CA IT Asset Manager (ITAM)/CA Asset Portfolio Management (APM): Assessment for PHP Remote Code Execution Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)

Products

• CA IT Asset Manager
• CA IT Asset Manager Asset Portfolio Management
• CA Service Management - Asset Portfolio Management

Issue/Introduction

This KB article addresses inquiries regarding CA IT Asset Manager (ITAM)/CA Asset Portfolio Management (APM) exposure to the critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) detailed in CERT-EU Security Advisory 2026-018.

Environment

CA IT Asset Manager (ITAM)/CA Asset Portfolio Management (APM) 17.x

Resolution

CA IT Asset Manager (ITAM)/CA Asset Portfolio Management (APM) is NOT vulnerable to CVE-2026-109618 or CVE-2026-109619.

No patch, configuration update or mitigation steps are required for CA IT Asset Manager (ITAM)/CA Asset Portfolio Management (APM) regarding these PHP advisories.

Additional Information

Older releases of CA IT Asset Manager (ITAM)/CA Asset Portfolio Management (APM) (up to release 17.3) may include a legacy CA Software Asset Manager (SAM) implementation, which operated on PHP 7.  

Please be aware that CA Software Asset Manager (SAM) has been end of life (EOL) since May 31, 2022. 

If customers have environments that are continuing to use CA SAM, they should engage with USU Support to discuss upgrade and mitigation options.