CVE-2026-111233
Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php
Netgate pfSense CE
CVSS
2.3LowExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 15 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)1.06%Chance of exploitation activity in the next 30 days, higher than 64% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewall rules privileges into opening a crafted GET link to execute script in the WebGUI with their privileges.
Text from CVE List
Affected versions 1
- pfSense CEaffected: 2.7.1 through 2.9.0CVE List
References 5
- vulncheck.com/advisories/netgate-pfsense-ce-2.7.1-through-2.9.0-reflected-xss-via-firewall-rules-phpAdvisoryvia CVE List
- github.com/abraxas/pfsense-rules-if-xssExploitvia CVE List
- abraxaslabs.tech/research/pfsense-ce-leftoversReferencevia CVE List
- github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/firewall_rules.php#L138-L146Referencevia CVE List
- github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/firewall_rules.php#L391Referencevia CVE List