Zultys Security Advisory Notice - SAN26-008 Rev 1.0

MX-SE, MX-SE II, MX-E and MX-Virtual systems – Firmware versions 18.4.13, 19.0.16, 19.0.20.

None

Not applicable

Not applicable

On October 21, 2026 details of a vulnerability in PHP, CVE-2026-109618 – Remote code execution via out-of-memory errors – was published in the CVE Vulnerability Database.

Zultys has evaluated the reported vulnerability and confirmed that MX-SE, MX-SE II, MX-E and MX-Virtual products running firmware versions 18.4.13, 19.0.16 or 19.0.20 are not impacted.

The MX platform does not use PHP and the operating system does not include the PHP interpreter.

Note: Earlier firmware versions which have reached end of support are not evaluated.

If additional information is required contact support@zultys.com or your Authorized Zultys Channel Partner.