Is CVE-2026-111233 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111233?

CVE-2026-111233 has a CVSS v3 severity of MEDIUM (4.7).

Back

CVE-2026-111233

Description

Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewall rules privileges into opening a crafted GET link to execute script in the WebGUI with their privileges.