Cross Site Scripting Vulnerability in Netgate pfSense
CVE-2026-78902

6.1MEDIUM

Key Information:

Vendor

Netgate

Status
pfSense
Vendor
CVE Published:
25 September 2026

What is CVE-2026-78902?

A vulnerability in Netgate pfSense allows for Cross Site Scripting (XSS) attacks via the pfBlockerNG package. An attacker could exploit this flaw to execute arbitrary code on the server by crafting a malicious DNS request. This could lead to severe security risks, as the unauthorized code execution could compromise sensitive data and the integrity of the network. Ensuring timely updates and patches is crucial to protect against this risk.

References

https://www.netspi.com/blog/technical-blog/web-applicatio...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.