PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619): Kaseya status - Investigation and Remediation

Kaseya is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619.

CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, potentially allowing attackers to achieve remote code execution using out-of-memory (OOM) triggers.

CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be accessed during subsequent requests, potentially enabling arbitrary code execution.

Kaseya has completed an evaluation of its product portfolio regarding these vulnerabilities. A summary of the current status across impacted products and services is provided in the table below. As our investigation and remediation efforts continue, we will keep the following list updated with the latest information.

Here is what each status means:

<b>Fully Patched:</b> The fix has been applied.

<b>Compensating Controls:</b> We have put controls in place to reduce exposure and potential impact while we work on remediation.

<b>Unaffected:</b> The product is not affected by these vulnerabilities.

Product Status:

AudIT - Unaffected
Autotask PSA - Fully Patched
Datto Backup for Azure Files + Blob Storage - Unaffected
BMS/Vorex - Fully patched
ConnectBooster - Unaffected
Datto Backup For Azure - Unaffected
Datto BCDR - Compensating Controls
Datto Direct to Cloud Products - Compensating Controls
Datto EDR - Unaffected
Datto Networking - Compensating Controls
Datto Partner Portal - Compensating Controls
Datto RMM - Fully Patched
Datto SaaS Defense - Unaffected
Datto SaaS Protection + Backupify - Compensating Controls
Datto Workplace + File Protect - Fully Patched
Endpoint Backup V2 - Fully Patched
Graphus - Unaffected
ID Agent - Fully Patched
Inky - Unaffected
IT Glue - Unaffected
Kaseya One - Unaffected
Kaseya Quote Manager - Fully Patched
Kaseya MDM - Unaffected
Microsoft Entra Backup - Unaffected
MyITProcess - Unaffected
Passly - Unaffected
RapidFire Tools - Fully Patched
RocketCyber - Fully Patched
SaaS Alerts -Unaffected
Secure Payments - Fully Patched
Spanning - Fully Patched
Unitrends - Fully Patched
UniView - Unaffected
vPenTest - Fully Patched
VSA 10 On Prem - Unaffected
VSA 10 Cloud - Fully Patched
VSA 9 On Prem - Unaffected
VSA 9 Cloud - Fully Patched

Please note that Unitrends customers will need to take an additional action as outlined in our Knowledgebase: https://help.unitrends.kaseya.com/help/Content/Satori/release-notes/release-notes-11-2-0-3.htm

We will continue to provide updates as additional information becomes available.

For additional questions, please create a ticket with our Support team here: https://helpdesk.kaseya.com/hc/en-gb#/contact

<b>Changelog Last Update: 11/12/2026 - Spanning - Moved from Compensating Controls to Fully Patched</b>

Two critical vulnerabilities were disclosed in third-party PHP libraries that allow unauthenticated remote code execution. Kaseya security teams are assessing all Kaseya systems and products and applying fixes as they become available.

This page is the source of truth for Kaseya status and guidance.

Product Status:
All products: Customer action: none
Kaseya corporate infrastructure: Customer action: none
Third-party components in Kaseya products: Customer action: none