CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Trend Micro Mobile Security for Enterprise

product · product:trend-micro-mobile-security-for-enterprise single-source

Coverage
1
first 2026-10-29 → last 2026-10-31
Latest activity
2026-10-31
PHP2Shell: Trend Micro Apex Central and Apex One await patches to 11 Nov; Quest KACE and NetApp ONTAP have…
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
6
5 hosts

Action items (2)

Do-now tasks recorded on the entries about Trend Micro Mobile Security for Enterprise, newest first. Check the date before acting on an older one.

  • Restrict the Trend Micro Apex Central and Apex One server consoles and web endpoints to administrator networks now, apply Trend Micro's interim mitigation, and install the critical patches when they ship, due on 2026-11-11, and the Mobile Security for Enterprise patch due on 2026-11-17 (until then take its mitigation from Trend Micro support); install the critical patches the table now lists for Deep Discovery Inspector and Email Inspector.
    2026-10-29CVE-2026-109618 +1
  • Install KACE SMA 15.0 CU5 or 15.1 CU2 and the SDA 9.3 hotfix 9.3.313 (9.3.312 where already installed), and until then block inbound ports 80, 443 and 52230 to every appliance, as Quest advises.
    2026-10-29CVE-2026-109618 +1

Defender insights

What each entry about Trend Micro Mobile Security for Enterprise tells a defender to do, newest first.

2026-10-29NOTABLEexploitedPHP2Shell: Trend Micro Apex Central and Apex One await patches to 11 Nov; Quest KACE and NetApp ONTAP have fixes

Exposure · detection

Story timeline

  1. 2026-10-29CVE-2026-109618 / CVE-2026-109619, PHP2Shell in management servers and storage: Trend Micro Apex Central and Apex One server have no fix until 2026-11-11, Quest KACE SMA and SDA have fixes and should block ports 80, 443 and 52230 until patched, and NetApp ONTAP 9 is affected by CVE-2026-109618 only, inside the PHP jail
    trending-vulnerabilitiesPHP2Shell: Trend Micro Apex Central and Apex One await patches to 11 Nov; Quest KACE and NetApp ONTAP have fixes

Hunting pivots

CVEs (exploited first)
CVE-2026-109618CVE-2026-109619
Releases covered
Trend Micro Mobile Security for Enterprise
Tags
cisa-kevpatch-availablepre-authrcevulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-29/php2shell-trend-micro-apex-quest-kace-netapp-ontap · ATT&CK page ↗

Entries about Trend Micro Mobile Security for Enterprise (1)

2026-10-29 · view entry permalink →

NOTABLECVE-2026-109618 +1exploitedupdatedNATOA2

CVE-2026-109618 / CVE-2026-109619, PHP2Shell in management servers and storage: Trend Micro Apex Central and Apex One server have no fix until 2026-11-11, Quest KACE SMA and SDA have fixes and should block ports 80, 443 and 52230 until patched, and NetApp ONTAP 9 is affected by CVE-2026-109618 only, inside the PHP jail

Trend Micro's customer advisory KA-0024802, last updated on 2026-10-30, lists Apex Central and the Apex One on-premises server as impacted by CVE-2026-109618 and CVE-2026-109619 with a critical patch expected on 2026-11-11 and an interim mitigation page for each; Mobile Security for Enterprise is impacted with a patch due on 2026-11-17, Trend Micro Web Security in the cloud is due on 2026-11-06 and Deep Discovery Analyzer on 2026-11-12, Apex One as a Service was addressed on 2026-10-23, and the table lists critical patches for Deep Discovery Inspector and Email Inspector (Trend Micro, 2026-10-30). Trend Micro says it has not seen successful exploitation in its products or services and asks customers to restrict the impacted management servers and consoles to trusted addresses until the patches ship (Trend Micro, 2026-10-30).

Quest's knowledge-base article says all versions of the KACE Systems Management Appliance (SMA) and Systems Deployment Appliance (SDA) are affected and that CVE-2026-115560 does not affect them; KACE SMA 15.0 CU5 (15.0.378) and 15.1 CU2 (15.1.177) with PHP 8.4.27 were published on 2026-10-23, the cumulative updates 15.0 Patch 4 and 15.1 Patch 1 do not contain the fix, and the SDA 9.3 hotfix 9.3.312 with PHP 8.3.36 followed (Quest Software, 2026-10-28); hotfix 9.3.313 of 2026-10-29 also covers systems on hotfix versions 9.3.305-9.3.111 and on GA version 9.3.304 (Quest Software, 2026-10-29). Until an appliance is updated Quest says to block all public internet access and, because a potentially exploitable communication path remains after the agent tunnel on port 52230 is established, to block inbound web traffic including ports 80, 443 and 52230 (Quest Software, 2026-10-28).

NetApp's advisory lists ONTAP 9 as affected only by CVE-2026-109618, scored CVSS 4.0 9.2, where an unauthenticated attacker could potentially gain access as the www user but would be restricted to the PHP jail, and lists the hotfix builds 9.14.1P18HF1, 9.15.1P20HF1, 9.16.1P16HF1, 9.17.1P11HF1, 9.18.1P8HF1, 9.19.1P3HF1 and, since revision 10.0 of 2026-10-29, 9.19.1P4 (NetApp, 2026-10-26; NetApp, 2026-10-29). NetApp's knowledge-base article names all ONTAP web services as affected, System Manager, the SPI web portal, the REST API, ZAPI and HTTP and HTTPS access, and recommends upgrading to a fixed version and undoing any workaround afterwards (NetApp Knowledge Base, 2026-10-26). CISA lists both PHP flaws as exploited since 2026-10-26, although none of the three vendors reports an exploited case (CISA KEV, 2026-10-28).

At this time, TrendAI has not seen any active instances or scenarios of successful exploitation of either of the vulnerabilities in our products or services.

Impacted - Critical Patch ETA: Nov. 11

Trend Micro (KA-0024802) 2026-10-28

DDEI 5.1: CP 4902

Critical Patch ETA: Nov. 17

Trend Micro (KA-0024802, status table as of 2026-10-30) 2026-10-30

Block all public Internet access to the KACE SMA and SDA systems.

Quest Software (KB 4385046) 2026-10-28

An unauthenticated attacker could potentially gain access as the www user but would be restricted to the PHP jail, limiting the scope of exploit.

NetApp (NTAP-20261021-0021, advisory data) 2026-10-26
Updaterun 2026-10-31T0256Z-intelsummaryaffected_productscvessourcesevidencesourcing_noteactionsbodyentities

Trend Micro's customer advisory KA-0024802 now reads last updated 2026-10-30, with its status table as of Oct. 30 (Trend Micro, 2026-10-30). The table now lists critical patches for Deep Discovery Inspector, one per listed line from CP 1077 on 7.0 to CP 1200 on 6.5, and for Deep Discovery Email Inspector 5.1 (CP 4902), which Trend Micro had listed as due on 2026-10-30 (Trend Micro, 2026-10-30). Trend Micro Mobile Security for Enterprise is newly listed as impacted, with a critical patch due on 2026-11-17 and mitigation through Trend Micro support (Trend Micro, 2026-10-30). Apex Central and the Apex One on-premises server stay due on 2026-11-11, Deep Discovery Analyzer on 2026-11-12 and the Trend Micro Web Security cloud service on 2026-11-06, and Trend Micro still says it has seen no exploitation in its products (Trend Micro, 2026-10-30). Quest's knowledge-base article now also lists KACE SDA hotfix 9.3.313, published on 2026-10-29, which covers systems on hotfix versions 9.3.305-9.3.111 and on GA version 9.3.304 (Quest Software, 2026-10-29), and NetApp's advisory data adds ONTAP 9.19.1P4 to the fixed builds in revision 10.0 of 2026-10-29 (NetApp, 2026-10-29).

Builds on: PHP2Shell: CISA lists both flaws as exploited after honeypot code execution; update the… · Palo Alto reports active exploitation of PAN-OS management interfaces via PHP2Shell; all 20… · NetScaler's PHP2Shell fix is out: 14.1-73.49, 13.1-64.32 and FIPS builds; restrict management… · PHP2Shell hits QNAP NAS before login: QTS, QuTS hero, QVR, TVR OS and Notes Station 3 fixed… · PHP2Shell hits NetModule routers with no fix, macmon, Schneider, B&R, HMS, Wibu and Oracle… · Cisco's final PHP2Shell advisory: Expressway needs 15.5.21, Duo Access Gateway 3.2.0; Cisco… · HPE ClearPass 6.14, 6.12 and 6.11 are affected by PHP2Shell; a hotfix patch exists for each… · CVE-2026-46300 (Fragnesia): CISA lists the Linux kernel root flaw as exploited, chained with… · Camping.Care booking data stolen: TCS and a second campsite warn of WhatsApp fraud; PHP link… · Check Point: PHP2Shell hits gateway VPN and portal web interfaces; hotfixes out, R81.20 package… · F5 BIG-IP is affected by PHP2Shell: fixes are in 17.1.3.7, 17.5.1.11 and 21.1.0.4; APM data…

vulnerability29 Oct 04:50Zsingle-sourceOpen finding →
Sources: Trend Micro (KA-0024802) · Quest Software (KB 4385046) · Trend Micro (KA-0024802, status table as of 2026-10-30) · Quest Software (KB 4385046, updated 2026-10-29) · NetApp (NTAP-20261021-0021) · NetApp (NTAP-20261021-0021, advisory data) · NetApp (NTAP-20261021-0021, advisory data revision 10.0) · NetApp Knowledge Base · CISA Known Exploited Vulnerabilities catalog

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • security.netapp.com2 (33%)
  • cisa.gov1 (17%)
  • kb.netapp.com1 (17%)
  • success.trendmicro.com1 (17%)
  • support.quest.com1 (17%)
All cited sources (6)