Summary

PHP vulnerabilities (CVE-2026-109619, CVE-2026-109618). Successful exploitation of these vulnerabilities may allow an attacker to achieve remote code execution. For details on these vulnerabilities, refer to: https://www.php.net/archive/2026.php.
Ruijie is investigating its product lines to determine which products and services may be affected. This work is ongoing. As the investigation progresses, Ruijie will update this advisory with information on the affected products and services. Please continue to monitor this advisory.

Affected Products and Remediation Plan

Ruijie is investigating to determine which products may be affected by these vulnerabilities.


Product Model Affected Versions Fixed Version / Remediation Plan
RG-WS7204-A Versions prior to AC_RGOS 11.9(6)W7 AC_RGOS 11.9(6)W7
RG-WS7208-A Versions prior to AC_RGOS 11.9(6)W7 AC_RGOS 11.9(6)W7
WS7005-A(V2) Versions prior to AC_RGOS 11.9(6)W5B9P2 AC_RGOS 11.9(6)W5B9P2
RG-SC6705-SP Versions prior to AC_RGOS 11.9(6)W5B9P2 AC_RGOS 11.9(6)W5B9P2
Obtaining Fixed Software：
  1. The product that supports automatic update will receive a system update prompt. You can install the update to fix the vulnerability.
  2. Download it from the Ruijie Networks websites.
  3. Contact local after-sales personnel to obtain it.

Unaffected Products

Ruijie has confirmed that the following products are not affected. Note: this section will be updated as information becomes available.
  • Ruijie data center switches (including the RG-N and RG-S series)
  • Ruijie switches (including the RG-S and RG-CS series)
  • Ruijie data center business management software and NFV-related products (including the ONC controller, hsproxy plug-in,ION collector, VNSC controller, Analyzer, vsw, NFV, and NEUTRON)
  • Ruijie wireless products
  • Ruijie Cybrey CS, CAP, CNC, CR and CF full series
  • Ruijie firewall RG-WALL 1600 Z-S series
  • Ruijie Reyee RG-NBS series
  • Ruijie Reyee RG-EG series
  • Ruijie Reyee RG-RAP series
  • Ruijie Reyee RG-EAP series
  • Ruijie Reyee RG-EST series
  • Ruijie Reyee RG-AirMetro series
  • Ruijie Reyee e-Lighten series(NBF/APF)
  • Ruijie Reyee RG-EW series
  • Ruijie Reyee RG-NIS series
  • Ruijie Reyee RG-ES1 series
  • Ruijie Reyee RG-ES2 series
  • Ruijie Reyee RG-YS series
  • Ruijie Reyee RG-FS3 series
  • Ruijie Cloud (MACC)
  • Security Cloud
  • SNC
  • ONC-wan
  • RG-UNC
  • RG-SAM+
  • RG-SMP+
  • INC-PRO
  • Secure Path
  • RG-Enjoy

Source

Externally and publicly disclosed.

Revision History

Date
Revision History
2026-10-23
Initial release
2026-10-27
Update the list of affected products and the list of products not affected by the vulnerability
2026-10-28
Update the list of products unaffected by this vulnerability

Contact Us

Ruijie Networks adheres to protecting the ultimate interests of users with best efforts and the principle of responsible disclosure and deals with product security issues through our response mechanism.
To enjoy Ruijie Networks PSIRT services and obtain Ruijie Networks product vulnerability information, please visit https://www.ruijienetworks.com/support/securityBulletins .
To report a security vulnerability in Ruijie Networks products and solutions, please send it to  PSIRT@ruijie.com.cn . For details, please visit https://www.ruijienetworks.com/support/securityBulletins/vulnerability_reporting .
You can contact us through the following channels:
  1. Support:https://www.ruijienetworks.com/support
  2. Community:https://community.ruijienetworks.com/portal.php
  3. Live Chat:https://www.ruijienetworks.com/rita