Fortinet has published security advisory FG-IR-26-186, announcing an investigation into the impact of a critical vulnerability in the PHP core — CVE-2026-109618 — on its product line. The vulnerability has a CVSSv3 score of 9.8 and is classified as critical. It allows an unauthenticated attacker to achieve remote code execution (RCE) by manipulating the handling of out-of-memory errors. At the time the advisory was published, 12 Fortinet products were still under investigation, while another 12 were confirmed as not affected. The advisory material available does not specify the exact affected versions or patches.
Vulnerability mechanism
According to Fortinet’s description, CVE-2026-109618 is related to how PHP uses the longjmp() function to handle out-of-memory (OOM) errors. When an OOM error occurs, PHP exits the current context and terminates request processing. The problem is that some contexts do not correctly account for this scenario: the request memory remains in an uninitialized state after the allocation attempt. The subsequent request cleanup procedure reads this memory or makes decisions based on it. Multiple strategies for triggering OOM allow this state to be reliably reproduced and used to achieve arbitrary code execution.
Key characteristics of the vulnerability according to Fortinet:
- CVE ID: CVE-2026-109618
- CVSSv3: 9.8 (Critical)
- Attack type: unauthenticated
- Impact: execution of unauthorized code or commands
- Source: third-party library (PHP)
- Known exploitation: according to Fortinet, none has been observed at the time of publication
The advisory title also mentions CVE-2026-109619, but the accessible text of the advisory does not contain a technical description, severity rating, or list of affected products for this identifier.
Affected and unaffected products
Fortinet divided its products into two categories. The following products are under investigation — meaning Fortinet has not yet definitively determined whether they are vulnerable:
- FortiADC
- FortiADC Manager
- FortiClient EMS
- FortiDDoS
- FortiDDoS-F
- FortiSIEM
- FortiMonitor
- FortiClient Cloud
- FortiSOAR
- FortiSOAR PaaS
- FortiGuard
- FortiEndpoint
Products confirmed as not affected by the vulnerability:
- FortiOS, FortiManager, FortiAnalyzer
- FortiWeb, FortiMail
- FortiClient Linux, FortiClient Windows, FortiClient MacOS
- FortiSASE, FortiAuthenticator, FortiSwitch, FortiNAC
It is important to emphasize that “under investigation” status does not mean a confirmed vulnerability. This list may change as Fortinet completes its analysis. The advisory material available does not contain information on affected versions or upgrade paths — this may be because the investigation is still in progress, or because the full text of the advisory contains additional details.
Impact assessment
The combination of three factors makes CVE-2026-109618 a priority for attention: a CVSS score of 9.8, the ability to exploit it without authentication, and the broad range of potentially affected products. The list of products under investigation includes traffic management solutions (FortiADC), SIEM systems (FortiSIEM), security orchestration platforms (FortiSOAR), and DDoS protection tools. These products are typically deployed in organizations’ critical security infrastructure.
It is worth noting that we have previously covered critical vulnerabilities in Fortinet products, including the critical FortiSIEM vulnerability with CVSS 9.4 and the FortiSandbox authentication bypass with CVSS 9.6. FortiSIEM has once again appeared on the list of products under investigation, underscoring the need to closely monitor updates for this platform.
Recommendations
Since Fortinet has not published specific versions to upgrade to or workarounds in the advisory material available, current recommendations are limited to the following:
- Monitor the advisory: track updates to FG-IR-26-186 — Fortinet may supplement it with information on affected versions and patches as the investigation progresses
- Inventory: determine whether products from the list under investigation are used in your infrastructure and prepare a plan for rapid updates
- Network segmentation: restrict network access to management interfaces of products under investigation, minimizing the attack surface until the vendor issues final recommendations
- Anomaly monitoring: increase monitoring of products under investigation for atypical activity — abnormal memory usage, unexpected processes, or suspicious network connections
Organizations running products from the list under investigation — especially FortiSIEM, FortiSOAR, and FortiADC — should prepare emergency update procedures now and restrict external access to these systems. Once Fortinet completes its investigation and publishes specific fixed versions, delaying their deployment in the context of a CVSS 9.8 vulnerability that does not require authentication will pose a serious risk.
