EN PT-BR
← Voltar ao feed
critical exploit público

PHP2shell RCE flaws CVE-2026-109618/109619 hit Cisco, Tenable, Citrix, Synology, QNAP, Belden, NetApp; CISA adds both to KEV

1 fonte(s) · 8 atualização(ões) · publicado 22/10/2026 21:00 · coletado há 14 horas

Matéria consolidada. Reúne 10 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que a fonte trouxe em 09/11/2026 00:02; os links antigos trazem para cá.

Fontes: cert.cyber.gouv.fr ×8 ↗

CERT-FR warned of multiple vulnerabilities that could let an attacker achieve remote arbitrary code execution. They are tracked as CVE-2026-109618 and CVE-2026-109619. The newest advisory, CERTFR-2026-AVI-1476 (6 November 2026), relays Cisco advisory cisco-sa-php-october26-Jj384Daq (30 October 2026). It identifies the flaws as two PHP vulnerabilities disclosed by the PHP Foundation on 21 October 2026 and named PHP2shell by researchers, which explains why many vendors are affected (cert.cyber.gouv.fr, sec.cloudapps.cisco.com). CISA added both CVEs to its KEV catalog on 26 October 2026 with a 29 October due date, although Cisco PSIRT says it is not aware of malicious use against any Cisco product (sec.cloudapps.cisco.com, vulntracker.io). The first CERT-FR advisory, CERTFR-2026-AVI-1370 (23 October 2026), covered Tenable Security Center and Tenable Enclave Security in versions without patch SC-202610.1 and cited bulletins tns-2026-28 and tns-2026-29 (22 October 2026). A second advisory (26 October 2026) covers the same Tenable products but refers to patch SC-202610.2 and bulletins tns-2026-30 and tns-2026-31 (23 October 2026) (cert.cyber.gouv.fr). CERT-FR has since attributed the same CVE IDs to Citrix NetScaler ADC and Gateway (CERTFR-2026-AVI-1394, 27 October 2026), Synology (CERTFR-2026-AVI-1435, 2 November 2026), QNAP QNE (ADRA) (CERTFR-2026-AVI-1437, 2 November 2026), Belden macmon and NRSW (CERTFR-2026-AVI-1438, 2 November 2026), NetApp ONTAP 9 (CERTFR-2026-AVI-1446, 3 November 2026) and Cisco (CERTFR-2026-AVI-1476, 6 November 2026) (cert.cyber.gouv.fr). Several of these refer to an earlier CERT-FR alert, CERTFR-2026-ALE-014 (21 October 2026). For Tenable, the later advisory is the more current, so defenders should treat SC-202610.2 as the target patch. The Cisco URWB and Unified Industrial Wireless fix (26.2.1.9) was still scheduled for November 2026 at the time of the advisory.

Entenda a falha

A vulnerabilidade

CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2shell, are upstream PHP flaws that allow remote code execution, and both are in CISA's KEV catalog. CVE-2026-109618 is out-of-memory corruption; CVE-2026-109619 is stale global state left after a fatal error. Trackers say no authentication is needed. Scores of 9.2 (CVSS 4.0), 9.8 and 8.1 are reported, without saying which belongs to which CVE. Because products bundle PHP, many vendors are affected: Cisco (Duo Access Gateway before 3.2.0, Expressway before 15.5.21, ISE Portal Builder, URWB before 26.2.1.9), Citrix NetScaler ADC and Gateway (before 13.1-64.32 or 14.1-73.49), Tenable Security Center and Enclave Security (patch SC-202610.2), Synology, QNAP QNE, Belden macmon and NRSW, and NetApp ONTAP 9. Upstream fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Como funciona

A request reaches a PHP worker inside the product, for example a management or portal interface. For CVE-2026-109618, when memory runs out during request handling, PHP uses longjmp() to abort the request. This leaves internal structures partly initialised, and the later cleanup reads or branches on corrupted memory. For CVE-2026-109619, a fatal error leaves global state behind, and a worker can still reference it when it handles a later request. In both cases PHP then works with memory or state it should not trust, which can lead to execution of attacker-controlled code.

Por que é vulnerável

The root cause is unsafe error handling in PHP. Aborting with longjmp() on out-of-memory skips normal initialisation and cleanup, so later code assumes structures are consistent when they are not. Likewise, global state is not reset after a fatal error, so a later request inherits stale data. The articles do not say why this went unnoticed. The fix is patched PHP releases, which vendors bundle into their own product updates.

Onde está

Upstream the issues are tracked as GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp in php/php-src; the articles name no file or function beyond the longjmp() usage.

Como foi descoberta

The PHP Foundation disclosed the flaws on 21 October 2026, and researchers named them PHP2shell; CERT-FR issued alert CERTFR-2026-ALE-014 the same day. Vendors followed: Tenable and Belden bulletins on 22 and 23 October, Citrix on 26 October, QNAP and Cisco on 30 October, Synology on 31 October and NetApp on 3 November. CISA added both CVEs to KEV on 26 October with a 29 October due date. Cisco PSIRT says it knows of no malicious use against Cisco products, and no source gives exploitation details for any specific vendor product. The articles do not say who found the bugs.

Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 00:17.

Exploit público

Há código de exploração publicado no Exploit-DB para CVE-2026-109618. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-52704 ↗ · remoto · php · pub. 22/10/2026 verificado

    PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE

    This script attacks PHP running under Apache mod_php (prefork) by sending crafted multipart uploads to any PHP page, abusing session upload-progress handling to corrupt memory. It needs only network access and no login, but the target must have specific settings: upload progress enabled, non-strict sessions, a low memory limit and a single worker. It leaks memory addresses via session cookies, then makes PHP run a short system command (14 bytes max). It looks like a working but fragile exploit, tuned to PHP 8.4.26 builds; the claim of all versions after 5.4 is unproven.

    CVE-2026-109618 · autor: OffSec · explicação gerada por IA

Detalhes técnicos

  • CVEs: CVE-2026-109618 and CVE-2026-109619, upstream PHP flaws named PHP2shell. They are tracked upstream as GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp in php/php-src (vulntracker.io).
  • CVE-2026-109618 (RCE via out-of-memory corruption): PHP uses longjmp() to abort request handling on out-of-memory conditions, leaving internal structures partly initialised, so the subsequent cleanup reads or branches on corrupted memory. CVE-2026-109619 (RCE via stale global state): stale global state left behind after a fatal error can still be referenced by a worker on a later request (hkcert.org, configlane.io).
  • Impact: remote arbitrary code execution. Both can lead to execution of attacker-controlled code without authentication (hkcert.org, configlane.io). Earlier CERT-FR advisories did not state whether authentication is required.
  • Severity: Cisco rates its advisory Critical (sec.cloudapps.cisco.com). Third-party trackers report CVSS 4.0 scores of 9.2 and NVD-style ratings of 9.8 and 8.1; the sources do not say which score belongs to which CVE (configlane.io, vulntracker.io). The earlier CERT-FR advisories gave no CVSS scores.
  • Affected (Tenable): Tenable Security Center and Tenable Enclave Security, in versions without the patch named in the relevant advisory.
  • Affected (Cisco, CERTFR-2026-AVI-1476, advisory cisco-sa-php-october26-Jj384Daq of 30 October 2026) (cert.cyber.gouv.fr):
    • Duo Access Gateway before 3.2.0
    • Expressway Series and Expressway Select Series before 15.5.21
    • Identity Services Engine (ISE) Portal Builder (no user interaction required)
    • Ultra-Reliable Wireless Backhaul (URWB) and Unified Industrial Wireless before 26.2.1.9
    • The Cisco bug for Expressway (CSCwx37062) states the product ships a vulnerable PHP build and is affected in its default configuration, with temporary mitigations proposed (community.cisco.com). Cisco states that products not listed in the advisory are not affected.
  • Affected (Citrix, CERTFR-2026-AVI-1394, based on Citrix bulletin CTX697263 of 26 October 2026) (cert.cyber.gouv.fr):
    • NetScaler ADC 13.1-FIPS before 13.1-NDcPP 13.1.37.286
    • NetScaler ADC 13.1.x before 13.1-64.32
    • NetScaler ADC 14.1-FIPS before 14.1-73.49 FIPS
    • NetScaler ADC 14.1.x before 14.1-73.49
    • NetScaler Gateway 13.1.x before 13.1-64.32
    • NetScaler Gateway 14.1.x before 14.1-73.49
    • A Citrix blog on protecting NetScaler management access describes the CVEs as PHP vulnerabilities. The advisory gives no per-CVE attack vector, authentication requirement or severity.
  • Affected (Synology, CERTFR-2026-AVI-1435, bulletin Synology_SA_26_14 of 31 October 2026): Mail Station, PHP (7.4.x, 8.0.x, 8.1.x, 8.2.x, 8.3.x and 8.4.x, pre-patch ranges) and Synology Calendar, across DSM 6.2, 7.0/7.1 and 7.2 (cert.cyber.gouv.fr).
  • Affected (QNAP, CERTFR-2026-AVI-1437, bulletin qsa-26-19 of 30 October 2026): QNE (ADRA) versions prior to 1.0.7.q327 (cert.cyber.gouv.fr).
  • Affected (Belden, CERTFR-2026-AVI-1438, Belden PSIRT bulletin of 22 October 2026): NRSW prior to 5.0.0.104 and macmon 6.x and 7.x without the latest security correction (cert.cyber.gouv.fr).
  • Affected (NetApp, CERTFR-2026-AVI-1446, bulletin NTAP-20261021-0021): ONTAP 9 9.12.x < 9.12.1P20HF1, 9.13.x < 9.13.1P21HF1, 9.14.x < 9.14.1P18HF1, 9.15.x < 9.15.1P20HF1, 9.16.x < 9.16.1P16HF1, 9.17.x < 9.17.1P11HF1, 9.18.x < 9.18.1P8HF1, 9.19.x < 9.19.1P3HF1 or 9.19.1P4 (cert.cyber.gouv.fr).
  • No IOCs or threat actors are provided.

Remediação

  • Tenable: apply the fixes in the Tenable security bulletins, including patch SC-202610.2, as CERT-FR directs in its most recent advisory (cert.cyber.gouv.fr).
  • Systems patched only with SC-202610.1 should be checked against the newer bulletins (tns-2026-30 and tns-2026-31) to confirm whether SC-202610.2 is also needed. The sources do not say how the two patches relate.
  • Cisco: upgrade Duo Access Gateway to 3.2.0 or later, Expressway Series and Expressway Select Series to 15.5.21 or later, and apply the Cisco-supplied fix for ISE Portal Builder. The URWB and Unified Industrial Wireless fixes arrive in 26.2.1.9, expected in November 2026, so apply the interim workarounds Cisco documents until then (cert.cyber.gouv.fr, sec.cloudapps.cisco.com).
  • Citrix: use bulletin CTX697263 to obtain the fixed builds and upgrade NetScaler ADC and Gateway to the versions listed above. Consult the Citrix techzone blog on protecting NetScaler management access for protective guidance (cert.cyber.gouv.fr).
  • Synology: apply the patched versions referenced in Synology_SA_26_14 (cert.cyber.gouv.fr).
  • QNAP: apply the patches in qsa-26-19 and consult CERT-FR alert CERTFR-2026-ALE-014 for prior guidance (cert.cyber.gouv.fr).
  • Belden: apply the patches in the Belden security bulletin. macmon 6.x installations must first be upgraded to 7.x before the latest patch can be applied (cert.cyber.gouv.fr).
  • NetApp: apply the hotfixes and patches referenced in NTAP-20261021-0021 (cert.cyber.gouv.fr).
  • Non-vendor PHP deployments should move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart workers (rescana.com, enterprotect.com).
  • Given the KEV listing, prioritise internet-facing systems.

Relatos divergentes

  • Patch level (Tenable): the 23 October advisory says SC-202610.1 (cert.cyber.gouv.fr). The 26 October advisory says SC-202610.2 (cert.cyber.gouv.fr). The 26 October advisory is more recent and should be preferred.
  • Vendor bulletins (Tenable): tns-2026-28 and tns-2026-29, dated 22 October, in the first advisory. tns-2026-30 and tns-2026-31, dated 23 October, in the second (cert.cyber.gouv.fr). Neither source explains the change, for example whether the later bulletins supersede the earlier ones or whether SC-202610.1 was found insufficient.
  • Scope and CVE attribution: the same two CVE IDs appear in CERT-FR advisories for seven unrelated vendors (Tenable, Citrix, Synology, QNAP, Belden, NetApp, Cisco) (cert.cyber.gouv.fr). The Cisco advisory, the most recent source, explains that they are upstream PHP flaws disclosed by the PHP Foundation on 21 October 2026, which accounts for the breadth (sec.cloudapps.cisco.com). The Citrix blog and the Synology PHP component are consistent with this, but the Tenable, QNAP, Belden and NetApp advisories do not state the PHP link. Check each vendor bulletin for the exact affected builds.
  • Exploitation status: earlier CERT-FR advisories reported no active exploitation. The most recent source says CISA added both CVEs to KEV on 26 October 2026 (due 29 October), which indicates exploitation of the upstream PHP flaws in the wild, while Cisco PSIRT says it is not aware of malicious use against any Cisco product (sec.cloudapps.cisco.com, vulntracker.io). The KEV listing is the more recent and authoritative signal for PHP in general, but no source gives exploitation details, and no exploitation is confirmed for any specific vendor product. CERT-FR alert CERTFR-2026-ALE-014 (21 October 2026) is referenced by several advisories, but its content is not given in the sources.
  • Date inconsistency (NetApp): the advisory says bulletin NTAP-20261021-0021 was published on 3 November 2026, while the identifier suggests 21 October (cert.cyber.gouv.fr). The sources do not resolve this.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 05/11/2026 21:00 · coletado 08/11 11:00

    CERT-FR advisory CERTFR-2026-AVI-1476: Cisco patches PHP2shell RCE flaws CVE-2026-109618/109619 in Expressway, Duo Access Gateway, ISE and URWB

    ler a análise desta fonte

    CERT-FR published advisory CERTFR-2026-AVI-1476 on 6 November 2026 relaying Cisco security advisory cisco-sa-php-october26-Jj384Daq of 30 October 2026, which covers two PHP vulnerabilities allowing remote arbitrary code execution in multiple Cisco products. The flaws are CVE-2026-109618 (RCE via out-of-memory corruption) and CVE-2026-109619 (RCE via stale global state), disclosed by the PHP Foundation on 21 October 2026 and named PHP2shell by researchers (sec.cloudapps.cisco.com). Cisco rates the advisory Critical and lists workarounds as available; the affected products named by CERT-FR are Duo Access Gateway before 3.2.0, Expressway Series and Expressway Select Series before 15.5.21, Identity Services Engine (ISE) Portal Builder (no user interaction required), and Ultra-Reliable Wireless Backhaul (URWB) and Unified Industrial Wireless before 26.2.1.9, whose fix is scheduled for November 2026. CISA added both CVEs to its KEV catalog on 26 October 2026 with a 29 October due date, although Cisco PSIRT states it is not aware of malicious use against any Cisco product (sec.cloudapps.cisco.com, vulntracker.io). The combination of unauthenticated remote code execution, exploitation of the upstream PHP flaws in the wild and the absence of a fixed release for the wireless backhaul products makes this an urgent patching item.

    Technical Details

    CVE-2026-109618 stems from PHP using longjmp() to abort request handling on out-of-memory conditions, leaving internal structures partly initialised so that the subsequent cleanup reads or branches on corrupted memory; CVE-2026-109619 comes from stale global state left behind after a fatal error, which a worker can still reference on a later request (hkcert.org, configlane.io). Both can lead to execution of attacker-controlled code without authentication; third-party trackers report CVSS 4.0 scores of 9.2 and NVD-style ratings of 9.8 and 8.1 (configlane.io, vulntracker.io). The Cisco bug for Expressway (CSCwx37062) states the product ships a vulnerable PHP build and is affected in its default configuration, with temporary mitigations proposed (community.cisco.com). Upstream, the issues are tracked as GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp in php/php-src (vulntracker.io).

    Remediation

    Upgrade Duo Access Gateway to 3.2.0 or later, Expressway Series and Expressway Select Series to 15.5.21 or later, and apply the Cisco-supplied fix for ISE Portal Builder; URWB and Unified Industrial Wireless fixes land in 26.2.1.9, expected in November 2026, so apply the interim workarounds Cisco documents until then. Cisco states that products not listed in the advisory are not affected. Non-Cisco PHP deployments should move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart workers (rescana.com, enterprotect.com).

  2. cert.cyber.gouv.fr ↗ · pub. 02/11/2026 21:00 · coletado 04/11 14:01

    CERT-FR Advisory: Multiple ONTAP 9 Vulnerabilities Enable Remote Code Execution

    ler a análise desta fonte

    CERT-FR published advisory CERTFR-2026-AVI-1446 on 03 November 2026 covering multiple vulnerabilities in NetApp ONTAP 9 that allow an attacker to achieve remote arbitrary code execution. The flaws affect a broad range of ONTAP 9.x branches, from 9.12.x through 9.19.x, prior to specific hotfixed or patched versions. The advisory references NetApp's security bulletin NTAP-20261021-0021, published the same day, and cites two CVE identifiers. Administrators are directed to the vendor bulletin for applicable fixes.

    Technical Details

    • Vulnerabilities allow remote arbitrary code execution in NetApp ONTAP 9.
    • Affected versions: 9.12.x < 9.12.1P20HF1, 9.13.x < 9.13.1P21HF1, 9.14.x < 9.14.1P18HF1, 9.15.x < 9.15.1P20HF1, 9.16.x < 9.16.1P16HF1, 9.17.x < 9.17.1P11HF1, 9.18.x < 9.18.1P8HF1, 9.19.x < 9.19.1P3HF1 or 9.19.1P4.
    • Tracked as CVE-2026-109618 and CVE-2026-109619.
    • Referenced vendor bulletin: NTAP-20261021-0021 (03 November 2026).

    Remediation

    • Apply the hotfixes/patches referenced in NetApp's security bulletin NTAP-20261021-0021.
  3. cert.cyber.gouv.fr ↗ · pub. 01/11/2026 21:00 · coletado 04/11 14:01

    CERT-FR Advisory: Critical RCE Vulnerabilities in Belden macmon and NRSW

    ler a análise desta fonte

    The French CERT-FR published advisory CERTFR-2026-AVI-1438 warning of multiple vulnerabilities in Belden macmon and NRSW that allow an attacker to achieve remote arbitrary code execution. Affected products include NRSW versions prior to 5.0.0.104 and macmon versions 6.x and 7.x without the latest security patch; Belden notes that 6.x installations must first be upgraded to 7.x before the patch can be applied. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619 and were disclosed in Belden's PSIRT bulletin of 22 October 2026, following an earlier CERT-FR alert (CERTFR-2026-ALE-014) issued 21 October 2026.

    Technical Details

    • Impact: remote arbitrary code execution.
    • Affected: NRSW < 5.0.0.104; macmon 6.x/7.x without the latest security correction.
    • CVE-2026-109618 and CVE-2026-109619.

    Remediation

    • Apply the patches referenced in Belden's official security bulletin.
    • Upgrade macmon 6.x installations to 7.x before applying the latest patch.
  4. cert.cyber.gouv.fr ↗ · pub. 01/11/2026 21:00 · coletado 04/11 14:01

    CERT-FR Advisory: QNAP QNE OS Vulnerabilities Allow Remote Code Execution

    ler a análise desta fonte

    CERT-FR published advisory CERTFR-2026-AVI-1437 detailing multiple vulnerabilities in QNAP QNE (ADRA) that allow an attacker to achieve remote arbitrary code execution. The flaws affect QNE (ADRA) versions prior to 1.0.7.q327. The advisory references QNAP's security bulletin qsa-26-19 (30 October 2026) and a prior CERT-FR alert CERTFR-2026-ALE-014 (21 October 2026). Two CVEs are tracked: CVE-2026-109618 and CVE-2026-109619.

    Technical Details

    • CVE-2026-109618 and CVE-2026-109619: enable remote code execution in QNAP QNE (ADRA).
    • Affected: QNE (ADRA) versions prior to 1.0.7.q327.

    Remediation

    • Apply the patches referenced in QNAP's security bulletin qsa-26-19.
    • Consult CERT-FR alert CERTFR-2026-ALE-014 for prior guidance.
  5. cert.cyber.gouv.fr ↗ · pub. 01/11/2026 21:00 · coletado 04/11 14:01

    CERT-FR Advisory: Multiple Synology Vulnerabilities Enable Remote Code Execution

    ler a análise desta fonte

    The French CERT-FR published advisory CERTFR-2026-AVI-1435 detailing multiple vulnerabilities in Synology products that allow an attacker to achieve remote code execution. Affected components include Mail Station, PHP (versions 7.4.x through 8.4.x), and Synology Calendar, across DSM 6.2, 7.0/7.1, and 7.2 platforms. CERT-FR references Synology's security bulletin Synology_SA_26_14, published 31 October 2026, and two associated CVEs. The advisory follows an earlier CERT-FR alert (CERTFR-2026-ALE-014) issued on 21 October 2026.

    Technical Details

    • Impact: remote arbitrary code execution.
    • Affected products: Mail Station (multiple pre-patch version ranges across DSM 6.2/7.0/7.1/7.2), PHP 7.4.x, 8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x (pre-patch ranges), Synology Calendar (pre-patch ranges across DSM 6.2/7.0/7.1/7.2).
    • Vulnerabilities: CVE-2026-109618, CVE-2026-109619.
    • Source: Synology security bulletin Synology_SA_26_14, 31 October 2026; prior CERT-FR alert CERTFR-2026-ALE-014, 21 October 2026.

    Remediation

    • Apply the patched versions referenced in Synology's security bulletin Synology_SA_26_14.
  6. cert.cyber.gouv.fr ↗ · pub. 26/10/2026 21:00 · coletado 28/10 14:01

    CERT-FR warns of multiple Citrix NetScaler ADC and Gateway RCE vulnerabilities, including PHP flaws CVE-2026-109618 and CVE-2026-109619

    ler a análise desta fonte

    CERT-FR published advisory CERTFR-2026-AVI-1394 on 27 October 2026 on multiple vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway. According to the advisory, the flaws allow an attacker to achieve remote arbitrary code execution. The advisory is based on Citrix security bulletin CTX697263 of 26 October 2026, which covers CVE-2026-109618 and CVE-2026-109619. The advisory does not report active exploitation and gives no CVSS scores or IOCs.

    Technical Details

    • CVEs referenced: CVE-2026-109618 and CVE-2026-109619. A Citrix blog on protecting NetScaler management access describes them as PHP vulnerabilities.
    • Impact listed: remote arbitrary code execution.
    • Affected versions:
      • NetScaler ADC 13.1-FIPS before 13.1-NDcPP 13.1.37.286
      • NetScaler ADC 13.1.x before 13.1-64.32
      • NetScaler ADC 14.1-FIPS before 14.1-73.49 FIPS
      • NetScaler ADC 14.1.x before 14.1-73.49
      • NetScaler Gateway 13.1.x before 13.1-64.32
      • NetScaler Gateway 14.1.x before 14.1-73.49
    • The advisory gives no per-CVE mapping of attack vectors, authentication requirements or severity.

    Remediation

    • Refer to Citrix bulletin CTX697263 to obtain the fixed builds and upgrade to the versions listed above.
    • Consult the Citrix techzone blog on protecting NetScaler management access from CVE-2026-109618 and CVE-2026-109619 for protective guidance.
  7. cert.cyber.gouv.fr ↗ · pub. 25/10/2026 21:00 · coletado 27/10 13:01

    CERT-FR: Tenable Security Center and Enclave Security vulnerabilities allow remote code execution (CVE-2026-109618, CVE-2026-109619)

    ler a análise desta fonte

    CERT-FR published an advisory on multiple vulnerabilities in Tenable products, specifically Enclave Security and Security Center without patch SC-202610.2. According to the advisory, an attacker could exploit them to achieve remote arbitrary code execution. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and are covered by Tenable bulletins tns-2026-30 and tns-2026-31, both dated 23 October 2026. The advisory does not report active exploitation and gives no CVSS scores or technical detail.

    Technical Details

    • Affected: Tenable Enclave Security and Tenable Security Center without patch SC-202610.2.
    • Impact: remote arbitrary code execution.
    • Vendor bulletins: tns-2026-30 and tns-2026-31 (23 October 2026).
    • No IOCs, threat actors or exploitation details are provided.

    Remediation

    • Apply the fixes described in the Tenable security bulletins, including patch SC-202610.2, as CERT-FR directs.
  8. cert.cyber.gouv.fr ↗ · pub. 22/10/2026 21:00 · coletado 27/10 13:01 primeiro registro

    CERT-FR flags multiple remote code execution vulnerabilities in Tenable Security Center and Enclave Security

    ler a análise desta fonte

    CERT-FR published advisory CERTFR-2026-AVI-1370 on multiple vulnerabilities in Tenable products that could let an attacker achieve remote arbitrary code execution. The affected products are Tenable Security Center and Tenable Enclave Security, in all versions without patch SC-202610.1. The advisory refers to the vendor bulletins tns-2026-28 and tns-2026-29, both dated 22 October 2026, and to two CVEs. It reports no active exploitation and gives no CVSS scores or technical detail.

    Technical Details

    • CVEs referenced: CVE-2026-109618 and CVE-2026-109619.
    • Impact class: remote arbitrary code execution. The advisory does not state whether authentication is required.
    • Affected: Tenable Security Center and Tenable Enclave Security, all versions without patch SC-202610.1.

    Remediation

    • Apply patch SC-202610.1 as described in Tenable bulletins tns-2026-28 and tns-2026-29, as CERT-FR directs.