{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "summary",
        "title": "Summary",
        "text": "Vulnerabilities in the PHP core library allow attackers to perform unauthenticated remote code execution in vulnerable systems."
      },
      {
        "category": "general",
        "title": "Affected Products",
        "text": "These vulnerabilities fully affect the following HPE Networking product(s) software versions unless specifically noted otherwise in the details section:\n\nHPE Networking ClearPass Policy Manager\n  - ClearPass 6.14.1 (released on Sep 29, 2026) and below\n  - ClearPass 6.11.16 (released on Sep 29, 2026) and below\n\nNOTE: Product software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise and are not covered by this security advisory. For deployments running software versions that are past End of Support (EoS), HPE Networking has not assessed exposure to the vulnerabilities referenced in this advisory. As a result, such installations should be considered potentially impacted by the listed CVE. Customers are strongly encouraged to upgrade to a supported software release to ensure proper evaluation and remediation.\n\nSupported versions as of the publication date of this advisory are:\n  - HPE Networking ClearPass Policy Manager 6.14.x\n  - HPE Networking ClearPass Policy Manager 6.11.x"
      },
      {
        "category": "general",
        "title": "Unaffected Products",
        "text": "HPE Aruba Networking products and software versions not specifically listed above are not known to be affected by these vulnerabilities.\n\nNOTE: For any other HPE Mist Networking products please refer to the following document:\nhttps://supportportal.juniper.net/s/article/2026-10-Reference-Advisory-Status-of-PHP2Shell-vulnerabilities-on-Juniper-Products-CVE-2026-109618-CVE-2026-109619"
      },
      {
        "category": "other",
        "title": "Exploitation and Public Discussion",
        "text": "These findings, publicly known as \"PHP2Shell\", were originally disclosed in a GitHub security advisory found at the links below:\n\nhttps://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w\nhttps://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
      },
      {
        "category": "general",
        "title": "HPE Networking SIRT Security Procedures",
        "text": "Complete information on reporting security vulnerabilities in HPE Networking products and obtaining assistance with security incidents is available at:\nhttps://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=a00100637en_us\n\nFor reporting NEW HPE Networking security issues, email can be sent to networking-psirt(at)hpe.com. For sensitive information we encourage the use of PGP encryption. Our public keys can be found at: https://www.hpe.com/info/psrt-pgp-key"
      },
      {
        "category": "legal_disclaimer",
        "title": "Legal Disclaimer",
        "text": "(c) Copyright 2026 by Hewlett Packard Enterprise Development LP. This advisory may be redistributed freely after the release date given at the top of the text, provided that the redistributed copies are complete and unmodified, including all data and version information."
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "Email: networking-psirt(at)hpe.com - For further details please see http://www.hpe.com/support/security-response-policy",
      "issuing_authority": "HPE Networking's Security Incident Response Team (SIRT) is responsible for receiving, tracking, managing, and disclosing vulnerabilities in HPE Aruba Networking products. The HPE Aruba Networking SIRT actively works with industry, non-profit, government organizations, and the security community when vulnerabilities are reported. A security vulnerability is defined as any weakness in a product that allows an attacker to compromise the confidentiality, integrity, or availability of a product, customer infrastructure, or IT system through an HPE Aruba Networking product in that environment.",
      "name": "HPE Networking",
      "namespace": "https://www.hpe.com/support/security-response-policy"
    },
    "references": [
      {
        "summary": "Original Advisory",
        "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05171en_us&docLocale=en_US"
      },
      {
        "summary": "HPE Networking Security Advisory Archive",
        "url": "https://csaf.arubanetworking.hpe.com/"
      },
      {
        "summary": "HPE Networking Product Security Incident Response Policy",
        "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=a00100637en_us"
      },
      {
        "summary": "PHP2Shell GitHub Security Advisory (CVE-2026-109618)",
        "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
      },
      {
        "summary": "PHP2Shell GitHub Security Advisory (CVE-2026-109619)",
        "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
      }
    ],
    "title": "Multiple \"PHP2Shell\" Vulnerabilities identified in PHP allow for Unauthenticated Remote Code Execution",
    "tracking": {
      "current_release_date": "2026-10-23T16:00:00.000Z",
      "generator": {
        "date": "2026-10-23T16:00:00.000Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.37"
        }
      },
      "id": "HPESBNW05171",
      "initial_release_date": "2026-10-22T16:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-10-22T16:00:00.000Z",
          "number": "1",
          "summary": "Initial release"
        },
        {
          "date": "2026-10-23T16:00:00.000Z",
          "number": "2",
          "summary": "Revised to address Hotfix Releases and update Unaffected Products section."
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ClearPass 6.14.1 Hotfix Patch to Address PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619",
                "product": {
                  "name": "HPE Networking ClearPass Policy Manager (CPPM)",
                  "product_id": "ClearPass 6.14.1 Hotfix Patch to Address PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619"
                }
              },
              {
                "category": "product_version",
                "name": "ClearPass 6.11.16 Hotfix Patch to Address PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619",
                "product": {
                  "name": "HPE Networking ClearPass Policy Manager (CPPM)",
                  "product_id": "ClearPass 6.11.16 Hotfix Patch to Address PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:semver/>=6.14.0|<=6.14.1",
                "product": {
                  "name": "HPE Networking ClearPass Policy Manager (CPPM) (ClearPass 6.14.1 released Sep 29, 2026)",
                  "product_id": ">=6.14.0|<=6.14.1"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:semver/>=6.11.0|<=6.11.16",
                "product": {
                  "name": "HPE Networking ClearPass Policy Manager (CPPM) (ClearPass 6.11.16 released Sep 29, 2026)",
                  "product_id": ">=6.11.0|<=6.11.16"
                }
              }
            ],
            "category": "product_name",
            "name": "ClearPass Policy Manager (CPPM)"
          }
        ],
        "category": "vendor",
        "name": "HPE Networking"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "organization": "Wiz"
        },
        {
          "organization": "OpenAI"
        },
        {
          "organization": "Calif"
        }
      ],
      "cve": "CVE-2026-109618",
      "notes": [
        {
          "category": "details",
          "text": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. In some contexts, request memory is temporarily reachable before it is fully initialized. If any allocation fails at that point, PHP does not properly account for the early exit and leaves the request memory in an invalid state. The failed allocation does not need to be related to the invalid memory. The request shutdown procedure may then read or branch on it. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).",
          "title": "Details"
        },
        {
          "category": "other",
          "text": "VULN-1469",
          "title": "Internal Reference"
        }
      ],
      "product_status": {
        "fixed": [
          "ClearPass 6.14.1 Hotfix Patch to Address PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619",
          "ClearPass 6.11.16 Hotfix Patch to Address PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619"
        ],
        "known_affected": [
          ">=6.14.0|<=6.14.1",
          ">=6.11.0|<=6.11.16"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-23T16:00:00.000Z",
          "details": "To address the vulnerabilities described in the Details Section, HPE Networking recommends upgrading the HPE Networking ClearPass Policy Manager (CPPM) products to the following software versions (as applicable):\n  - ClearPass 6.14.1: Apply ClearPass 6.14.1 Hotfix Patch to Address PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619\n  - ClearPass 6.11.16: Apply ClearPass 6.11.16 Hotfix Patch to Address PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619\n\nSoftware versions with resolution/fixes for the vulnerabilities covered above can be downloaded from the HPE Networking Support Portal at: https://networkingsupport.hpe.com",
          "product_ids": [
            "ClearPass 6.14.1 Hotfix Patch to Address PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619",
            "ClearPass 6.11.16 Hotfix Patch to Address PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619"
          ],
          "url": "https://networkingsupport.hpe.com"
        },
        {
          "category": "workaround",
          "date": "2026-10-23T16:00:00.000Z",
          "details": "To minimize the likelihood of an attacker exploiting these vulnerabilities, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above along with accounting controls for tracking and logging user activities and resource usage.\n\nIn addition, customers are asked to consider removing guest portals and all management interfaces from public access until ClearPass instances have been upgraded to a version providing some level of mitigation. These versions are 6.14.1 and 6.11.16.",
          "product_ids": [
            ">=6.14.0|<=6.14.1",
            ">=6.11.0|<=6.11.16"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            ">=6.14.0|<=6.14.1",
            ">=6.11.0|<=6.11.16"
          ]
        }
      ],
      "title": "RCE via OOM Corruption"
    },
    {
      "acknowledgments": [
        {
          "organization": "Wiz"
        },
        {
          "organization": "OpenAI"
        },
        {
          "organization": "Calif"
        }
      ],
      "cve": "CVE-2026-109619",
      "notes": [
        {
          "category": "details",
          "text": "PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).",
          "title": "Details"
        },
        {
          "category": "other",
          "text": "VULN-1470",
          "title": "Internal Reference"
        }
      ],
      "product_status": {
        "fixed": [
          "ClearPass 6.14.1 Hotfix Patch to Address PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619",
          "ClearPass 6.11.16 Hotfix Patch to Address PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619"
        ],
        "known_affected": [
          ">=6.14.0|<=6.14.1",
          ">=6.11.0|<=6.11.16"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-23T16:00:00.000Z",
          "details": "To address the vulnerabilities described in the Details Section, HPE Networking recommends upgrading the HPE Networking ClearPass Policy Manager (CPPM) products to the following software versions (as applicable):\n  - ClearPass 6.14.1: Apply ClearPass 6.14.1 Hotfix Patch to Address PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619\n  - ClearPass 6.11.16: Apply ClearPass 6.11.16 Hotfix Patch to Address PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619\n\nSoftware versions with resolution/fixes for the vulnerabilities covered above can be downloaded from the HPE Networking Support Portal at: https://networkingsupport.hpe.com",
          "product_ids": [
            "ClearPass 6.14.1 Hotfix Patch to Address PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619",
            "ClearPass 6.11.16 Hotfix Patch to Address PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619"
          ],
          "url": "https://networkingsupport.hpe.com"
        },
        {
          "category": "workaround",
          "date": "2026-10-23T16:00:00.000Z",
          "details": "To minimize the likelihood of an attacker exploiting these vulnerabilities, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above along with accounting controls for tracking and logging user activities and resource usage.\n\nIn addition, customers are asked to consider removing guest portals and all management interfaces from public access until ClearPass instances have been upgraded to a version providing some level of mitigation. These versions are 6.14.1 and 6.11.16.",
          "product_ids": [
            ">=6.14.0|<=6.14.1",
            ">=6.11.0|<=6.11.16"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            ">=6.14.0|<=6.14.1",
            ">=6.11.0|<=6.11.16"
          ]
        }
      ],
      "title": "RCE via Stale Global State"
    }
  ]
}