Product Notice: SonicWall Products and PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619

Overview

• CVE-2026-109618: PHP vulnerability – CVSS v4.0 Score: 9.2 (Critical)
• CVE-2026-109619: PHP vulnerability – CVSS v4.0 Score: 9.2 (Critical)

Two critical PHP vulnerabilities have been published, with potential remote code execution reported publicly. SonicWall is aware of customer inquiries and vulnerability-scanner findings related to these CVEs.

Product Impact

The SonicWall Product Security Incident Response Team (PSIRT) performed an initial review and found no use of PHP in the following products. Based on this review, SonicWall has no indication that these CVEs apply to them.

• SonicOS (firewalls)
• SMA 1000 Series
• Network Security Manager (NSM)
• Licensing and asset/account management - MySonicWall
• Email Security (ES)
• Cloud Secure Edge (CSE)
• Unified Management (UM)
• Wireless Network Manager (WNM)

This is the current assessment and is not a statement covering the entire SonicWall portfolio. SonicWall will update this notice if the assessment changes.

Scanner Findings

If a vulnerability scanner reports either CVE against one of the products listed above, please open a support case and provide the scanner report and relevant details. SonicWall will review each finding.

Related Information

• CVE-2026-109618
• CVE-2026-109619
• Contact Support

Change Log:

• 2026-10-22 4:30 AM PDT: Initial publish.
• 2026-10-22 7:25 AM PDT: Updated Product Impact list to add Switches and Access Points (SonicWave).
• 2026-10-22 8:17 AM PDT: Updated Product Impact list to remove Switches and Access Points (SonicWave) and add Unified Management (UM) and Wireless Network Manager (WNM). SonicWall PSIRT is currently evaluating Switches and Access Points (SonicWave) for impact from the PHP vulnerabilities.