CVE-2026-109618 / CVE-2026-109619, HPE Networking ClearPass Policy Manager: bulletin HPESBNW05171 lists 6.14.1 and 6.11.16 and below as affected by the PHP2Shell flaws and names hotfix patches for both (CVSS 3.1 9.8)

HPE Networking's bulletin HPESBNW05171, released on 2026-10-22 and revised on 2026-10-23 to cover hotfix releases, lists ClearPass Policy Manager 6.14.1 and below and 6.11.16 and below, both released on 2026-09-29, as affected by CVE-2026-109618 and CVE-2026-109619, the PHP flaws behind PHP2Shell, and scores each CVSS 3.1 9.8 with network access, no privileges and no user interaction (HPE Networking, 2026-10-23). The fix is a hotfix patch for 6.14.1 and one for 6.11.16, downloadable from the HPE Networking Support Portal; versions past end of maintenance are presumed affected and are not covered by the bulletin, and HPE has not assessed versions past end of support, which it says should be considered potentially impacted (HPE Networking, 2026-10-23).

HPE recommends confining the CLI and web management interfaces to a dedicated layer 2 segment or VLAN, or controlling them with firewall policy at layer 3 and above, and asks customers to consider removing guest portals and all management interfaces from public access until ClearPass instances have been upgraded to "a version providing some level of mitigation", which it names as 6.14.1 and 6.11.16, although the same bulletin lists 6.14.1 and 6.11.16 and below as affected and names the hotfix patches as the remediation (HPE Networking, 2026-10-23). Other HPE Aruba Networking products it does not list are not known to be affected, and for Mist products the bulletin points to a Juniper reference advisory (HPE Networking, 2026-10-23). CISA added both PHP flaws to its Known Exploited Vulnerabilities catalog on 2026-10-26 (CISA KEV, 2026-10-27); the bulletin itself says nothing about exploitation of ClearPass (HPE Networking, 2026-10-23).