SECURITY UPDATE | Advisory released: 22 October 2026
Moxa products are not affected
Moxa has confirmed that none of its products are affected by CVE-2026-109618 and CVE-2026-109619, the two PHP vulnerabilities covered in security advisory MPSA-260001.
What has Moxa confirmed?
On 22 October 2026, Moxa released version 1.0 of its security advisory assessing the impact of these two PHP vulnerabilities on its products. Its conclusion is clear:
“Moxa has determined that none of our products are affected.”
— Moxa Security Advisory MPSA-260001
What are the PHP vulnerabilities?
Both vulnerabilities involve how PHP manages memory while processing requests. Under certain conditions, these memory-handling issues can lead to remote code execution, potentially allowing an attacker to run code on an affected system.
CVE-2026-109618
An issue in handling out-of-memory errors can leave request memory uninitialised and subsequently accessed during cleanup. Under certain conditions, this can lead to remote code execution.
CVE-2026-109619
Global state can retain references to request memory after it has been freed, allowing later requests to access stale memory. Under certain conditions, this can also lead to remote code execution.
What this means for Moxa users
For customers using Moxa products, the advisory provides reassurance that Moxa has assessed these two vulnerabilities and identified no affected products. The advisory does not list any affected models or prescribe a product-specific patch or workaround for these CVEs.
This assessment concerns Moxa products and the two CVEs named above. Other PHP-based applications or systems in your environment should be assessed separately against their respective vendors’ guidance.
Read the official advisory
For the manufacturer’s statement and any subsequent revisions, refer to Moxa’s official security advisory.
Read Moxa’s Official AdvisoryQuestions about your Moxa setup? Message us or get in touch with TNS Team.
Source: Moxa Security Advisory MPSA-260001, version 1.0, released 22 October 2026. This article summarises the advisory as issued on that date.
