PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)
2026-10-24T08:52:16Z•f07e86246210b709a321d7678db02092313c82ceb76482f611582d898de0f98f
CVE-2022-0778CVE-2026-109618CVE-2026-109619FortiAnalyzerFortiClientFortiMailFortiManagerFortiMonitorOnSightFortiOSFortiPAMFortiProxyFortiSIEMFortiSOARFortiSandboxFortinetOpenSSLPSIRTSQL-injectionXSSaccess-controlarbitrary-file-writeauthentication-bypasscommand-injectiondenial-of-serviceexploited-in-the-wildpath-traversalremote-code-execution
What happened
Fortinet PSIRT feed containing numerous advisories affecting FortiOS, FortiProxy, FortiSIEM, FortiSandbox, FortiManager, FortiAnalyzer, FortiMail, FortiSOAR, FortiClient, FortiPAM, FortiMonitorOnSight, and related products. Issues include unauthenticated remote code execution, arbitrary file write, authentication bypass, SQL and OS command injection, path traversal, access-control flaws, XSS, denial of service, and OpenSSL certificate-parsing DoS. The most urgent entry is an unauthenticated arbitrary file-write vulnerability reportedly exploited in the wild; several other vulnerabilities have
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- fortinet_blog
- Record identifier
- f07e86246210b709a321d7678db02092313c82ceb76482f611582d898de0f98f
- Enrichment time
- 2026-10-24T08:52:16Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.