Quest KACE Systems Deployment Appliance

CVE-2026-109618 / CVE-2026-109619, PHP2Shell in management servers and storage: Trend Micro Apex Central and Apex One server have no fix until 2026-11-11, Quest KACE SMA and SDA have fixes and should block ports 80, 443 and 52230 until patched, and NetApp ONTAP 9 is affected by CVE-2026-109618 only, inside the PHP jail

Trend Micro's customer advisory KA-0024802, last updated on 2026-10-28, lists Apex Central and the Apex One on-premises server as impacted by CVE-2026-109618 and CVE-2026-109619 with a critical patch expected on 2026-11-11 and an interim mitigation page for each; Trend Micro Web Security in the cloud is due on 2026-11-06, Deep Discovery Inspector and Email Inspector on 2026-10-30 and Deep Discovery Analyzer on 2026-11-12, and Apex One as a Service was addressed on 2026-10-23 (Trend Micro, 2026-10-28). Trend Micro says it has not seen successful exploitation in its products or services and asks customers to restrict the impacted management servers and consoles to trusted addresses until the patches ship (Trend Micro, 2026-10-28).

Quest's knowledge-base article says all versions of the KACE Systems Management Appliance (SMA) and Systems Deployment Appliance (SDA) are affected and that CVE-2026-115560 does not affect them; KACE SMA 15.0 CU5 (15.0.378) and 15.1 CU2 (15.1.177) with PHP 8.4.27 were published on 2026-10-23, the cumulative updates 15.0 Patch 4 and 15.1 Patch 1 do not contain the fix, and the SDA 9.3 hotfix 9.3.312 with PHP 8.3.36 followed (Quest Software, 2026-10-28). Until an appliance is updated Quest says to block all public internet access and, because a potentially exploitable communication path remains after the agent tunnel on port 52230 is established, to block inbound web traffic including ports 80, 443 and 52230 (Quest Software, 2026-10-28).

NetApp's advisory lists ONTAP 9 as affected only by CVE-2026-109618, scored CVSS 4.0 9.2, where an unauthenticated attacker could potentially gain access as the www user but would be restricted to the PHP jail, and lists the hotfix builds 9.14.1P18HF1, 9.15.1P20HF1, 9.16.1P16HF1, 9.17.1P11HF1, 9.18.1P8HF1 and 9.19.1P3HF1 (NetApp, 2026-10-26; NetApp, 2026-10-26). NetApp's knowledge-base article names all ONTAP web services as affected, System Manager, the SPI web portal, the REST API, ZAPI and HTTP and HTTPS access, and recommends upgrading to a fixed version and undoing any workaround afterwards (NetApp Knowledge Base, 2026-10-26). CISA lists both PHP flaws as exploited since 2026-10-26, although none of the three vendors reports an exploited case (CISA KEV, 2026-10-28).

Builds on: PHP2Shell: CISA lists both flaws as exploited after honeypot code execution; update the… · Palo Alto reports active exploitation of PAN-OS management interfaces via PHP2Shell; 19 of 20… · NetScaler's PHP2Shell fix is out: 14.1-73.49, 13.1-64.32 and FIPS builds; restrict management… · PHP2Shell hits QNAP NAS before login: QTS, QuTS hero, QVR and TVR OS fixed, Notes Station 3 and… · PHP2Shell hits NetModule routers with no fix, macmon, Schneider, B&R, HMS, Wibu and Oracle… · Cisco's final PHP2Shell advisory: Expressway needs 15.5.21, Duo Access Gateway 3.2.0; Cisco… · HPE ClearPass through 6.14.1 and 6.11.16 is affected by PHP2Shell; hotfix patches exist for… · CVE-2026-46300 (Fragnesia): CISA lists the Linux kernel root flaw as exploited, chained with… · Camping.Care booking data stolen: TCS and a second campsite warn of WhatsApp fraud; PHP link… · Check Point: PHP2Shell hits gateway VPN and portal web interfaces; hotfixes out, R81.20 package… · F5 BIG-IP is affected by PHP2Shell: fixes are in 17.1.3.7, 17.5.1.11 and 21.1.0.4; APM data…