CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
Affected products
php: php; canonical: ubuntu linux; debian: debian linux; fedoraproject: fedora; tenable: tenable.sc; redhat: software collections; redhat: enterprise linux; redhat: enterprise linux desktop; redhat: enterprise linux eus; redhat: enterprise linux eus compute node; redhat: enterprise linux for arm 64; redhat: enterprise linux for arm 64 eus; redhat: enterprise linux for ibm z systems; redhat: enterprise linux for ibm z systems eus; redhat: enterprise linux for power big endian
References10
- bugs.php.net/bug.php?id=78599 ExploitIssue TrackingPatchVendor Advisory
- bugs.php.net/bug.php?id=78599 ExploitIssue TrackingPatchVendor Advisory
- packetstormsecurity.com/files/156642/PHP-FPM-7.x-Remote-Code-Ex… ExploitThird Party AdvisoryVDB Entry
- github.com/neex/phuip-fpizdam ExploitThird Party Advisory
- packetstormsecurity.com/files/156642/PHP-FPM-7.x-Remote-Code-Ex… ExploitThird Party AdvisoryVDB Entry
- github.com/neex/phuip-fpizdam ExploitThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-11/msg00011.… Mailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-11/msg00014.… Mailing ListThird Party Advisory
- seclists.org/fulldisclosure/2020/Jan/40 Mailing ListThird Party Advisory
- access.redhat.com/errata/RHSA-2019:3286 Third Party Advisory
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 100% percentile: 100 · as of 10 November 2026
- CWE
- CWE-120CWE-787
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.