CVE-2026-109618 / CVE-2026-109619, Cisco Expressway, Ultra-Reliable Wireless Backhaul, Duo Access Gateway and ISE Portal Builder: Cisco's final PHP2Shell advisory names Expressway 15.5.21 and Duo Access Gateway 3.2.0 as the fixes and knows of no malicious use against its products
Cisco's final PHP2Shell advisory: Expressway needs 15.5.21, Duo Access Gateway 3.2.0; Cisco knows of no malicious use
Defender actions
- Upgrade every Cisco Expressway-C, Expressway-E and Expressway Select unit to 15.5.21, including units already moved to X15.5.20 for CVE-2026-76466, which Cisco's table does not name as the PHP2Shell fix, and until then apply the workaround in bug CSCwx37062; take any Duo Access Gateway to 3.2.0.
Analysis
Cisco's advisory cisco-sa-php-october26-Jj384Daq, published on 2026-10-21 and final at version 1.8 on 2026-10-27, lists Expressway, Ultra-Reliable Wireless Backhaul, Duo Access Gateway and ISE Portal Builder as affected by CVE-2026-109618 and CVE-2026-109619, the PHP flaws behind PHP2Shell (Cisco PSIRT, 2026-10-27). Expressway Series and Expressway Select Series (bug CSCwx37062) have fixed release 15.5.21 and a workaround described in the bug record; Ultra-Reliable Wireless Backhaul and Unified Industrial Wireless Software (bug CSCwx37073) have 27.1.1, listed for March 2027, and a workaround, and there the attacker must be authenticated as an administrator, which lowers the CVSS 3.1 score to 6.6; Duo Access Gateway is fixed in 3.2.0; and ISE Portal Builder is offline for remediation (Cisco PSIRT, 2026-10-27). The advisory gives no affected-version ranges and no workaround steps; its bug records carry platform-specific information, workarounds and fixed releases, and a product it does not list is, in Cisco's review, not affected (Cisco PSIRT, 2026-10-27).
Cisco says it is aware that a public announcement is available and knows of no malicious use of the flaws against any Cisco product (Cisco PSIRT, 2026-10-27); CISA added both flaws to its Known Exploited Vulnerabilities catalog on 2026-10-26 (CISA KEV, 2026-10-27). For Expressway the PHP fix is 15.5.21 (Cisco PSIRT, 2026-10-27), while the release Cisco names for the unauthenticated root command execution on clustered units, CVE-2026-76466, is X15.5.20 (Cisco PSIRT, 2026-10-21).
Cited evidence
The Cisco PSIRT is not aware of any malicious use of these vulnerabilities against any Cisco product.
If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability.
For this product, the attacker must be authenticated as an administrator to exploit this vulnerability.
Sources4
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.