PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)
2026-10-24T20:52:16Z•306bcf92ff07fe374eca68c41794d3b415b4393849ade3a8f828b2932b00bc6f
CVE-2022-0778CVE-2026-109618CVE-2026-109619FortiAnalyzerFortiClientFortiMailFortiManagerFortiMonitorFortiOSFortiPAMFortiProxyFortiSIEMFortiSOARFortiSandboxFortinetOpenSSLPHPPSIRTSQL-injectionaccess-controlactively-exploitedarbitrary-file-writeauthentication-bypasscommand-injectioncross-site-scriptingdenial-of-servicepath-traversalremote-code-execution
What happened
Fortinet PSIRT advisories covering multiple products and vulnerability classes, including several critical unauthenticated authentication bypass, arbitrary file write, command execution, and remote code execution issues. The collection includes PHP core RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619 (CVSS 9.8), a FortiSIEM path traversal enabling unauthenticated code execution (CVSS 9.4), an actively exploited Fortinet path traversal/NULL-byte issue enabling arbitrary file writes (CVSS 9.8), and other access-control, injection, denial-of-service, XSS, and cryptographic weaknesses. The
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- fortinet_blog
- Record identifier
- 306bcf92ff07fe374eca68c41794d3b415b4393849ade3a8f828b2932b00bc6f
- Enrichment time
- 2026-10-24T20:52:16Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.