CVE-2026-78849

Netgate pfSense Plus software versions up to 26.03 and pfSense CE versions up to 2.8.1 are vulnerable to a Cross Site Scripting (XSS) flaw that can be exploited by remote attackers through the captive_portal_status.widget.php file, potentially allowing them to execute arbitrary code. Organizations using these versions of pfSense should prioritize remediation to mitigate the risk of unauthorized access and code execution.