Impact of PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 on PAM

Products

• CA Privileged Access Manager (PAM)
• CA Privileged Access Manager - Server Control (PAMSC)
• CA Privileged Identity Management Endpoint (PIM)
• CA Threat Analytics for PAM

Issue/Introduction

What is the impact of the following Critical Core PHP Unauthenticated Remote Code Execution Vulnerabilities on PAM?

CVE-2026-109618: PHP OOM Request Parsing Memory Corruption and Unauthenticated RCE

CVE-2026-109619: PHP Worker State Persistence Use-After-Free and Unauthenticated RCE

Environment

CA Privileged Access Manager (PAM) appliances.

Cause

IMS Advisory for PHP2shell Vulnerabilities CVE-2026-109618 & CVE-2026-109619 lists PAM as affected. The PAM appliance does not have an externally open PHP web service, but runs one internally and is not completely immune to these vulnerabilities.

Resolution

Published hotfixes are available for PAM releases 4.2.3-4.3.2, consistent with the PAM fix strategy.

Hotfix 4.3.2.85

Hotfix 4.3.1.85

Hotfix 4.3.0.85

Hotfix 4.2.4.85

Hotfix 4.2.3.85

All are standalone hotfixes that can coexist with, but do not depend on, any other hotfixes at the respective PAM release.

All patch binaries are available on the PAM Solutions & Patches page. Use Ctrl-F to search for a specific hotfix, such as "4.3.2.85". At the time of their release the patches are listed at the top of the page. Revert patches are available as well, but we recommend contacting Support before applying any revert patch.

Additional Information

Only the PAM server/appliance is affected. Other PAM components such as PAM clients, PAM agents, PAM Server Control agents, A2A clients, Socket Filter Agents, Windows Proxies and Threat Analytics for PAM are not affected by these vulnerabilities.