CERT-FR flags critical Aruba, Cisco, PHP flaws
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
CERT-FR's weekly bulletin highlights CVSS-10 RCEs in HPE Aruba AOS, Cisco UCM/VCS, and actively exploited PHP and third-party vulnerabilities needing urgent patching.
CERT-FR's weekly vulnerability roundup (week 43, 2026) consolidates the most significant advisories published between 19 and 25 October. The standout is a batch of 19 HPE Aruba Networking AOS vulnerabilities, several rated a maximum CVSS 10, enabling unauthenticated remote code execution, SQL injection, privilege escalation and security bypasses on Aruba's networking OS — no public PoC is yet known but the sheer count and severity make this the week's priority patch. Cisco disclosed multiple 9.3–9.8 CVSS flaws in Unified Communications Manager, IM&Presence, Unity Connection and TelePresence VCS (including a static-credential issue enabling RCE/security bypass) and an integrity-impacting issue in Secure Firewall Threat Defense's Snort 3 engine. SolarWinds, F5 NGINX, and Apache Tomcat also received high-severity RCE/DoS/confidentiality advisories with no confirmed in-the-wild exploitation reported.
Separately, PHP disclosed two critical vulnerabilities fixed in October, plus a newly reported RCE (CVE-2026-115560) deemed unlikely to be exploited and awaiting a fix. Most notably, CERT-FR confirms it is now aware of public proof-of-concept code and active exploitation attempts against CVE-2026-109618 and CVE-2026-109619 for specific PHP deployments — a point of real urgency given PHP's broad use across web products. The bulletin's 'Other vulnerabilities' table lists several already-exploited flaws: Arista VeloCloud Orchestrator privilege escalation/data exposure (CVE-2026-114625), Collabora Online CODE Server RCE (CVE-2026-110447), Plex Media Server confidentiality/SSRF issues, E-Guardian Siteguard arbitrary code execution, Siemens Software Center arbitrary code execution, and a WordPress Superio theme privilege-escalation flaw with public exploit code.
For defenders, priorities are: apply HPE Aruba AOS patches immediately given the CVSS-10 ratings even absent confirmed exploitation; treat Cisco UCM/VCS and Secure Firewall advisories as high priority on exposed voice/firewall infrastructure; and assume active exploitation against the flagged PHP CVEs and the listed 'Exploitée' third-party products (Arista, Collabora, Plex, Siteguard, Siemens), prioritizing those patches over the unconfirmed ones.
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/actualite/CERTFR-2026-ACT-045
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,237 reports from 143 sources, 591 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs