CVE-2026-109619

Ein Hersteller-Fix ist verfügbar.

• BehobenABB Manufacturing Execution System (MES) installed with Dokuwikiabb_psirt

  The vulnerabilities are not tight to any specific MES version but solely depend on the delivery including Dokuwiki, which relies on affected PHP versions. The affected PHP versions are listed in CERT-EU - Critical Vulnerabilities in PHP Reference section. The problem is corrected in the following product versions: • PHP 8.5.12 • PHP 8.4.27 • PHP 8.3.36 • PHP 8.2.35 ABB recommends that customers apply the updates immediately. The updates are applied by updating the PHP packages in operating system of the servers that run Dokuwiki. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. PHP is installed on the web server / operating system, so upgrading PHP is a server administration task. It needs to be checked which PHP packages are installed on the system, and upgrade them (depending on the OS, with either ‘dnf’ or ‘yum’). ABB recommends that only PHP packages are updated, not the whole Dokuwiki installation.

• BehobenAPROLabb_psirt

  B&R is actively working on patch versions for affected products. Based on current planning, these are expected to be released on October 26, 2026 (for R 4.4-65) and October 29, 2026 (for R 4.4-01). B&R will up-date this advisory if these dates change. APROL is intended to be operated only in environments with restricted logical and physical access, as described in the product documentation and in “Defense in Depth for B&R products”. Until patches are available and installed, B&R recommends that customers restrict HTTP(S) traffic to the APROL system, particularly from untrusted networks, and implement additional security measures to limit access to the product to trusted personnel. We advise customers to review and validate their current access re-strictions to confirm that logical and physical access controls are configured in line with these recom-mendations. These measures reduce, but may not fully eliminate, the risk of exploitation.

• BehobenRUGGEDCOM APE1808siemens_psirt

  Contact customer support to receive patch and update information

• Behobenphp-srccisa_csaf_it

  Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.

  https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp↗
• MitigationABB Manufacturing Execution System (MES) installed with Dokuwikiabb_psirt

  Updating to a release containing the patches is the only complete and reliable mitigation. You should immediately update the PHP component in Dokuwiki to one of the following: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP is installed on the web server / operating system, so upgrading PHP is a server administration task. • To check the version of PHP: use ‘php -v’ (as ‘root’). • The exact names and availability of individual PHP packages vary by distribution release. To see the list of installed PHP packages: dnf list installed 'php*'. o Typical package names on RHEL-family systems look like: - php - php-cli - php-common - php-gd - php-intl - php-mbstring - php-opcache - php-pdo - php-xml - (there might be other PHP packages, as well) Refer to section “General security recommendations” for further advise on how to keep your system secure.

• MitigationAPROLabb_psirt

  APROL is intended to be operated only in environments with restricted logical and physical access, as described in the product documentation and in “Defense in Depth for B&R products”. Until patches are available and installed, B&R recommends that customers implement additional security measures to limit access to the product to trusted personnel. We advise customers to review and validate their cur-rent access restrictions to confirm that logical and physical access controls are configured in line with these recommendations. These measures reduce, but may not fully eliminate, the risk of exploitation. It is recommended to block any HTTP(S) traffic, particularly from untrusted networks, reaching the APROL system on your connected firewalls. Refer to section “General security recommendations” for further advise on how to keep your system secure.

• WorkaroundABB Manufacturing Execution System (MES) installed with Dokuwikiabb_psirt

  The only workaround, while patches are not installed, is to temporarily shut down the Dokuwiki server(s).