This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Accept
Reject
Help
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 

Security Impact Assessment – CVE-2026-109618 / CVE-2026-109619 on ExtremeCloud IQ Controller (XIQ-C)

Security Impact Assessment – CVE-2026-109618 / CVE-2026-109619 on ExtremeCloud IQ Controller (XIQ-C)

Marino_Choi
New Contributor

a week ago

Dear Extreme Networks Support,

We would like to request an official security impact assessment for ExtremeCloud IQ Controller (XIQ-C) regarding the recently disclosed critical PHP vulnerabilities:

  • CVE-2026-109618

  • CVE-2026-109619

The UK NCSC has issued an alert regarding these vulnerabilities and recommends organizations identify systems running PHP, including third-party products and appliances that may bundle PHP.

Could you please confirm the following?

  1. Is ExtremeCloud IQ Controller (XIQ-C) affected by CVE-2026-109618 and/or CVE-2026-109619?

  2. Does the XIQ-C appliance include PHP, and if so, which PHP version(s) are included in the affected XIQ-C releases?

  3. If XIQ-C is affected, which XIQ-C versions are impacted and which version contains the security fix?

  4. Will Extreme Networks provide an official security patch or XIQ-C software update to address these vulnerabilities?

  5. Is manually upgrading or patching PHP on the XIQ-C appliance officially supported?

  6. Could manually upgrading PHP affect XIQ-C functionality or Extreme TAC support eligibility?

We will not make any manual changes to the embedded PHP packages until we receive official guidance from Extreme Networks.

Please provide the recommended mitigation or remediation procedure if XIQ-C is affected.

Best regards,

Bumkyu Choi

0 Kudos
0 REPLIES 0
GTM-P2G8KFN