Security Advisory: CVE-2026-109618 and CVE-2026-109619

Security Advisory: CVE-2026-109618 and CVE-2026-109619


Info

Applicability to Applications Manager: Not Applicable


We have received enquiries regarding CVE-2026-109618 and CVE-2026-109619 from users, which affect the PHP runtime.


We would like to clarify that ManageEngine Applications Manager and the APM Insight PHP Agent do not bundle the PHP runtime or its components. These vulnerabilities affect the PHP runtime and are therefore not directly applicable to Applications Manager or the APM Insight PHP Agent.


However, these vulnerabilities may affect customers who have installed a vulnerable PHP runtime on their machines or are running PHP-based applications in their environment. Such customers should assess their PHP installations and apply the relevant security updates as recommended by the PHP project.