CVE-2026-78849 in pfSense CE
Summary
by MITRE • 09/04/2026
Cross Site Scripting vulnerability in Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1 allows a remote attacker to execute arbitrary code via the captive_portal_status.widget.php file
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/05/2026
The identified security flaw represents a classic Cross-Site Scripting vulnerability within the Netgate pfSense Plus and Community Edition management interfaces, specifically targeting the captive portal status widget functionality. This type of web application weakness arises when an application includes untrusted data in a new web page without proper validation or escaping. In this specific instance, the file responsible for rendering the captive portal status, identified as captive_portal_status.widget.php, fails to adequately sanitize user-supplied input before including it in the HTML output sent to the browser. This lack of sanitization allows an attacker who can interact with the affected component to inject malicious client-side scripts into web pages viewed by other users or potentially executed within the context of the administrative interface itself.
From a technical perspective, the vulnerability stems from insufficient validation mechanisms on parameters passed to the widget script. When a remote actor crafts a request containing specially formed input strings that include JavaScript code, these payloads are processed and rendered directly by the web server without being neutralized. Because the captive portal status page is often accessed frequently during network administration or monitoring tasks, an attacker could potentially lure an administrator into visiting a maliciously crafted URL or exploit session management weaknesses to trigger this execution automatically. The core issue lies in the failure to apply output encoding rules that would convert special characters such as angle brackets and quotes into their safe HTML entity equivalents, thereby preventing the browser from interpreting the injected content as executable code rather than plain text data.
The operational impact of this vulnerability is significant due to its potential for session hijacking and privilege escalation within the network management plane. If an administrator with high-level privileges inadvertently triggers the execution of malicious JavaScript in their own browser while logged into the pfSense interface, the attacker gains the ability to perform actions on behalf of that user. This can include reading sensitive configuration data, modifying firewall rules, changing authentication credentials, or redirecting traffic through a compromised node. Furthermore, because captive portal functionality is often tied to guest access and network segmentation policies, exploiting this flaw could undermine the integrity of network isolation strategies, allowing unauthorized entities to bypass intended access controls or exfiltrate internal network information under the guise of legitimate administrative activity.
This vulnerability aligns with CWE-79, which categorizes improper neutralization of input during web page generation as a Cross-Site Scripting weakness. In terms of offensive security frameworks, this flaw facilitates techniques associated with MITRE ATT&CK T1059, specifically command and script interpretation via browser-based execution, or potentially T1078 if it leads to valid account compromise for lateral movement within the management network. The attack vector is classified as remote, requiring no authentication in some configurations where guest access is enabled, or low complexity if administrative credentials are required but can be phished through social engineering combined with this technical exploit.
To mitigate this risk, immediate patching is essential. Administrators running pfSense Plus versions 26.03 and earlier or pfSense CE versions 2.8.1 and earlier must upgrade to the latest stable release where the input validation in captive_portal_status.widget.php has been corrected. Until patches are applied, network segmentation should be enforced to restrict access to the management interface strictly from trusted IP addresses using strong multi-factor authentication. Additionally, implementing a Web Application Firewall with rulesets designed to detect and block common XSS payloads can provide an additional layer of defense by intercepting malicious requests before they reach the vulnerable application logic. Regular security audits and code reviews focusing on input sanitization practices are recommended to prevent similar vulnerabilities in other components of the management interface.