CVE-2026-109618, CVE-2026-109619

CVE-2026-109618, CVE-2026-109619

Max CVSS: 9.2

Published: October 21, 2026

Xona Systems Security Advisory

Critical PHP Security Vulnerability in Legacy Xona CSG

Summary

2 critical security vulnerabilities have been identified in the PHP runtime used by legacy versions of the Xona Critical System Gateway (CSG).

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, affect PHP's handling of out-of-memory conditions during HTTP request processing. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code within the context of the affected web service.

These vulnerabilities affect Xona CSG versions up to and including v4.

The Xona X-Connect Manager (XCM) platform, introduced with version 5, is not affected by this vulnerability.

Who is affected

Customers operating Xona Critical System Gateway (CSG) versions v4 and earlier are affected by this vulnerability.

Customers operating Xona X-Connect Manager (XCM) version 5 or later are not affected.

What to do

Xona recommends that customers running affected legacy CSG versions migrate to the XCM platform (v5 or later) as soon as possible.

If immediate migration is not possible, the following interim measures can help reduce exposure:

• Restrict access to affected CSG web interfaces to trusted networks and authorized sources using appropriate network firewall rules and access controls.
• Avoid exposing affected web interfaces directly to untrusted networks or the public internet.
• Where available, implement web application firewall protections and HTTP request-size restrictions to reduce exposure to malicious requests.
• Monitor affected systems for suspicious HTTP activity, unexpected web service behavior, and indications of unauthorized access.

Interim measures reduce risk but do not eliminate the underlying vulnerability. Customers should prioritize migration to an unaffected Xona platform or contact Xona Support for approved remediation options.

Further information

Security teams, researchers, and customers with questions about this vulnerability or assistance with migration should contact Xona Support at support@xonasystems.com.

For additional technical information, refer to:

• CISA Security Alert — Critical Vulnerabilities in PHP Require Immediate Patching
• PHP Security Advisory — CVE-2026-109618
• PHP Security Advisory — CVE-2026-109619