THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-56126 (MEDIUM 5.4) — pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /status_monitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, reso

[NVD] CVE-2026-56126 (MEDIUM 5.4) — pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /status_monitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, reso

mednvdPublished 2026-09-03

CVE-2026-56126 CVSS: 5.4 MEDIUM Published: 2026-09-03T15:17:30.630

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /status_monitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-date, end-date, start-time, end-time,

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-56126cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-56126