CVE-2026-111222 Netgate CVE debrief

Who should care

System administrators and defenders responsible for pfSense CE installations, particularly those with untrusted or internet-exposed management interfaces, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-111222 is a high-severity vulnerability in Netgate pfSense CE through 2.9.0, allowing authenticated users to inject php.ini directives and execute PHP as root. Defenders should prioritize verification and remediation, particularly for untrusted or internet-exposed management interfaces.

• Execution of PHP as root after php.ini regeneration
• Potential for privilege escalation and system compromise
• Need for input validation and sanitization of timezone values
• Verification of pfSense CE version and user activity monitoring

Technical summary

The vulnerability exists in Netgate pfSense CE through 2.9.0, allowing authenticated users with General Setup privileges to inject php.ini directives via unvalidated timezone values. This can lead to execution of PHP as root after php.ini regeneration at boot or php-fpm restart. Defenders should prioritize verifying and remediating this vulnerability in pfSense CE installations, particularly those with untrusted or internet-exposed management interfaces, by verifying the pfSense CE version, restricting timezone input validation and sanitization, and monitoring php.ini regeneration and php-fpm restarts for suspicious activity.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in pfSense CE installations, particularly those with untrusted or internet-exposed management interfaces.

Recommended defensive actions

• Verify pfSense CE version and check for General Setup privilege abuse
• Restrict timezone input validation and sanitization
• Monitor php.ini regeneration and php-fpm restarts for suspicious activity
• Implement additional logging and monitoring for user activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 7.5 and HIGH severity. References include links to issue tracking, third-party advisories, and product source code.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.