Cleo Product Security Advisory – PHP2Shell CVE-2026-109618 and CVE-2026-109619 – CVSS v4.0 (Critical)

  • Updated

This pertains to the public announcement of CVE-2026-109618 and CVE-2026-109619 – CVSS v4.0 (Critical), collectively referred to as PHP2Shell. These two vulnerabilities in PHP allow remote code execution (RCE). 

The Cleo products listed below are NOT affected by these vulnerabilities: 

Private Cloud Edition 
  • Cleo Harmony - not affected 
  • Cleo VLTrader - not affected
  • Cleo LexiCom - not affected
  • Cleo Clarify - not affected
  • Cleo Dashboards - not affected
Cloud Edition
Cleo Integration Cloud - not affected

 

The Cleo products listed below have been patched to protect against these vulnerabilities:

Compliance Edition
Cleo WebEDI - patched

Comments

0 comments

Please sign in to leave a comment.