Home / Items
Vendor advisoryKnown exploitedSeverity 5.3 mediumExploit likelihood 100%
PHP2Shell core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)
FG-IR-26-186 · Fortinet · October 21, 2026
Summary
No summary from the source. Read the linked document.
What to do
FortiSOAR PaaS 8.0: Upgrade to 8.0.1 or above
FortiSOAR PaaS 7.6: Upgrade to upcoming 7.6.8 or above
FortiSOAR PaaS 7.5: Upgrade to upcoming 7.5.5 or above
FortiSOAR PaaS 7.4: Migrate to a fixed release
FortiSOAR PaaS 7.3: Migrate to a fixed release
FortiSOAR on-premise 8.0: Upgrade to 8.0.1 or above
FortiSOAR on-premise 7.6: Upgrade to upcoming 7.6.8 or above
FortiSOAR on-premise 7.5: Upgrade to upcoming 7.5.5 or above
FortiSOAR on-premise 7.4: Migrate to a fixed release
FortiSOAR on-premise 7.3: Migrate to a fixed release
FortiSOAR on-premise 7.2: Migrate to a fixed release
FortiSOAR on-premise 7.0: Migrate to a fixed release
Vendor fix or mitigation, quoted from the advisory.
Each CVE in this advisory
| CVE | Severity | Known exploited | Exploit likelihood |
|---|---|---|---|
| CVE-2026-109618 | 5.3 medium | Exploited | 100.0% |
| CVE-2026-109619 | 5.3 medium | Exploited | 100.0% |
Severity from the advisory (CVSS), known exploitation from CISA's catalog, exploit likelihood from EPSS (next 30 days).
Why it's on these mode pages
- Maritime: Vendor table: Fortinet (network and remote-access gear used in every mode, all modes) (matched by rule)
- Pipeline: Vendor table: Fortinet (network and remote-access gear used in every mode, all modes) (matched by rule)
- Freight rail: Vendor table: Fortinet (network and remote-access gear used in every mode, all modes) (matched by rule)
- Passenger rail and transit: Vendor table: Fortinet (network and remote-access gear used in every mode, all modes) (matched by rule)
- Highway and motor carrier: Vendor table: Fortinet (network and remote-access gear used in every mode, all modes) (matched by rule)
- Postal and parcel: Vendor table: Fortinet (network and remote-access gear used in every mode, all modes) (matched by rule)
Change history
- October 21, 2026: Initial Publication
- October 21, 2026: Initial Publication
- November 9, 2026: First collected by Watch
Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com