CVE-2026-78849: n/a

This vulnerability is a Cross Site Scripting (CWE-79) flaw in the captive_portal_status.widget.php component of Netgate pfSense Plus and pfSense CE software. It affects versions up to 26.03 for pfSense Plus and up to 2.8.1 for pfSense CE. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary code by injecting malicious scripts. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and low impact on confidentiality and integrity with no impact on availability.

Successful exploitation could allow an attacker to execute arbitrary code in the context of the vulnerable web interface, potentially leading to limited confidentiality and integrity impacts. There is no indication of availability impact. The vulnerability requires user interaction and can be exploited remotely without privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with captive portal interfaces and consider restricting access or applying temporary mitigations as recommended by the vendor once available.