IMS Advisory for PHP2shell Vulnerabilities CVE-2026-109618 & CVE-2026-109619

AgentMinder

46 more products

39408

26 October 2026

22 October 2026

CLOSED

CRITICAL

9.2

CVE-2026-109618 & CVE-2026-109619

Summary

IMS, a Division of Broadcom has investigated the below PHP2Shell: Critical Core PHP Unauthenticated Remote Code Execution Vulnerabilities:

  • CVE-2026-109618: PHP OOM Request Parsing Memory Corruption and Unauthenticated RCE
    • CVSS 4.0 Score & Severity: 9.2 / Critical
    • Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2026-109619: PHP Worker State Persistence Use-After-Free and Unauthenticated RCE
    • CVSS 4.0 Score & Severity: 9.2 / Critical
    • Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Product(s)

Security Analytics (SA) (Advisory: https://knowledge.broadcom.com/external/article?articleNumber=460321)
Symantec Privileged Access Manager (Advisory: https://knowledge.broadcom.com/external/article/460168)

Non-Affected Products

2E (Advisory: https://knowledge.broadcom.com/external/article?articleNumber=460081)
AgentMinder (formerly Symantec Identity Security Platform) (Advisory: https://knowledge.broadcom.com/external/article?articleNumber=459975)
Application Synthetic Monitor (ASM) (Advisory: https://knowledge.broadcom.com/external/article/460268)
Application Synthetic Monitor SaaS (ASM SaaS) (Advisory: https://knowledge.broadcom.com/external/article/460268)
Agile Requirements Designer (ARD)
Application Delivery Analysis
Application Experience Analytics (AXA) (Advisory: https://knowledge.broadcom.com/external/article?articleNumber=460333)
Application Experience Analytics SaaS (AXA SaaS) (Advisory: https://knowledge.broadcom.com/external/article?articleNumber=460333)
Application Performance Management (APM) (Advisory: https://knowledge.broadcom.com/external/article?articleNumber=460333)
Application Performance Management SaaS (APM SaaS) (Advisory: https://knowledge.broadcom.com/external/article?articleNumber=460333)
Business Service Insight (Advisory: https://knowledge.broadcom.com/external/article?articleNumber=460094)
CA Harvest Software Change Manager (Advisory: https://knowledge.broadcom.com/external/article?articleNumber=460103)
Client Automation (Advisory: https://knowledge.broadcom.com/external/article?articleNumber=460088)
CloudHealth (Advisory: https://knowledge.broadcom.com/external/article?articleNumber=460054)
Configuration Automation (Advisory: https://knowledge.broadcom.com/external/article?articleNumber=460085)
Continuous Delivery Director
Continuous Delivery Director SaaS
DX Operational Observability  (Advisory: https://knowledge.broadcom.com/external/article?articleNumber=460333)
DX OpenExplore (Advisory: https://knowledge.broadcom.com/external/article?articleNumber=460340)
Email Security.cloud (Advisory: https://knowledge.broadcom.com/external/article?articleNumber=460109)
Ghost Solution Suite
HSM Agent
IT Asset Manager (ITAM) (Advisory: https://knowledge.broadcom.com/external/article?articleNumber=460096)
IT Management Suite
IT Process Automation (ITPAM) (Advisory: https://knowledge.broadcom.com/external/article?articleNumber=460093)
Layer7 API Developer Portal (Advisory: https://knowledge.broadcom.com/external/article?articleNumber=460090)
Layer7 API Gateway (Advisory: https://knowledge.broadcom.com/external/article?articleNumber=460090) 
Layer7 Mobile API Gateway (Advisory: https://knowledge.broadcom.com/external/article?articleNumber=460090)
Mobile Device Manager
Nolio Release Automation
PacketShaper (PS) S-Series
PGP Encryption (Advisory: https://knowledge.broadcom.com/external/article/157729)
Plex (Advisory: https://knowledge.broadcom.com/external/article?articleNumber=460083)
PolicyCenter (PC) S-Series
Service Catalog (Advisory: https://knowledge.broadcom.com/external/article?articleNumber=460097)
Service Desk Manager (Advisory: https://knowledge.broadcom.com/external/article?articleNumber=460100)
Service Operations Insight (SOI) (Advisory: https://knowledge.broadcom.com/external/article?articleNumber=460123)
Service Virtualization (CA Application Test)
Symantec Advanced Authentication (Advisory: https://knowledge.broadcom.com/external/article?articleNumber=459977)
Symantec Control Compliance Suite (CCS)
Symantec Directory (Advisory: https://knowledge.broadcom.com/external/article?articleNumber=460108)
Symantec Endpoint Encryption (Advisory: https://knowledge.broadcom.com/external/article/157729)
Symantec Identity Governance and Administration (Advisory: https://knowledge.broadcom.com/external/article?articleNumber=460114)
Symantec Messaging Gateway (SMG) (Advisories: https://knowledge.broadcom.com/external/article/459965/, https://knowledge.broadcom.com/external/article/459962/)
Symantec Privileged Access Manager Server Control
Symantec Privileged Identity Manager
Symantec SiteMinder (Advisory: https://knowledge.broadcom.com/external/article?articleNumber=460212)
Symantec VIP (Advisory: https://knowledge.broadcom.com/external/article?articleNumber=459964)
Test Data Manager 
Unified Infrastructure Management (Nimsoft / UIM) (Advisory: https://knowledge.broadcom.com/external/article/460136)

Products Under Investigation

None



References (Vendor Advisories)