Home / Items
Vendor advisoryKnown exploitedSeverity 9.8 criticalExploit likelihood 100%
PHP2Shell Critical Vulnerabilities
2NGA003224 · ABB · October 30, 2026
Summary
ABB is aware of publicly reported information concerning recently disclosed PHP vulnerabilities that impact the product versions listed as affected in the advisory.
An attacker who successfully exploited this vulnerability may insert and run arbitrary code on affected products.
As part of ABB product lifecycle policy, once a product transitions to obsolete state, we discontinue maintenance, security patches, and technical support to focus on current and future technologies. While the product will continue to function, we strongly recommend implementing the mitigations de-fined in this document to reduce security risks.
From ABB (vendor's own words, quoted), quoted as published. Check the source before acting.
What to do
Mitigating factors describe conditions and circumstances that make an attack that exploits vulnerability difficult or less likely to succeed.
- Obtain a private cellular Access Point (private APN). A dedicated private APN and the corresponding SIM card subscriptions can be obtained from your cellular service provider. This service does not expose traffic between remote sites and the main site to the Internet. Instead, communication is carried over the cellular operator’s private wide area network (WAN). Therefore, the ARM600 does not require any inbound ports to be exposed to the…
As the affected products are in the obsolete lifecycle state, ABB will not provide a security update for these vulnerabilities. ABB strongly recommends implementing the measures described in the sections Mitigating factors and General security recommendations.
Vendor fix or mitigation, quoted from the advisory.
Each CVE in this advisory
| CVE | Severity | Known exploited | Exploit likelihood |
|---|---|---|---|
| CVE-2026-109618 | 9.8 critical | Exploited | 100.0% |
| CVE-2026-109619 | 8.1 high | Exploited | 100.0% |
Severity from the advisory (CVSS), known exploitation from CISA's catalog, exploit likelihood from EPSS (next 30 days).
Affected products
| Vendor | Product |
|---|---|
| ABB | ARG600 ARG600A1220NA |
| ABB | ARG600 ARG600A1230NA |
| ABB | ARG600 ARG600A1240NA |
| ABB | ARG600 ARG600A1260NA |
| ABB | ARG600 ARG600A2622NA |
| ABB | ARG600 ARG600A2625NA |
| ABB | ARP600 ARP600A2200NA |
| ABB | ARP600 ARP600A2220NA |
| ABB | ARP600 ARP600A2250NA |
| ABB | ARP600 ARP600A2260NA |
| ABB | ARP600 ARP600A2651NA |
| ABB | ARP600 ARP600A2560NA |
| ABB | ARR600 ARR600A3201NA |
| ABB | ARR600 ARR600A3202NA |
| ABB | ARR600 ARR600A3221NA |
| ABB | ARR600 ARR600A3222NA |
| ABB | ARR600 ARR600A3251NA |
| ABB | ARR600 ARR600A3252NA |
| ABB | ARR600 ARR600A3261NA |
| ABB | ARR600 ARR600A3262NA |
| ABB | ARC600 ARC600A2325NA |
| ABB | ARC600 ARC600A2323NA |
| ABB | ARC600 ARC600A2324NA |
| ABB | ARM600 ARM600A2500NA |
| ABB | ARM600 ARM600B2500NA |
| ABB | ARM600 ARM600C2500NA |
| ABB | ARM600 ARM600A2505NA |
| ABB | ARM600 ARM600B2505NA |
| ABB | ARM600 ARM600C2505NA |
| ABB | ARM600 SW ARM600SW1A1 |
| ABB | ARM600 SW ARM600SW2A3 |
| ABB | ARM600 SW ARM600SW3A3 |
Why it's on these mode pages
- Pipeline: Vendor table: ABB (matched by rule)
Change history
- October 30, 2026: Initial version.
- November 9, 2026: First collected by Watch
Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com