# ADV-2026-021 - PHP Runtime Vulnerabilities in Netwrix Endpoint Protector

**URL:** <https://community.netwrix.com/t/adv-2026-021-php-runtime-vulnerabilities-in-netwrix-endpoint-protector/161687>\
**Category:** Endpoint Protector Security Advisories\
**Created:** [October 22, 2026, 5:26pm UTC](https://community.netwrix.com/t/adv-2026-021-php-runtime-vulnerabilities-in-netwrix-endpoint-protector/161687 "2026-10-22T17:26:25Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![netwrix-product-security](https://yyz1.discourse-cdn.com/netwrix/user_avatar/community.netwrix.com/netwrix-product-security/32/3102_2.png) [@netwrix-product-security](https://community.netwrix.com/u/netwrix-product-security)\
**Post date:** [October 22, 2026, 5:26pm UTC](https://community.netwrix.com/t/adv-2026-021-php-runtime-vulnerabilities-in-netwrix-endpoint-protector/161687/1 "2026-10-22T17:26:25Z")

</div>

# Executive Summary

The PHP Group has disclosed two vulnerabilities in the PHP runtime used by the Netwrix Endpoint Protector Server. These vulnerabilities could allow an unauthenticated remote attacker to execute arbitrary code on the Endpoint Protector Server, potentially resulting in full compromise of the confidentiality, integrity and availability of the server and the data it manages.

Netwrix is unaware of any attacks targeting Netwrix Endpoint Protector. However, these PHP vulnerabilities are publicly known, exploit code is available, and exploitation attempts have been reported in the wild. Netwrix Endpoint Protector SaaS environments have already been patched. All on-premises Netwrix Endpoint Protector customers are advised to apply the available security updates immediately.

Netwrix Endpoint Protector is the only Netwrix product affected by these vulnerabilities. No other Netwrix products or services are affected.

# Vulnerability

| Title | Affected Component | Affected Versions | CVSS 4.0 Score | CVSS 3.1 Score (Base / Temporal) | Description |
| --- | --- | --- | --- | --- | --- |
| PHP - RCE via OOM corruption (CVE-2026-109618) | Endpoint Protector Server | \<=2608 (PHP \< 8.2.35) | [9.2](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) | [8.1 / 7.5](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C) | In the PHP runtime used by the Endpoint Protector Server, out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid, potentially allowing a remote attacker to execute arbitrary code. |
| PHP - RCE via stale global state (CVE-2026-109619) | Endpoint Protector Server | \<=2608 (PHP \< 8.2.35) | [9.2](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) | [8.1 / 7.5](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C) | In the PHP runtime used by the Endpoint Protector Server, request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it, potentially allowing a remote attacker to execute arbitrary code. |

# Exploitability

Factors such as whether details about the vulnerability are publicly known, whether an exploit is readily available, or whether adversaries are actively exploiting the vulnerability are valuable in making risk-based judgments about urgency and priority; customers should use the information below in making those decisions.

| Title | Publicly known? | Exploit available? | Actively exploited? |
| --- | --- | --- | --- |
| Use of Improperly Initialized Resource in PHP Runtime (CVE-2026-109618) | Yes | Yes | No |
| Use After Free in PHP Runtime (CVE-2026-109619) | Yes | Yes | No |

# Solution

**Netwrix Endpoint Protector SaaS customers**

The security patch has already been applied to your environment. No action is required.

**New Installations**

All appliances downloaded since October 26, 2026 already include the fix and no further action is required.

**On-premises customers on version 2608**

Apply the security updates by following the [security update instructions](https://docs.netwrix.com/docs/endpointprotector/admin/systemconfiguration/overview#security-updates).

**On-premises customers on older appliance versions**

We strongly recommend migrating to the latest Endpoint Protector Server release, currently version 2608. Until the migration is complete you should apply the security updates as described above. See the [migration guide](https://docs.netwrix.com/docs/endpointprotector/install/migrationprocedure/migrationguide) on [docs.netwrix.com](https://docs.netwrix.com/docs/endpointprotector/).

Please contact the [Netwrix technical support team](https://www.netwrix.com/support.html#contact-us) should you need assistance.

# Official Fixes

Updated software has been released containing an official fix for the vulnerabilities as indicated in the table below.

| Product | Release Version |
| --- | --- |
| Netwrix Endpoint Protector | 2608 (PHP 8.5.4) |

# FAQ

1. **Where can I find more information about these vulnerabilities?**

2. **What if I’m on an older appliance version?**

3. **What about CVE-2026-115560?**

# Revisions

Updates to this advisory may be made as necessary. Information about each change will be published in the table below.

| Revision | Date | Description |
| --- | --- | --- |
| 1 | Invalid date | First published |
| 2 | Invalid date | Updated instructions to reflect new patched appliances available and patched php version |
| 3 | Invalid date | Removed need to apply patches after migrating to updated appliance |
| 3 | Invalid date | Added information around CVE-2026-115560 |

# Disclaimer

The information and materials included in or linked to this Security Advisory are provided on an “as-is” basis and without warranty of any kind, and we disclaim all representations and warranties of any kind, whether express or implied, including warranties of merchantability and fitness for a particular use. You acknowledge and agree that your use of the information and materials included in or linked to this Security Advisory are at your own risk.

---

<div class="post-metadata">

**Author:** ![netwrix-product-security](https://yyz1.discourse-cdn.com/netwrix/user_avatar/community.netwrix.com/netwrix-product-security/32/3102_2.png) [@netwrix-product-security](https://community.netwrix.com/u/netwrix-product-security)\
**Post date:** [October 27, 2026, 4:38pm UTC](https://community.netwrix.com/t/adv-2026-021-php-runtime-vulnerabilities-in-netwrix-endpoint-protector/161687/2 "2026-10-27T16:38:37Z")

</div>

_An update was made to this advisory._

---

<div class="post-metadata">

**Author:** ![netwrix-product-security](https://yyz1.discourse-cdn.com/netwrix/user_avatar/community.netwrix.com/netwrix-product-security/32/3102_2.png) [@netwrix-product-security](https://community.netwrix.com/u/netwrix-product-security)\
**Post date:** [October 27, 2026, 6:21pm UTC](https://community.netwrix.com/t/adv-2026-021-php-runtime-vulnerabilities-in-netwrix-endpoint-protector/161687/3 "2026-10-27T18:21:22Z")

</div>

_An update was made to this advisory._

---

<div class="post-metadata">

**Author:** ![netwrix-product-security](https://yyz1.discourse-cdn.com/netwrix/user_avatar/community.netwrix.com/netwrix-product-security/32/3102_2.png) [@netwrix-product-security](https://community.netwrix.com/u/netwrix-product-security)\
**Post date:** [October 28, 2026, 9:45am UTC](https://community.netwrix.com/t/adv-2026-021-php-runtime-vulnerabilities-in-netwrix-endpoint-protector/161687/4 "2026-10-28T09:45:39Z")

</div>

_An update was made to this advisory._

---

<div class="post-metadata">

**Author:** ![netwrix-product-security](https://yyz1.discourse-cdn.com/netwrix/user_avatar/community.netwrix.com/netwrix-product-security/32/3102_2.png) [@netwrix-product-security](https://community.netwrix.com/u/netwrix-product-security)\
**Post date:** [October 28, 2026, 1:12pm UTC](https://community.netwrix.com/t/adv-2026-021-php-runtime-vulnerabilities-in-netwrix-endpoint-protector/161687/5 "2026-10-28T13:12:47Z")

</div>

_An update was made to this advisory._