CVE-2026-109618 and CVE-2026-109619 PHP vulnerabilities statement related to IGA and its components

Products

• CA Identity Governance
• CA Identity Manager
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

Concern regarding the Identity Manager product and its components published CVE-2026-109618 and CVE-2026-109619 PHP vulnerabilities.

Environment

Identity Manager
Identity Portal
Identity Governance
Identity Suite
Connector Server 
Provisioning Manager
IGA Xpress

Versions:
14.x
15

Resolution

It has been confirmed that none of the IGA products are affected by these vulnerabilities CVE-2026-109618 and CVE-2026-109619. The Identity Manager and Governance suite of products do not use PHP.

Identity Manager
Identity Portal
Identity Governance
Identity Suite
Connector Server 
Provisioning Manager
IGA Xpress