Product Affected

Multiple
Critical

CVSS: v3.1: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) 
CVSS: v4.0: 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)

 

Problem

The Juniper PSIRT is aware of the two PHP vulnerabilities leading to remote code execution, known as "PHP2Shell", and being tracked as CVE-2026-109618 and CVE-2026-109619.

 

  • RCE via OOM corruption, CVE-2026-109618: out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
  • RCE via stale global state, CVE-2026-109619: request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.
 
Below is the current status of Juniper Networking products potentially impacted by the PHP2Shell vulnerabilities:

ProductStatus
Junos OSJunos is vulnerable to CVE-2026-109618 and is being upgraded to PHP 8.5.12 to resolve this issue. For affected systems, the recommended mitigation is to disable J-Web, JSC, and fwAuth.
SRX SeriesSRX does not use PHP starting with 25.2R1. For earlier versions, upgrade to 25.2R1, disable J-Web, JSC, and fwAuth, or limit access to trusted hosts and administrators.
EX Series Disable J-Web and Captive Portal Auth or limit access to trusted hosts and administrators.
MX Series Disable J-Web or limit access to trusted hosts and administrators.
Junos OS Evolved (EVO)Not Vulnerable.
Session Smart RouterNot Vulnerable.
Mist

The following HPE Mist Networking products are not impacted:

  • Mist Cloud
  • Wireless Assurance
  • Wired Assurance
  • Location Services
  • Access Assurance
  • Premium Analytics
  • Mist Access Points
  • Mist Edge 
Junos SpaceNot Vulnerable.

Other products not listed above are still under investigation.
 
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was discovered by a third-party upstream provider.

Solution

Software releases will be updated to resolve this issue and made available on the Customer Support Downloads site.

This issue is being tracked as 1959788, 1990005, 1990031, 1990051 and 1990294 which are visible on the Customer Support website.

Note: Juniper SIRT's policy is not to evaluate releases that are beyond End of Engineering (EOE) or End of Life (EOL).

 

Workaround

For most products, disable web access or limit access to trusted hosts and administrators.

 

Severity Assessment

Information for how Juniper Networks uses CVSS can be found at KB 16446 [juniper.net] "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."

Modification History

2026-10-23: Initial publication
2026-10-23: Updated Mist status

Related Information