CERT-FR issued a notice on November 6, 2026, covering remote code execution vulnerabilities in specific Cisco products. In a same-day update, Cisco listed fixed version 26.2.1.9 as available for Ultra-Reliable Wireless Backhaul (URWB) and Unified Industrial Wireless Software. Check the exact product name and installed version against Cisco’s affected-version thresholds and fixes. CERT-FR’s notice
Cisco’s advisory, first published October 21 and updated November 6, covers CVE-2026-109618 and CVE-2026-109619. It describes both as vulnerabilities that could allow remote code execution, or code to run on an affected system from a remote connection. Cisco attributes the first to out-of-memory corruption and the second to stale global state. Cisco’s advisory
Affected Cisco products and fixed versions
The affected version thresholds and corresponding fixed releases are:
| Cisco product | Affected versions | Cisco-listed fixed version |
| Duo Access Gateway | Earlier than 3.2.0 | 3.2.0 |
| Expressway Series | Earlier than 15.5.21 | 15.5.21 |
| Expressway Select Series | Earlier than 15.5.21 | 15.5.21 |
| Ultra-Reliable Wireless Backhaul (URWB) | Earlier than 26.2.1.9 | 26.2.1.9 |
| Unified Industrial Wireless Software | Earlier than 26.2.1.9 | 26.2.1.9 |
Cisco’s November 6 update listed 26.2.1.9 as available for both wireless products. For Expressway Series and Expressway Select Series, Cisco points customers to bug record CSCwx37062 for fixed-software and workaround details. For URWB and Unified Industrial Wireless Software, it points to CSCwx37073.
Match the full product name and installed version before acting. ISE Portal Builder and ISE have different security statuses.
ISE Portal Builder and ISE have different statuses
Cisco says the fix for Identity Services Engine (ISE) Portal Builder was deployed and requires no customer action. Cisco lists Identity Services Engine (ISE) itself as not vulnerable to these PHP issues. The advisory also lists Secure Firewall Adaptive Security Appliance, Secure Firewall Threat Defense, Secure Firewall Management Center, IOS, IOS XE, IOS XR, NX-OS and all UCS software as not vulnerable.
What Cisco says about exploitation
Cisco PSIRT says it is not aware of malicious use of these vulnerabilities against any Cisco product. For URWB specifically, Cisco says exploitation requires administrator authentication and assigns that product case a CVSS 3.1 score of 6.6.
