Kyocera Document Solutions is aware of two critical PHP vulnerabilities publicly disclosed on October 21, 2026. An investigation has confirmed that KYOCERA Net Manager (KNM) and Fiery products are affected. Information regarding the vulnerability and currently available countermeasures is provided below.

【Vulnerability description】

On October 21, 2026, two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were publicly disclosed. If successfully exploited, these vulnerabilities could allow an unauthenticated remote attacker to execute arbitrary code on an affected system. This may impact the confidentiality, integrity, and availability of data and services.

【Affected Products】　

【Security Patch Availability】　

Security patches are currently under development. Additional information, including patch availability and release schedules, will be communicated as soon as it becomes available.

【Temporary Mitigation】　

No permanent workaround is currently available.

Until security patches become available, customers are strongly advised to:

• Prevent direct access from the Internet
• Restrict access to trusted networks, users, and devices only
• Monitor systems for suspicious activity

【Additional Information】

For the latest information, please refer to the official KYOCERA Document Solutions Global Security Announcement:

https://www.kyoceradocumentsolutions.com/global/en/support-and-download/security-information/info_20261022.html