EN PT-BR
← Voltar ao feed
high exploit público

CERT-FR: RCE flaws CVE-2026-109618 and CVE-2026-109619 listed for Tenable, Citrix NetScaler, Synology, QNAP, Belden and NetApp ONTAP

1 fonte(s) · 7 atualização(ões) · publicado 22/10/2026 21:00 · coletado há 11 horas

Matéria consolidada. Reúne 8 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que a fonte trouxe em 05/11/2026 00:09; os links antigos trazem para cá.

Fontes: cert.cyber.gouv.fr ×7 ↗

CERT-FR warned of multiple vulnerabilities that could let an attacker achieve remote arbitrary code execution. They are tracked as CVE-2026-109618 and CVE-2026-109619. The first advisory, CERTFR-2026-AVI-1370 (23 October 2026), covered Tenable Security Center and Tenable Enclave Security in versions without patch SC-202610.1 and cited Tenable bulletins tns-2026-28 and tns-2026-29 (22 October 2026) (cert.cyber.gouv.fr). A second advisory (26 October 2026) covers the same Tenable products and CVEs but refers to patch SC-202610.2 and bulletins tns-2026-30 and tns-2026-31 (23 October 2026) (cert.cyber.gouv.fr). CERT-FR has since published advisories attributing the same two CVE IDs to other vendors: Citrix NetScaler ADC and Gateway (CERTFR-2026-AVI-1394, 27 October 2026), Synology (CERTFR-2026-AVI-1435, 2 November 2026), QNAP QNE (ADRA) (CERTFR-2026-AVI-1437, 2 November 2026), Belden macmon and NRSW (CERTFR-2026-AVI-1438, 2 November 2026) and NetApp ONTAP 9 (CERTFR-2026-AVI-1446, 3 November 2026) (cert.cyber.gouv.fr). Several of these refer to an earlier CERT-FR alert, CERTFR-2026-ALE-014 (21 October 2026). None of the advisories reports active exploitation or gives CVSS scores. For Tenable, the later advisory is the more current, so defenders should treat SC-202610.2 as the target patch.

Entenda a falha

A vulnerabilidade

CVE-2026-109618 and CVE-2026-109619 are remote code execution flaws. CERT-FR lists them in advisories for Tenable Security Center and Enclave Security (without patch SC-202610.2), Citrix NetScaler ADC and Gateway (13.1 before 13.1-64.32, 14.1 before 14.1-73.49), Synology Mail Station, PHP and Calendar, QNAP QNE (ADRA) before 1.0.7.q327, Belden NRSW before 5.0.0.104 and macmon 6.x/7.x, and NetApp ONTAP 9 (9.12 to 9.19 before the HF/P releases in NTAP-20261021-0021). The advisories give no per-CVE severity, CVSS score, attack vector or authentication requirement. Citrix and Belden call them PHP flaws, but a shared root cause is not confirmed.

Como foi descoberta

The articles do not say who found the flaws or how. CERT-FR issued alert CERTFR-2026-ALE-014 on 21 October 2026, whose content is not given. Vendor bulletins followed: Belden on 22 October, Tenable on 22 and 23 October (the patch changed from SC-202610.1 to SC-202610.2, with no explanation), Citrix on 26 October, QNAP on 30 October, Synology on 31 October and NetApp on 3 November. No advisory reports active exploitation.

Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 00:25.

Exploit público

Há código de exploração publicado no Exploit-DB para CVE-2026-109618. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-52704 ↗ · remoto · php · pub. 22/10/2026 verificado

    PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE

    This script attacks PHP running under Apache mod_php (prefork) by sending crafted multipart uploads to any PHP page, abusing session upload-progress handling to corrupt memory. It needs only network access and no login, but the target must have specific settings: upload progress enabled, non-strict sessions, a low memory limit and a single worker. It leaks memory addresses via session cookies, then makes PHP run a short system command (14 bytes max). It looks like a working but fragile exploit, tuned to PHP 8.4.26 builds; the claim of all versions after 5.4 is unproven.

    CVE-2026-109618 · autor: OffSec · explicação gerada por IA

Detalhes técnicos

  • CVEs: CVE-2026-109618 and CVE-2026-109619.
  • Impact: remote arbitrary code execution. Whether authentication is required is not stated (cert.cyber.gouv.fr).
  • Affected (Tenable): Tenable Security Center and Tenable Enclave Security, in versions without the patch named in the relevant advisory.
  • Affected (Citrix, CERTFR-2026-AVI-1394, based on Citrix bulletin CTX697263 of 26 October 2026) (cert.cyber.gouv.fr):
    • NetScaler ADC 13.1-FIPS before 13.1-NDcPP 13.1.37.286
    • NetScaler ADC 13.1.x before 13.1-64.32
    • NetScaler ADC 14.1-FIPS before 14.1-73.49 FIPS
    • NetScaler ADC 14.1.x before 14.1-73.49
    • NetScaler Gateway 13.1.x before 13.1-64.32
    • NetScaler Gateway 14.1.x before 14.1-73.49
    • A Citrix blog on protecting NetScaler management access describes the CVEs as PHP vulnerabilities. The advisory gives no per-CVE attack vector, authentication requirement or severity.
  • Affected (Synology, CERTFR-2026-AVI-1435, bulletin Synology_SA_26_14 of 31 October 2026): Mail Station, PHP (7.4.x, 8.0.x, 8.1.x, 8.2.x, 8.3.x and 8.4.x, pre-patch ranges) and Synology Calendar, across DSM 6.2, 7.0/7.1 and 7.2 (cert.cyber.gouv.fr).
  • Affected (QNAP, CERTFR-2026-AVI-1437, bulletin qsa-26-19 of 30 October 2026): QNE (ADRA) versions prior to 1.0.7.q327 (cert.cyber.gouv.fr).
  • Affected (Belden, CERTFR-2026-AVI-1438, Belden PSIRT bulletin of 22 October 2026): NRSW prior to 5.0.0.104 and macmon 6.x and 7.x without the latest security correction (cert.cyber.gouv.fr).
  • Affected (NetApp, CERTFR-2026-AVI-1446, bulletin NTAP-20261021-0021): ONTAP 9 9.12.x < 9.12.1P20HF1, 9.13.x < 9.13.1P21HF1, 9.14.x < 9.14.1P18HF1, 9.15.x < 9.15.1P20HF1, 9.16.x < 9.16.1P16HF1, 9.17.x < 9.17.1P11HF1, 9.18.x < 9.18.1P8HF1, 9.19.x < 9.19.1P3HF1 or 9.19.1P4 (cert.cyber.gouv.fr).
  • No IOCs, threat actors or exploitation details are provided.

Remediação

  • Tenable: apply the fixes in the Tenable security bulletins, including patch SC-202610.2, as CERT-FR directs in its most recent advisory (cert.cyber.gouv.fr).
  • Systems patched only with SC-202610.1 should be checked against the newer bulletins (tns-2026-30 and tns-2026-31) to confirm whether SC-202610.2 is also needed. The sources do not say how the two patches relate.
  • Citrix: use bulletin CTX697263 to obtain the fixed builds and upgrade NetScaler ADC and Gateway to the versions listed above. Consult the Citrix techzone blog on protecting NetScaler management access for protective guidance (cert.cyber.gouv.fr).
  • Synology: apply the patched versions referenced in Synology_SA_26_14 (cert.cyber.gouv.fr).
  • QNAP: apply the patches in qsa-26-19 and consult CERT-FR alert CERTFR-2026-ALE-014 for prior guidance (cert.cyber.gouv.fr).
  • Belden: apply the patches in the Belden security bulletin. macmon 6.x installations must first be upgraded to 7.x before the latest patch can be applied (cert.cyber.gouv.fr).
  • NetApp: apply the hotfixes and patches referenced in NTAP-20261021-0021 (cert.cyber.gouv.fr).

Relatos divergentes

  • Patch level (Tenable): the 23 October advisory says SC-202610.1 (cert.cyber.gouv.fr). The 26 October advisory says SC-202610.2 (cert.cyber.gouv.fr). The 26 October advisory is more recent and should be preferred.
  • Vendor bulletins (Tenable): tns-2026-28 and tns-2026-29, dated 22 October, in the first advisory. tns-2026-30 and tns-2026-31, dated 23 October, in the second (cert.cyber.gouv.fr). Neither source explains the change, for example whether the later bulletins supersede the earlier ones or whether SC-202610.1 was found insufficient.
  • Scope and CVE attribution: the same two CVE IDs appear in CERT-FR advisories for six unrelated vendors (Tenable, Citrix, Synology, QNAP, Belden, NetApp) (cert.cyber.gouv.fr). The sources do not explain this. Two of them hint at a PHP link: the Citrix blog calls the CVEs PHP vulnerabilities, and the Synology advisory lists PHP among the affected components. This is not confirmed as a common root cause. Check each vendor bulletin for the exact flaw and affected builds.
  • Date inconsistency (NetApp): the advisory says bulletin NTAP-20261021-0021 was published on 3 November 2026, while the identifier suggests 21 October (cert.cyber.gouv.fr). The sources do not resolve this.
  • Exploitation status: all advisories report no active exploitation. CERT-FR alert CERTFR-2026-ALE-014 (21 October 2026) is referenced by several of them, but its content is not given in the sources.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 02/11/2026 21:00 · coletado 04/11 14:01

    CERT-FR Advisory: Multiple ONTAP 9 Vulnerabilities Enable Remote Code Execution

    ler a análise desta fonte

    CERT-FR published advisory CERTFR-2026-AVI-1446 on 03 November 2026 covering multiple vulnerabilities in NetApp ONTAP 9 that allow an attacker to achieve remote arbitrary code execution. The flaws affect a broad range of ONTAP 9.x branches, from 9.12.x through 9.19.x, prior to specific hotfixed or patched versions. The advisory references NetApp's security bulletin NTAP-20261021-0021, published the same day, and cites two CVE identifiers. Administrators are directed to the vendor bulletin for applicable fixes.

    Technical Details

    • Vulnerabilities allow remote arbitrary code execution in NetApp ONTAP 9.
    • Affected versions: 9.12.x < 9.12.1P20HF1, 9.13.x < 9.13.1P21HF1, 9.14.x < 9.14.1P18HF1, 9.15.x < 9.15.1P20HF1, 9.16.x < 9.16.1P16HF1, 9.17.x < 9.17.1P11HF1, 9.18.x < 9.18.1P8HF1, 9.19.x < 9.19.1P3HF1 or 9.19.1P4.
    • Tracked as CVE-2026-109618 and CVE-2026-109619.
    • Referenced vendor bulletin: NTAP-20261021-0021 (03 November 2026).

    Remediation

    • Apply the hotfixes/patches referenced in NetApp's security bulletin NTAP-20261021-0021.
  2. cert.cyber.gouv.fr ↗ · pub. 01/11/2026 21:00 · coletado 04/11 14:01

    CERT-FR Advisory: Critical RCE Vulnerabilities in Belden macmon and NRSW

    ler a análise desta fonte

    The French CERT-FR published advisory CERTFR-2026-AVI-1438 warning of multiple vulnerabilities in Belden macmon and NRSW that allow an attacker to achieve remote arbitrary code execution. Affected products include NRSW versions prior to 5.0.0.104 and macmon versions 6.x and 7.x without the latest security patch; Belden notes that 6.x installations must first be upgraded to 7.x before the patch can be applied. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619 and were disclosed in Belden's PSIRT bulletin of 22 October 2026, following an earlier CERT-FR alert (CERTFR-2026-ALE-014) issued 21 October 2026.

    Technical Details

    • Impact: remote arbitrary code execution.
    • Affected: NRSW < 5.0.0.104; macmon 6.x/7.x without the latest security correction.
    • CVE-2026-109618 and CVE-2026-109619.

    Remediation

    • Apply the patches referenced in Belden's official security bulletin.
    • Upgrade macmon 6.x installations to 7.x before applying the latest patch.
  3. cert.cyber.gouv.fr ↗ · pub. 01/11/2026 21:00 · coletado 04/11 14:01

    CERT-FR Advisory: QNAP QNE OS Vulnerabilities Allow Remote Code Execution

    ler a análise desta fonte

    CERT-FR published advisory CERTFR-2026-AVI-1437 detailing multiple vulnerabilities in QNAP QNE (ADRA) that allow an attacker to achieve remote arbitrary code execution. The flaws affect QNE (ADRA) versions prior to 1.0.7.q327. The advisory references QNAP's security bulletin qsa-26-19 (30 October 2026) and a prior CERT-FR alert CERTFR-2026-ALE-014 (21 October 2026). Two CVEs are tracked: CVE-2026-109618 and CVE-2026-109619.

    Technical Details

    • CVE-2026-109618 and CVE-2026-109619: enable remote code execution in QNAP QNE (ADRA).
    • Affected: QNE (ADRA) versions prior to 1.0.7.q327.

    Remediation

    • Apply the patches referenced in QNAP's security bulletin qsa-26-19.
    • Consult CERT-FR alert CERTFR-2026-ALE-014 for prior guidance.
  4. cert.cyber.gouv.fr ↗ · pub. 01/11/2026 21:00 · coletado 04/11 14:01

    CERT-FR Advisory: Multiple Synology Vulnerabilities Enable Remote Code Execution

    ler a análise desta fonte

    The French CERT-FR published advisory CERTFR-2026-AVI-1435 detailing multiple vulnerabilities in Synology products that allow an attacker to achieve remote code execution. Affected components include Mail Station, PHP (versions 7.4.x through 8.4.x), and Synology Calendar, across DSM 6.2, 7.0/7.1, and 7.2 platforms. CERT-FR references Synology's security bulletin Synology_SA_26_14, published 31 October 2026, and two associated CVEs. The advisory follows an earlier CERT-FR alert (CERTFR-2026-ALE-014) issued on 21 October 2026.

    Technical Details

    • Impact: remote arbitrary code execution.
    • Affected products: Mail Station (multiple pre-patch version ranges across DSM 6.2/7.0/7.1/7.2), PHP 7.4.x, 8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x (pre-patch ranges), Synology Calendar (pre-patch ranges across DSM 6.2/7.0/7.1/7.2).
    • Vulnerabilities: CVE-2026-109618, CVE-2026-109619.
    • Source: Synology security bulletin Synology_SA_26_14, 31 October 2026; prior CERT-FR alert CERTFR-2026-ALE-014, 21 October 2026.

    Remediation

    • Apply the patched versions referenced in Synology's security bulletin Synology_SA_26_14.
  5. cert.cyber.gouv.fr ↗ · pub. 26/10/2026 21:00 · coletado 28/10 14:01

    CERT-FR warns of multiple Citrix NetScaler ADC and Gateway RCE vulnerabilities, including PHP flaws CVE-2026-109618 and CVE-2026-109619

    ler a análise desta fonte

    CERT-FR published advisory CERTFR-2026-AVI-1394 on 27 October 2026 on multiple vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway. According to the advisory, the flaws allow an attacker to achieve remote arbitrary code execution. The advisory is based on Citrix security bulletin CTX697263 of 26 October 2026, which covers CVE-2026-109618 and CVE-2026-109619. The advisory does not report active exploitation and gives no CVSS scores or IOCs.

    Technical Details

    • CVEs referenced: CVE-2026-109618 and CVE-2026-109619. A Citrix blog on protecting NetScaler management access describes them as PHP vulnerabilities.
    • Impact listed: remote arbitrary code execution.
    • Affected versions:
      • NetScaler ADC 13.1-FIPS before 13.1-NDcPP 13.1.37.286
      • NetScaler ADC 13.1.x before 13.1-64.32
      • NetScaler ADC 14.1-FIPS before 14.1-73.49 FIPS
      • NetScaler ADC 14.1.x before 14.1-73.49
      • NetScaler Gateway 13.1.x before 13.1-64.32
      • NetScaler Gateway 14.1.x before 14.1-73.49
    • The advisory gives no per-CVE mapping of attack vectors, authentication requirements or severity.

    Remediation

    • Refer to Citrix bulletin CTX697263 to obtain the fixed builds and upgrade to the versions listed above.
    • Consult the Citrix techzone blog on protecting NetScaler management access from CVE-2026-109618 and CVE-2026-109619 for protective guidance.
  6. cert.cyber.gouv.fr ↗ · pub. 25/10/2026 21:00 · coletado 27/10 13:01

    CERT-FR: Tenable Security Center and Enclave Security vulnerabilities allow remote code execution (CVE-2026-109618, CVE-2026-109619)

    ler a análise desta fonte

    CERT-FR published an advisory on multiple vulnerabilities in Tenable products, specifically Enclave Security and Security Center without patch SC-202610.2. According to the advisory, an attacker could exploit them to achieve remote arbitrary code execution. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and are covered by Tenable bulletins tns-2026-30 and tns-2026-31, both dated 23 October 2026. The advisory does not report active exploitation and gives no CVSS scores or technical detail.

    Technical Details

    • Affected: Tenable Enclave Security and Tenable Security Center without patch SC-202610.2.
    • Impact: remote arbitrary code execution.
    • Vendor bulletins: tns-2026-30 and tns-2026-31 (23 October 2026).
    • No IOCs, threat actors or exploitation details are provided.

    Remediation

    • Apply the fixes described in the Tenable security bulletins, including patch SC-202610.2, as CERT-FR directs.
  7. cert.cyber.gouv.fr ↗ · pub. 22/10/2026 21:00 · coletado 27/10 13:01 primeiro registro

    CERT-FR flags multiple remote code execution vulnerabilities in Tenable Security Center and Enclave Security

    ler a análise desta fonte

    CERT-FR published advisory CERTFR-2026-AVI-1370 on multiple vulnerabilities in Tenable products that could let an attacker achieve remote arbitrary code execution. The affected products are Tenable Security Center and Tenable Enclave Security, in all versions without patch SC-202610.1. The advisory refers to the vendor bulletins tns-2026-28 and tns-2026-29, both dated 22 October 2026, and to two CVEs. It reports no active exploitation and gives no CVSS scores or technical detail.

    Technical Details

    • CVEs referenced: CVE-2026-109618 and CVE-2026-109619.
    • Impact class: remote arbitrary code execution. The advisory does not state whether authentication is required.
    • Affected: Tenable Security Center and Tenable Enclave Security, all versions without patch SC-202610.1.

    Remediation

    • Apply patch SC-202610.1 as described in Tenable bulletins tns-2026-28 and tns-2026-29, as CERT-FR directs.