Does Layer7 Product Suite: Api Gateway, Portal, Mobile, Oauth. Have exposure to PHP CVE-2026-109618 CVE-2026-109619

Products

• CA API Gateway Precision API Monitoring Module for API Gateway (Layer 7)
• CA API Gateway
• CA API Developer Portal

Issue/Introduction

CVE-2026-109618 and CVE-2026-109619 related to potential remote code execution (RCE) in PHP.

As such these new raised vulnerabilities have raised questions to whether the Layer7 Product suite is affected.

Including :

Layer7 API Gateway

Layer7 CA API Developer Portal

Layer7 Mobile API Gateway

Layer7 Oauth Tool Kit

Environment

Layer7 API Gateway:11.x

Layer7 CA API Developer Portal: 5.x

Layer7 Mobile API Gateway: 4.x

Layer7 Oauth Tool Kit: 4.x

Resolution

Layer 7 API Gateway, Layer7 API Portal, and Layer7 Mobile API Gateway, Layer7 Oauth Tool Kit are not vulnerable to CVE-2026-109618 or CVE-2026-109619.

Layer7 Product Suite does not use PHP in any capacity.