upgrade to a fixed release named by the vendor:
- pfSense: 26.07, 2.9.0
Vendor advisory comparison
pfSense
1 advisory- Advisory severityMedium5.1
Medium [CVE-2026-56128] pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php
CVE-2026-56128Source published Source updated
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an HTML attribute value in /firewall_rules.php with only single-quote escaping applied, permitting double-quote breakout. The payload executes in the browser of any user with the Firewall: Rules privilege who views the rules list with the affected schedule attached. Affected products named by the advisory: pfSense CE.
- Affected products in this advisory
- pfSense Plus
- pfSense CE
- Source-reported affected versions
- before 26.07
- before 2.9.0
- Source-reported fixed versions
- 26.07
- 2.9.0
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Red Hat
1 advisory- Advisory severityMedium5.4
Medium [CVE-2026-56128] pfSense Plus: CE: pfSense Plus and CE: Stored Cross-Site Scripting (XSS) via firewall schedule description.
CVE-2026-56128Source published Source updated
pfSense Plus: CE: pfSense Plus and CE: Stored Cross-Site Scripting (XSS) via firewall schedule description. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-79.
- Related products — impact not confirmed
- No product details extracted. Check the source bulletin.
- Source-reported affected versions
- < 26.07
- < 2.9.0
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Browse the latest tracked CVEs or the CVEs listed in CISA KEV.
Android app · Google Play
Turn CVE research into alerts on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.