Home / Items
Vendor advisoryKnown exploitedSeverity 9.8 criticalExploit likelihood 100%
IPEC Standalone iSM PHP2Shell and NTFS-3G Vulnerabilities
4TLB000837 · ABB · November 6, 2026
Summary
ABB is aware of public reports of vulnerabilities in third-party components (PHP and NTFS-3G) included in the product versions listed as affected in the advisory.
An attacker who successfully exploited these vulnerabilities may insert and run arbitrary code on affected products.
No active exploitations of the vulnerabilities have been reported to ABB by the time of writing this document. ABB will inform affected customers if this changes.
From ABB (vendor's own words, quoted), quoted as published. Check the source before acting.
What to do
For the products and version numbers listed below, please apply the relevant software patches according to the instructions provided by your ABB contact.
- IPEC iSM Local Server: Debian 11 (Bullseye)
- IPEC iSM Local Server: Debian 12 (Bookworm)
- IPEC iSM Local Server: Debian 13 (Trixie)
If further support is required to install the patches, please contact IPEC Sales ([email protected]). Installation support may be chargeable where not covered by your existing warranty, maintenance or support agreement.
ABB recommends that customers apply the update as soon as possible.
For the products and version numbers listed below, an update to the server operating system is required before the relevant software patches can be installed. Please contact IPEC Sales ([email protected]) for advice on upgrading the operating system. Upgrade services may be chargeable where not covered by your existing warranty, maintenance or support agreement.
- IPEC iSM Local Server: Legacy iASM
- IPEC iSM Local Server: Debian 8 (Jessie)
- IPEC iSM Local Server: Debian 9 (Stretch)
ABB recommends that customers apply the update as soon as possible.
As a temporary workaround to reduce the risk of PHP vulnerabilities exploitation, customers can disable the Apache web server on the affected IPEC Standalone iSM system.
This can be performed by a user with root privileges using the following command:
systemctl stop apache2
To prevent Apache from starting automatically following a server reboot:
systemctl disable apache2
Impact: Disabling Apache will make the IPEC Standalone iSM web interface unavailable. Other IPEC Standalone iSM services that depend on Apache or the web interface may also be affected.
Once the PHP security updates…
Updating PHP to a version containing the security fixes (8.2.35, 8.3.36, 8.4.27, 8.5.12) and updating or removing NTFS-3G are the recommended remediation measures.
Until these updates have been applied, ABB recommends that customers restrict HTTP(S) access to the IPEC Standalone iSM system to trusted networks and authorized personnel only. Where possible, access should be restricted using firewall rules and network segmentation, ensuring that the IPEC Standalone iSM web interface is not accessible from untrusted networks or the public internet.
Exploitation of the NTFS-3G vulnerabilities…
Vendor fix or mitigation, quoted from the advisory.
Each CVE in this advisory
| CVE | Severity | Known exploited | Exploit likelihood |
|---|---|---|---|
| CVE-2026-109618 | 9.8 critical | Exploited | 100.0% |
| CVE-2026-109619 | 8.1 high | Exploited | 100.0% |
| CVE-2026-40706 | 8.4 high | No | 0.2% |
| CVE-2026-42616 | 7.8 high | No | 0.2% |
| CVE-2026-42617 | 7.1 high | No | 0.1% |
| CVE-2026-42618 | 7.1 high | No | 0.1% |
| CVE-2026-46569 | 7.7 high | No | 0.2% |
| CVE-2026-46570 | 8.1 high | No | 0.2% |
| CVE-2026-46572 | 7.4 high | No | 0.1% |
| CVE-2026-56135 | 7.4 high | No | 0.1% |
Severity from the advisory (CVSS), known exploitation from CISA's catalog, exploit likelihood from EPSS (next 30 days).
Affected products
| Vendor | Product |
|---|---|
| ABB | IPEC iSM Local Server |
Why it's on these mode pages
- Pipeline: Vendor table: ABB (matched by rule)
Change history
- November 6, 2026: Initial version.
- November 9, 2026: First collected by Watch
Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com