https://community.extremenetworks.com/t5/extremecloud-iq-controller/security-impact-assessment-cve-2026-109618-cve-2026-109619-on/m-p/122869#M870 <P><SPAN>Dear Extreme Networks Support,</SPAN></P><P><SPAN>We would like to request an official security impact assessment for ExtremeCloud IQ Controller (XIQ-C) regarding the recently disclosed critical PHP vulnerabilities:</SPAN></P><UL><LI><P><SPAN>CVE-2026-109618</SPAN></P></LI><LI><P><SPAN>CVE-2026-109619</SPAN></P></LI></UL><P><SPAN>The UK NCSC has issued an alert regarding these vulnerabilities and recommends organizations identify systems running PHP, including third-party products and appliances that may bundle PHP.</SPAN></P><P><SPAN>Could you please confirm the following?</SPAN></P><OL><LI><P><SPAN>Is ExtremeCloud IQ Controller (XIQ-C) affected by CVE-2026-109618 and/or CVE-2026-109619?</SPAN></P></LI><LI><P><SPAN>Does the XIQ-C appliance include PHP, and if so, which PHP version(s) are included in the affected XIQ-C releases?</SPAN></P></LI><LI><P><SPAN>If XIQ-C is affected, which XIQ-C versions are impacted and which version contains the security fix?</SPAN></P></LI><LI><P><SPAN>Will Extreme Networks provide an official security patch or XIQ-C software update to address these vulnerabilities?</SPAN></P></LI><LI><P><SPAN>Is manually upgrading or patching PHP on the XIQ-C appliance officially supported?</SPAN></P></LI><LI><P><SPAN>Could manually upgrading PHP affect XIQ-C functionality or Extreme TAC support eligibility?</SPAN></P></LI></OL><P><SPAN>We will not make any manual changes to the embedded PHP packages until we receive official guidance from Extreme Networks.</SPAN></P><P><SPAN>Please provide the recommended mitigation or remediation procedure if XIQ-C is affected.</SPAN></P><P><SPAN>Best regards,</SPAN></P><P><SPAN>Bumkyu Choi</SPAN></P> Thu, 22 Oct 2026 06:42:53 GMT Marino_Choi 2026-10-22T06:42:53Z https://community.extremenetworks.com/t5/extremecloud-iq-controller/security-impact-assessment-cve-2026-109618-cve-2026-109619-on/m-p/122869#M870 <P><SPAN>Dear Extreme Networks Support,</SPAN></P><P><SPAN>We would like to request an official security impact assessment for ExtremeCloud IQ Controller (XIQ-C) regarding the recently disclosed critical PHP vulnerabilities:</SPAN></P><UL><LI><P><SPAN>CVE-2026-109618</SPAN></P></LI><LI><P><SPAN>CVE-2026-109619</SPAN></P></LI></UL><P><SPAN>The UK NCSC has issued an alert regarding these vulnerabilities and recommends organizations identify systems running PHP, including third-party products and appliances that may bundle PHP.</SPAN></P><P><SPAN>Could you please confirm the following?</SPAN></P><OL><LI><P><SPAN>Is ExtremeCloud IQ Controller (XIQ-C) affected by CVE-2026-109618 and/or CVE-2026-109619?</SPAN></P></LI><LI><P><SPAN>Does the XIQ-C appliance include PHP, and if so, which PHP version(s) are included in the affected XIQ-C releases?</SPAN></P></LI><LI><P><SPAN>If XIQ-C is affected, which XIQ-C versions are impacted and which version contains the security fix?</SPAN></P></LI><LI><P><SPAN>Will Extreme Networks provide an official security patch or XIQ-C software update to address these vulnerabilities?</SPAN></P></LI><LI><P><SPAN>Is manually upgrading or patching PHP on the XIQ-C appliance officially supported?</SPAN></P></LI><LI><P><SPAN>Could manually upgrading PHP affect XIQ-C functionality or Extreme TAC support eligibility?</SPAN></P></LI></OL><P><SPAN>We will not make any manual changes to the embedded PHP packages until we receive official guidance from Extreme Networks.</SPAN></P><P><SPAN>Please provide the recommended mitigation or remediation procedure if XIQ-C is affected.</SPAN></P><P><SPAN>Best regards,</SPAN></P><P><SPAN>Bumkyu Choi</SPAN></P> Thu, 22 Oct 2026 06:42:53 GMT https://community.extremenetworks.com/t5/extremecloud-iq-controller/security-impact-assessment-cve-2026-109618-cve-2026-109619-on/m-p/122869#M870 Marino_Choi 2026-10-22T06:42:53Z