Symantec Endpoint Protection Manager

CVE-2026-109618 / CVE-2026-109619, Broadcom Symantec Endpoint Protection Manager, Carbon Black App Control Server, CloudSOC SpanVA and Content Analysis and Malware Analysis: PHP2Shell reaches the endpoint-security management servers; App Control Server 8.12.2 and 8.13.2 are the fixes Broadcom names

Broadcom's Enterprise Security Group advisory 39404, published on 2026-10-21 and last revised on 2026-10-30, lists four products as affected by the PHP flaws CVE-2026-109618 and CVE-2026-109619: Carbon Black App Control Server (moved to affected on 2026-10-22), Symantec Endpoint Protection Manager (SEPM, 2026-10-22), the CloudSOC SpanVA Appliance (2026-10-23) and Content Analysis and Malware Analysis (CASMA), which moved from under investigation to affected on 2026-10-30; the page states no versions, fixes or workarounds, and lists Content Analysis (CAS), the Symantec Endpoint Protection agent, Symantec Endpoint Security, Data Loss Prevention, Cloud Secure Web Gateway and Zero Trust Network Access among the products that are not vulnerable (Broadcom, 2026-10-30). CISA added both PHP flaws to its Known Exploited Vulnerabilities catalog on 2026-10-26 (CISA KEV catalog, 2026-10-26); Broadcom's advisory says nothing about attacks on these products.

Broadcom's article 459982 says the App Control Server is affected in all supported versions and that builds 8.12.2 and 8.13.2 are available and contain only PHP-related changes: an installation on 8.12 or earlier may take either, one already on 8.13 must take 8.13.2 (Broadcom, 2026-10-22). For SEPM, NCSC-NL's tracker lists builds 14.3.27716.10000 and 14.4.494.0000 as the fixes, on the strength of a community report that cites Broadcom's SEPM advisory, which needs a login and which the maintainer did not verify (NCSC-NL, 2026-10-30). No fix is stated for the CloudSOC SpanVA Appliance or CASMA.

Builds on: PHP2Shell: CISA lists both flaws as exploited after honeypot code execution; update the… · Palo Alto reports active exploitation of PAN-OS management interfaces via PHP2Shell; all 20… · NetScaler's PHP2Shell fix is out: 14.1-73.49, 13.1-64.32 and FIPS builds; restrict management… · PHP2Shell hits QNAP NAS before login: QTS, QuTS hero, QVR, TVR OS and Notes Station 3 fixed… · PHP2Shell hits NetModule routers with no fix, macmon, Schneider, B&R, HMS, Wibu and Oracle… · Cisco's final PHP2Shell advisory: Expressway needs 15.5.21, Duo Access Gateway 3.2.0; Cisco… · HPE ClearPass 6.14, 6.12 and 6.11 are affected by PHP2Shell; a hotfix patch exists for each… · Check Point: PHP2Shell hits gateway VPN and portal web interfaces; hotfixes out, R81.20 package… · F5 BIG-IP is affected by PHP2Shell: fixes are in 17.1.3.7, 17.5.1.11 and 21.1.0.4; APM data… · PHP2Shell: Trend Micro Apex Central and Apex One await patches to 11 Nov; Quest KACE and NetApp… · CVE-2026-46300 (Fragnesia): CISA lists the Linux kernel root flaw as exploited, chained with… · Camping.Care booking data stolen: TCS and a second campsite warn of WhatsApp fraud; PHP link…