VDB

CVE-2026-109619

CVE-2026-109619 PUBLISHED KEV CVSS 9.800000190734863 CRITICAL

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

EPSS 100.00% · 100.0th percentile

Risk Scores

CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C
EPSS Score
100.00%
100.0th percentile

Affected Products

VendorProductVersions
ABBABB NEXUS Series NEXUS-3-x 3.09.00 installed with OS AlmaLinux 9.5
ABBABB NEXUS Series NEXUS-3-x <=3.09.00 installed with OS CentOS 6/7
ABBABB ASPECT®-Enterprise ASP-ENT-x 3.09.00 installed with OS AlmaLinux 9.5
ABBABB ASPECT®-Enterprise ASP-ENT-x <=3.09.00 installed with OS CentOS 6/7
ABBABB NEXUS Series NEX-2x <=3.09.00 installed with OS CentOS 6/7
ABBB&R Industrial Automation GmbH APROL <=R 4.4-65
ABBABB MATRIX Series MAT-x <=3.09.00 installed with OS /all

Timeline

  • CVE Published
  • Dec 31, 2022 CrowdSec Sighting
  • Dec 31, 2022 CrowdSec Sighting
  • Dec 31, 2022 CrowdSec Sighting
  • Jan 17, 2023 CrowdSec Sighting
  • Feb 1, 2023 CrowdSec Sighting
  • May 14, 2023 CrowdSec Sighting
  • Sep 17, 2023 CrowdSec Sighting
  • Nov 25, 2023 CrowdSec Sighting
  • Dec 26, 2023 CrowdSec Sighting
  • Apr 18, 2024 CrowdSec Sighting
  • Apr 22, 2024 CrowdSec Sighting

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›