PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)
2026-10-23T08:52:15Z•4d62680def25d5869ee2a1f917ffa1bb53de13f14c63b05002781886320d1f63
CVE-2022-0778CVE-2026-109618CVE-2026-109619FortiAnalyzerFortiClientFortiMailFortiManagerFortiMonitorOnSightFortiOSFortiPAMFortiProxyFortiSIEMFortiSOARFortiSandboxFortinetPHPSQL-injectionXSSaccess-controlarbitrary-file-writeauthentication-bypasscommand-injectiondenial-of-serviceexploited-in-the-wildinformation-disclosureman-in-the-middlepath-traversalremote-code-execution
What happened
Fortinet security advisories disclose numerous vulnerabilities across FortiOS, FortiProxy, FortiSIEM, FortiSandbox, FortiManager, FortiAnalyzer, FortiMail, FortiSOAR, FortiClient, FortiMonitorOnSight, FortiPAM, and PHP core. The issues include unauthenticated remote code execution, arbitrary file write, authentication bypass, SQL and OS command injection, path traversal, authorization flaws, information disclosure, denial of service, XSS, and certificate-validation weaknesses. Several vulnerabilities have critical CVSS scores up to 9.9, and one arbitrary-file-write issue is reported as being3x
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- fortinet_blog
- Record identifier
- 4d62680def25d5869ee2a1f917ffa1bb53de13f14c63b05002781886320d1f63
- Enrichment time
- 2026-10-23T08:52:15Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.