# CERT-FR flags critical Aruba, Cisco, PHP flaws

Published: 2026-10-26 · Severity: severe · Sectors: Technology, Telecommunications
Canonical: https://vorant.io/reports/5c08a5f6-e183-56a5-91a2-d56982935554/cert-fr-flags-critical-aruba-cisco-php-flaws

> CERT-FR's weekly bulletin highlights CVSS-10 RCEs in HPE Aruba AOS, Cisco UCM/VCS, and actively exploited PHP and third-party vulnerabilities needing urgent patching.

CERT-FR's weekly vulnerability roundup (week 43, 2026) consolidates the most significant advisories published between 19 and 25 October. The standout is a batch of 19 HPE Aruba Networking AOS vulnerabilities, several rated a maximum CVSS 10, enabling unauthenticated remote code execution, SQL injection, privilege escalation and security bypasses on Aruba's networking OS — no public PoC is yet known but the sheer count and severity make this the week's priority patch. Cisco disclosed multiple 9.3–9.8 CVSS flaws in Unified Communications Manager, IM&Presence, Unity Connection and TelePresence VCS (including a static-credential issue enabling RCE/security bypass) and an integrity-impacting issue in Secure Firewall Threat Defense's Snort 3 engine. SolarWinds, F5 NGINX, and Apache Tomcat also received high-severity RCE/DoS/confidentiality advisories with no confirmed in-the-wild exploitation reported.

Separately, PHP disclosed two critical vulnerabilities fixed in October, plus a newly reported RCE (CVE-2026-115560) deemed unlikely to be exploited and awaiting a fix. Most notably, CERT-FR confirms it is now aware of public proof-of-concept code and active exploitation attempts against CVE-2026-109618 and CVE-2026-109619 for specific PHP deployments — a point of real urgency given PHP's broad use across web products. The bulletin's 'Other vulnerabilities' table lists several already-exploited flaws: Arista VeloCloud Orchestrator privilege escalation/data exposure (CVE-2026-114625), Collabora Online CODE Server RCE (CVE-2026-110447), Plex Media Server confidentiality/SSRF issues, E-Guardian Siteguard arbitrary code execution, Siemens Software Center arbitrary code execution, and a WordPress Superio theme privilege-escalation flaw with public exploit code.

For defenders, priorities are: apply HPE Aruba AOS patches immediately given the CVSS-10 ratings even absent confirmed exploitation; treat Cisco UCM/VCS and Secure Firewall advisories as high priority on exposed voice/firewall infrastructure; and assume active exploitation against the flagged PHP CVEs and the listed 'Exploitée' third-party products (Arista, Collabora, Plex, Siteguard, Siemens), prioritizing those patches over the unconfirmed ones.

## Mentioned in this report

- Vulnerabilities: CVE-2026-103119, CVE-2026-110447 (KEV), CVE-2026-114625 (KEV), CVE-2026-15176, CVE-2026-20043, CVE-2026-28308, CVE-2026-28324, CVE-2026-76466, CVE-2026-76473, CVE-2026-76474, CVE-2026-76475, CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, CVE-2026-79851, CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, CVE-2026-79861, CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, CVE-2026-79871, CVE-2026-93479, CVE-2026-97205

Source reporting: https://www.cert.cyber.gouv.fr/actualite/CERTFR-2026-ACT-045

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/5c08a5f6-e183-56a5-91a2-d56982935554/cert-fr-flags-critical-aruba-cisco-php-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup