CVE-2026-78849 Overview
CVE-2026-78849 is a Cross-Site Scripting (XSS) vulnerability affecting Netgate pfSense Plus and pfSense CE firewall distributions. The flaw resides in the captive_portal_status.widget.php file, a dashboard widget used to display captive portal session status. A remote attacker can inject script content that executes in the context of the pfSense web administration interface. Successful exploitation allows arbitrary script execution against authenticated administrators, potentially leading to session theft, configuration tampering, or pivoting into the underlying firewall appliance.
Critical Impact
Attackers can execute arbitrary script in an administrator's browser session, enabling firewall configuration changes and full compromise of network perimeter controls.
Affected Products
- Netgate pfSense Plus software versions <= 26.03
- Netgate pfSense CE software versions <= 2.8.1
- Component: captive_portal_status.widget.php (WebGUI dashboard widget)
Discovery Timeline
- 2026-09-04 - CVE-2026-78849 published to the National Vulnerability Database (NVD)
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-78849
Vulnerability Analysis
The vulnerability is a stored or reflected Cross-Site Scripting (XSS) flaw within the pfSense WebGUI dashboard component that renders captive portal session status. The affected script captive_portal_status.widget.php includes data that is rendered into the HTML response without adequate output encoding or input validation. Because the WebGUI runs with administrator privileges over HTTPS, script execution in that origin exposes session cookies, CSRF tokens, and firewall management APIs to the attacker. Netgate published advisory pfSense-SA-26_05.webgui and tracked remediation in issue #16773.
Root Cause
The root cause is improper neutralization of input during web page generation within the captive portal status widget. User-influenced values consumed by the widget are echoed into the rendered HTML without appropriate contextual escaping (for example, HTML entity encoding or JavaScript-safe encoding). This allows an attacker to embed script content that the browser then parses as executable code.
Attack Vector
Exploitation requires that an authenticated administrator view the dashboard containing the vulnerable widget. An attacker capable of influencing captive portal-related data, such as session identifiers, usernames, or MAC address fields presented by the widget, can plant script payloads that trigger when the widget is rendered. See the Netgate pfSense Security Advisory and pfSense Issue Tracker Entry #16773 for vendor-supplied technical details.
Detection Methods for CVE-2026-78849
Indicators of Compromise
- Unexpected <script>, onerror, or onload attributes appearing in captive portal user, hostname, or MAC address fields.
- WebGUI HTTP responses from captive_portal_status.widget.php containing HTML markup within data fields.
- Anomalous administrative configuration changes shortly after an administrator loaded the pfSense dashboard.
- Outbound requests from an administrator browser to unfamiliar domains after dashboard access.
Detection Strategies
- Inspect webserver access logs on the pfSense appliance for requests to captive_portal_status.widget.php correlated with new sessions containing suspicious character sequences.
- Review captive portal database entries and RADIUS logs for username or hostname values containing HTML or JavaScript syntax.
- Compare running configuration (config.xml) hashes against a known-good baseline to identify unauthorized modifications.
Monitoring Recommendations
- Forward pfSense system, webConfigurator, and captive portal logs to a centralized SIEM for correlation and retention.
- Alert on administrative logins followed within seconds by configuration diff events, package installations, or firewall rule additions.
- Monitor for new administrator accounts, SSH key additions, or changes to authorized_keys on the firewall.
How to Mitigate CVE-2026-78849
Immediate Actions Required
- Upgrade Netgate pfSense Plus to a version above 26.03 and pfSense CE to a version above 2.8.1 per the Netgate advisory.
- Restrict access to the pfSense WebGUI to trusted management networks only.
- Rotate WebGUI administrator credentials and invalidate active sessions after patching.
- Audit captive portal user records and remove entries containing markup or script characters.
Patch Information
Netgate has published security advisory pfSense-SA-26_05.webgui addressing the flaw in captive_portal_status.widget.php. Refer to the Netgate pfSense Security Advisory and pfSense Issue Tracker Entry #16773 for fixed release versions and upgrade procedures.
Workarounds
- Remove the Captive Portal Status widget from the pfSense dashboard until the appliance is upgraded.
- Disable the captive portal feature on affected zones if it is not required for operations.
- Enforce administrator access to the WebGUI over a dedicated management VLAN with source-IP allow-listing.
- Require administrators to use isolated browsers or dedicated jump hosts when managing pfSense.
# Configuration example: restrict WebGUI access via pfSense firewall rule (concept)
# Allow only management subnet 10.10.0.0/24 to reach the WebGUI on TCP/443
pfctl -a mgmt -f - <<EOF
block in quick on $wan_if proto tcp to (self) port 443
pass in quick on $mgmt_if proto tcp from 10.10.0.0/24 to (self) port 443
EOF
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
