CVE-2026-111232: Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-15 · updated 2026-10-21
Weakness: CWE-79

Description

Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field. Attackers can submit a crafted separator[] color value that display_separator() renders unencoded into class attributes, executing in administrators' browsers to perform WebGUI actions with their privileges.

Affected products

Netgate pfSense CE: from 2.3.0 through 2.9.0

References

https://abraxaslabs.tech/research/pfsense-ce-leftovers
https://github.com/abraxas/pfsense-separator-color-xss
https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/filter.inc#L6238-L6252
https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/firewall_rules.php#L236-L245
https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.3.0-through-2.9.0-stored-xss-via-separator-color

Get alerted when CVE-2026-111232 or the next vulnerability affects your stack