Executive Summary
The PHP Group has disclosed two vulnerabilities in the PHP runtime used by the Netwrix Endpoint Protector Server. These vulnerabilities could allow an unauthenticated remote attacker to execute arbitrary code on the Endpoint Protector Server, potentially resulting in full compromise of the confidentiality, integrity and availability of the server and the data it manages.
Netwrix is unaware of any attacks targeting Netwrix Endpoint Protector. However, these PHP vulnerabilities are publicly known, exploit code is available, and exploitation attempts have been reported in the wild. Netwrix Endpoint Protector SaaS environments have already been patched. All on-premises Netwrix Endpoint Protector customers are advised to apply the available security updates immediately.
Netwrix Endpoint Protector is the only Netwrix product affected by these vulnerabilities. No other Netwrix products or services are affected.
Vulnerability
| Title | Affected Component | Affected Versions | CVSS 4.0 Score | CVSS 3.1 Score (Base / Temporal) | Description |
|---|---|---|---|---|---|
| PHP - RCE via OOM corruption (CVE-2026-109618) | Endpoint Protector Server | <=2608 (PHP < 8.2.35) | 9.2 | 8.1 / 7.5 | In the PHP runtime used by the Endpoint Protector Server, out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid, potentially allowing a remote attacker to execute arbitrary code. |
| PHP - RCE via stale global state (CVE-2026-109619) | Endpoint Protector Server | <=2608 (PHP < 8.2.35) | 9.2 | 8.1 / 7.5 | In the PHP runtime used by the Endpoint Protector Server, request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it, potentially allowing a remote attacker to execute arbitrary code. |
Exploitability
Factors such as whether details about the vulnerability are publicly known, whether an exploit is readily available, or whether adversaries are actively exploiting the vulnerability are valuable in making risk-based judgments about urgency and priority; customers should use the information below in making those decisions.
| Title | Publicly known? | Exploit available? | Actively exploited? |
|---|---|---|---|
| Use of Improperly Initialized Resource in PHP Runtime (CVE-2026-109618) | Yes | Yes | No |
| Use After Free in PHP Runtime (CVE-2026-109619) | Yes | Yes | No |
Solution
Netwrix Endpoint Protector SaaS customers
The security patch has already been applied to your environment. No action is required.
New Installations
All appliances downloaded since October 26, 2026 already include the fix and no further action is required.
On-premises customers on version 2608
Apply the security updates by following the security update instructions.
On-premises customers on older appliance versions
We strongly recommend migrating to the latest Endpoint Protector Server release, currently version 2608. Until the migration is complete you should apply the security updates as described above. See the migration guide on docs.netwrix.com.
Please contact the Netwrix technical support team should you need assistance.
Official Fixes
Updated software has been released containing an official fix for the vulnerabilities as indicated in the table below.
| Product | Release Version |
|---|---|
| Netwrix Endpoint Protector | 2608 (PHP 8.5.4) |
FAQ
-
Where can I find more information about these vulnerabilities?
Further information is available in the advisory from the PHP Group.
-
What if I’m on an older appliance version?
We strongly recommend migrating to the latest Endpoint Protector Server release, currently version 2608, and then applying the security updates as described above. See the migration guide on docs.netwrix.com.
If you are temporarily unable to update you can apply the latest security fixes to mitigate this issue by following the guide here
Revisions
Updates to this advisory may be made as necessary. Information about each change will be published in the table below.
| Revision | Date | Description |
|---|---|---|
| 1 | Invalid date | First published |
| 2 | Invalid date | Updated instructions to reflect new patched appliances available and patched php version |
Disclaimer
The information and materials included in or linked to this Security Advisory are provided on an “as-is” basis and without warranty of any kind, and we disclaim all representations and warranties of any kind, whether express or implied, including warranties of merchantability and fitness for a particular use. You acknowledge and agree that your use of the information and materials included in or linked to this Security Advisory are at your own risk.