CVE-2026-67189 is a stored cross-site scripting vulnerability affecting pfSense Plus versions before 26.07 and pfSense CE through 2.8.1. The flaw exists in the Traffic Graphs top-talkers feature, where PTR records returned by reverse DNS lookups are not sanitized before being included in AJAX responses and rendered via a DOM sink in the administrator interface. This allows an attacker who controls a PTR record and generates sufficient traffic to appear as a top talker to execute arbitrary JavaScript in the context of an administrator's browser session. Exploitation can lead to session hijacking, unauthorized access to the firewall management interface, account creation, and arbitrary OS command execution.

Successful exploitation allows an attacker to execute arbitrary JavaScript in an administrator's browser, leading to session hijacking and same-origin access to the firewall management interface. This can result in unauthorized account creation and arbitrary operating system command execution on the firewall device, significantly compromising the security and integrity of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling or restricting access to the Traffic Graphs top-talkers feature or limit exposure of the administrative interface to trusted networks only. Monitor vendor communications for updates and apply patches promptly once released.