Is CVE-2026-91768 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91768 being exploited in the wild.

How severe is CVE-2026-91768?

Medium severity, with a CVSS score of 6.5, published 25 September 2026.

Which products and versions are affected?

PHP-FPM <8.2.34, <8.3.35, <8.4.26, <8.5.11.

Is there a fix for CVE-2026-91768?

A patch was published on 2026-09-24: Patched in versions 8.2.34, 8.3.35, 8.4.26, 8.5.11 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-91768 attacked?

It is attacked from the adjacent network.

Am I affected by CVE-2026-91768?

Check whether you run PHP-FPM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91768: PHP FastCGI access control bypass in IPv6 address comparison

Q: Which products and versions are affected?

PHP-FPM <8.2.34, <8.3.35, <8.4.26, <8.5.11.

Q: Is there a fix for CVE-2026-91768?

A patch was published on 2026-09-24: Patched in versions 8.2.34, 8.3.35, 8.4.26, 8.5.11 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-91768 attacked?

It is attacked from the adjacent network.

Q: Am I affected by CVE-2026-91768?

Check whether you run PHP-FPM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91768 · Severity: medium · CVSS 6.5 · Published 2026-09-25

PHP-FPM's FastCGI server uses an incomplete comparison of IPv6 addresses when enforcing access control lists, only checking the first 96 bits instead of the full address. An attacker on the same /96 IPv6 network as an allowed client can bypass the access control and execute arbitrary PHP code on the server. This affects deployments that rely on listen.allowed_clients for FastCGI security boundaries over IPv6 TCP connections.

Vendors: PHP.

Quick answers

Is CVE-2026-91768 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91768 being exploited in the wild.
How severe is CVE-2026-91768?: Medium severity, with a CVSS score of 6.5, published 25 September 2026.
Which products and versions are affected?: PHP-FPM <8.2.34, <8.3.35, <8.4.26, <8.5.11.
Is there a fix for CVE-2026-91768?: A patch was published on 2026-09-24: Patched in versions 8.2.34, 8.3.35, 8.4.26, 8.5.11 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-91768 attacked?: It is attacked from the adjacent network.
Am I affected by CVE-2026-91768?: Check whether you run PHP-FPM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The fcgi_is_allowed() function in main/fastcgi.c compares only 12 bytes of a 16-byte IPv6 address instead of the full struct in6_addr, effectively widening ACL entries to /96 prefixes. An attacker who can source an IPv6 address sharing the first 96 bits with an allowed client passes the check and reaches the FastCGI endpoint with the privileges of the FPM worker process. Unix socket, IPv4-only, and firewall-protected deployments are unaffected.

Affected products

PHP PHP-FPM <8.2.34, <8.3.35, <8.4.26, <8.5.11

Timeline

2026-09-24: disclosed
2026-09-24: patched: Patched in versions 8.2.34, 8.3.35, 8.4.26, 8.5.11

References

https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.