Quick answers
- Is CVE-2026-111227 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-111227 being exploited in the wild.
- How severe is CVE-2026-111227?
- Medium severity, with a CVSS score of 5.5, published 15 October 2026.
- Which products and versions are affected?
- Netgate Pfsense Ce through 2.9.0.
- Is there a fix for CVE-2026-111227?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-111227 attacked?
- It is attacked with local access, in a network appliance.
- Am I affected by CVE-2026-111227?
- Check whether you run Netgate Pfsense Ce or Pfsense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A CRLF injection flaw in services_unbound_acls.php allows authenticated users with the DNS Resolver: Access Lists privilege to embed carriage return and line feed characters in the aclname or aclaction fields. This causes arbitrary Unbound configuration directives (local-data, local-zone, forward-zone) to be written to access_lists.conf, letting attackers manipulate DNS responses. The vulnerability requires prior authentication and the specific DNS Resolver ACL privilege.
Affected products
- Netgate pfSense CE through 2.9.0
Timeline
- 2026-10-15: disclosed