PHP vulnerabilities
CVE-2026-109618 and CVE-2026-109619
Summary
Barracuda is aware of two critical vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619, that could allow unauthenticated attackers to remotely execute code on affected web servers.
We are actively assessing Barracuda products and services for potential impact and taking appropriate action where necessary. This advisory will be updated as product assessments are completed.
Product status
The table below reflects the current status of our assessment. Status will be updated as each product is validated.
| Product | Status |
|---|---|
|
Email Security Gateway (ESG)
|
Not affected
|
|
CloudGen Firewall
|
Under investigation
|
|
CloudGen WAN
|
Under investigation
|
|
SecureEdge
|
Under investigation
|
|
Cloud Control
|
Under investigation
|
|
Email Gateway Defense
|
Under investigation
|
|
Cloud-to-Cloud Backup
|
Not affected
|
|
Cloud Archiving Service
|
Not affected
|
|
Web Security Gateway / Web Security Agent
|
Not affected
|
|
Web Application Firewall / Load Balancer ADC / WAF Control Center
|
Under investigation
|
|
WAF as a Service / Active DDoS Protection
|
Under investigation
|
|
Vulnerability Manager
|
Under investigation
|
|
XDR
|
Under investigation
|
|
Advanced Threat Protection
|
Not affected
|
|
Data Inspector
|
Not affected
|
|
Incident Response & Impersonation Protection
|
Not affected
|
|
Security Awareness Training
|
Under investigation
|
|
RMM
|
Not affected
|
|
BarracudaONE
|
Not affected
|
|
MSP / Maestro
|
Under investigation
|
|
Backup Service (BBS)
|
Under investigation
|
Don’t wait to get protected
Get a free consultation with a cybersecurity expert and see Barracuda's cybersecurity solutions in action.
