Trellix is aware of two critical vulnerabilities recently disclosed in PHP (CVE-2026-109618 and CVE-2026-109619). Our security and product teams have assessed these vulnerabilities across Trellix network security products, and we want to share what we found and what we recommend.
Affected product
Trellix Central Management System (CMS) includes PHP as part of its embedded content distribution service and is affected. Trellix assesses the risk to CMS customers as lower than the published severity score for three reasons:
- Authentication is required. The vulnerable code can only be reached with FENET service credentials, which are generated automatically and issued only to managed appliances.
- Exploitation is complex. A successful attack depends on memory and server process conditions outside an attacker’s control.
- No known exploitation. As of October 22, 2026, Trellix is not aware of any active exploitation of these vulnerabilities against CMS.
Products not affected
Network Security (NX), Email Security (EX), Malware Analysis (AX), File Protect (FX), Intelligent Virtual Execution (IVX), Enterprise Security Manager (ESM) and Endpoint Security (HX) do not include a PHP request path and are not affected.
Recommended actions for CMS customers
Until the update is applied, Trellix recommends:
- Restricting access to the CMS FENET endpoint (HTTPS port 443, path /fenet) to the IP addresses of your managed appliances.
- Keeping the CMS management network separate from general user networks and from networks exposed to the internet.
Update availability
The PHP update will be included in CMS 11.0.2, planned for Q1 2027. Trellix continues to monitor this situation closely. If our assessment changes, including if a working exploit becomes publicly available, Trellix may deliver a CMS hotfix ahead of that release. We will update this guidance if that happens.