The HPE Juniper Networking PSIRT is aware of the two PHP vulnerabilities leading to remote code execution, known as "PHP2Shell", and being tracked as CVE-2026-109618 and CVE-2026-109619.

 

• RCE via OOM corruption, CVE-2026-109618: out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
• RCE via stale global state, CVE-2026-109619: request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

 

Below is the current status of Juniper Networking products potentially impacted by the PHP2Shell vulnerabilities:

Product	Status
Junos OS	Junos OS is vulnerable to CVE-2026-109618 but not exploitable. The pre-auth out-of-memory issue is reachable but harmless. Junos OS is not affected by CVE-2026-109619.
SRX Series	SRX does not use PHP starting with 25.2R1. For earlier versions, Junos OS is vulnerable but not exploitable (see above).
Junos OS Evolved (EVO)	Not Vulnerable.
Session Smart Router	Not Vulnerable.
Mist	The following HPE Mist Networking products are not impacted: Mist Cloud Wireless Assurance Wired Assurance Location Services Access Assurance Premium Analytics Mist Access Points Mist Edge
WAN Automation	The following HPE WAN Management Software products are not impacted: Routing Director Routing Assurance Routing Active Testing Paragon Insights (formerly Paragon Automation) Paragon Pathfinder/Planner (formerly NorthStar Controller)
Junos Space	Not Vulnerable.
Apstra	Not Vulnerable.
Corero	The Corero SmartWall ONE platform is not vulnerable.
Security Director	Security Director Cloud and Security Director OnPrem are not vulnerable.
Security Threat Response Manager (JSA Series)	Vulnerable, fixed in JSA PHP Vulnerabilities Hotfix

Other products not listed above are still under investigation.

 

 

These issues were discovered by a third-party upstream provider.

Software releases will be updated to resolve this issue and made available on the Customer Support Downloads site.

 

The Security Threat Response Manager (JSA Series) Hotfix is available at: 

https://support.juniper.net/support/downloads/?p=juniper-secure-analytics

 

Note: Juniper SIRT's policy is not to evaluate releases that are beyond End of Engineering (EOE) or End of Life (EOL).

For most products, disable web access or limit access to trusted hosts and administrators.