PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)
2026-10-22T08:52:16Z•0b3cf1f1683bb4379c0998478984adff713f38dc92710f891561e44deac3bf22
CVE-2022-0778CVE-2026-109618CVE-2026-109619CWE-22CWE-78FortiAnalyzerFortiClientFortiMailFortiManagerFortiMonitorOnSightFortiOSFortiPAMFortiProxyFortiSIEMFortiSOARFortiSandboxFortinetOpenSSLSQL-injectionarbitrary-file-writeauthentication-bypasscommand-injectioncross-site-scriptingdenial-of-serviceexploited-in-the-wildinformation-disclosurepath-traversalremote-code-execution
What happened
Fortinet security advisory feed containing numerous vulnerabilities across FortiOS, FortiProxy, FortiSIEM, FortiSandbox, FortiManager, FortiAnalyzer, FortiMail, FortiSOAR, FortiClient, FortiPAM, FortiMonitorOnSight, and related products. Issues include remote and unauthenticated authentication bypass, arbitrary file write, command injection, SQL injection, remote code execution, path traversal, information disclosure, denial of service, XSS, and certificate-validation flaws. The most urgent item is a CVSS 9.8 arbitrary file-write/path-traversal issue reported as exploited in the wild; the feed
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- fortinet_blog
- Record identifier
- 0b3cf1f1683bb4379c0998478984adff713f38dc92710f891561e44deac3bf22
- Enrichment time
- 2026-10-22T08:52:16Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.