Is CVE-2026-111222 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111222 being exploited in the wild.

How severe is CVE-2026-111222?

Medium severity, with a CVSS score of 6.6, published 15 October 2026.

Which products and versions are affected?

Netgate Pfsense Ce through 2.9.0.

Is there a fix for CVE-2026-111222?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-111222 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-111222?

Check whether you run Netgate Pfsense Ce or Pfsense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111222: Netgate pfSense CE php.ini injection via timezone

CVE-2026-111222 · Severity: medium · CVSS 6.6 · Published 2026-10-15

pfSense CE is a firewall appliance that protects networks through its web-based management interface. An authenticated administrator with General Setup privileges can inject malicious PHP configuration directives via the timezone field, allowing remote code execution as the root user when PHP-FPM restarts or the system boots. This gives attackers complete control over the firewall and all systems it protects.

Technologies: Netgate Pfsense Ce, Pfsense. Vendors: Netgate, Pfsense.

Quick answers

Is CVE-2026-111222 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111222 being exploited in the wild.
How severe is CVE-2026-111222?: Medium severity, with a CVSS score of 6.6, published 15 October 2026.
Which products and versions are affected?: Netgate Pfsense Ce through 2.9.0.
Is there a fix for CVE-2026-111222?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-111222 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-111222?: Check whether you run Netgate Pfsense Ce or Pfsense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a php.ini injection flaw in pfSense CE's General Setup timezone configuration. An authenticated user with appropriate privileges can embed a quote character and newline in the timezone value to inject auto_prepend_file directives pointing to /var/db/zoneinfo, causing arbitrary PHP code execution as root after the php.ini file is regenerated at boot or php-fpm restart. Authentication and privilege level are required; no network-based unauthenticated attack exists.

Affected products

Netgate pfSense CE through 2.9.0

Timeline

2026-10-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.