22. 10. 2026 Thomas Forrer Bug Fixes, NetEye

NetEye 4 – Security Advisory (PHP)

Important: PHP security update

Type/Severity

NetEye Product Security has rated this update as having a CRITICAL security impact.

Topic

Updates for the php and glpi packages are now available for NetEye 4.

Security Fix for All NetEye Releases

  • php-7.4.33-8.module+el8.10.0+25117+30337cca
    • php-7.4.33-8.module+el8.10.0+25117+30337cca
    • php-cli-7.4.33-8.module+el8.10.0+25117+30337cca
    • php-common-7.4.33-8.module+el8.10.0+25117+30337cca
    • php-fpm-7.4.33-8.module+el8.10.0+25117+30337cca
    • php-gd-7.4.33-8.module+el8.10.0+25117+30337cca
    • php-gmp-7.4.33-8.module+el8.10.0+25117+30337cca
    • php-intl-7.4.33-8.module+el8.10.0+25117+30337cca
    • php-json-7.4.33-8.module+el8.10.0+25117+30337cca
    • php-ldap-7.4.33-8.module+el8.10.0+25117+30337cca
    • php-mbstring-7.4.33-8.module+el8.10.0+25117+30337cca
    • php-mysqlnd-7.4.33-8.module+el8.10.0+25117+30337cca
    • php-opcache-7.4.33-8.module+el8.10.0+25117+30337cca
    • php-pdo-7.4.33-8.module+el8.10.0+25117+30337cca
    • php-pgsql-7.4.33-8.module+el8.10.0+25117+30337cca
    • php-process-7.4.33-8.module+el8.10.0+25117+30337cca
    • php-soap-7.4.33-8.module+el8.10.0+25117+30337cca
    • php-xml-7.4.33-8.module+el8.10.0+25117+30337cca
    • php-xmlrpc-7.4.33-8.module+el8.10.0+25117+30337cca

Security Fix for NetEye 4.50

  • glpi-11.0.11_neteye1.25.7-1
    • glpi-11.0.11_neteye1.25.7-1
    • glpi-autosetup-11.0.11_neteye1.25.7-1
    • glpi-configurator-11.0.11_neteye1.25.7-1
    • glpi-neteye-config-11.0.11_neteye1.25.7-1

Security Fix for NetEye 4.49

  • glpi-neteye-config-11.0.11_neteye1.20.4-1.noarch
  • glpi-configurator-11.0.11_neteye1.20.4-1.noarch
  • glpi-autosetup-11.0.11_neteye1.20.4-1.noarch
  • glpi-11.0.11_neteye1.20.4-1.noarch

CVEs

1. CVE-2026-109618
  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
2. CVE-2026-109619
  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
3. CVE-2026-91765
  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4. CVE-2025-14181
  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
5. CVE-2026-91767
  CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
6. CVE-2026-91768
  CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7. CVE-2026-91766
  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
8. CVE-2026-92842
  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
9. CVE-2026-93682
  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
10. CVE-2026-6103
   CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
11. CVE-2026-91769
   CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
12. CVE-2025-1218
   CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

The two most severe CVEs can be triggered by an unauthenticated remote attacker who sends crafted HTTP requests to a PHP application. CVE-2026-109618 corrupts engine memory when request parsing fails on an out-of-memory condition. CVE-2026-109619 is a use-after-free: after a fatal error, a reused PHP-FPM worker can act on state left over from an earlier request. Both can potentially lead to remote code execution, but reliable exploitation needs precise heap manipulation and timing. CVE-2026-91765 lets an unauthenticated attacker crash the PHP process by posting a deeply nested request to a SOAP server endpoint. The remaining CVEs mostly affect PHP acting as a client: credential leakage or out-of-bounds reads when following HTTP redirects, weaknesses in TLS certificate verification, and crashes caused by malicious SOAP or MySQL servers. CVE-2026-91768 makes PHP-FPM’s listen.allowed_clients check match a whole IPv6 /96 prefix instead of the exact address. The glpi packages have been rebuilt to align with the updated PHP packages.

Affected Products

All NetEye 4.x versions.

IMPORTANT: If you applied the mitigation shared via email yesterday, it is now safe to remove it.

References

Thomas Forrer

Thomas Forrer

Team Leader Research & Development at Würth IT Italy
Hi folks! I began loving computer since 1994, it was still the time of windows 3.1. Immediately I learned starting DOS games from the command promt, and while typing some white text on black background I felt like some hackish dude in a hollywoodian movie. Later during the studies at the university, I discovered the magic world of opensource, and it was love at first sight. Finally I got rid of BSOD's =) I love everything that is connected to some network, especially in a security perspective. My motto is: "With motivation, nothing is impossibile. It only requires more time."

Author

Thomas Forrer

Hi folks! I began loving computer since 1994, it was still the time of windows 3.1. Immediately I learned starting DOS games from the command promt, and while typing some white text on black background I felt like some hackish dude in a hollywoodian movie. Later during the studies at the university, I discovered the magic world of opensource, and it was love at first sight. Finally I got rid of BSOD's =) I love everything that is connected to some network, especially in a security perspective. My motto is: "With motivation, nothing is impossibile. It only requires more time."

Latest posts by Thomas Forrer

13. 12. 2021 Bug Fixes, NetEye
NetEye 4 APM, Log and SIEM Module – Security Advisory
20. 09. 2021 CTF Writeups, SEC4U
RomHack CTF 2021: Table of Contents Writeup
02. 08. 2021 Downloads / Release Notes, NetEye, Unified Monitoring
NetEye 4.19 Release Notes
03. 06. 2021 Downloads / Release Notes, NetEye, Unified Monitoring
NetEye 4.18 Release Notes
01. 04. 2021 Downloads / Release Notes, NetEye, Unified Monitoring
NetEye 4.17 Release Notes
See All

Related Content

Tags: , , , ,

15. 10. 2026 Bug Fixes, NetEye

NetEye 4 – Security Advisory (GLPI)

Important: GLPI security update Type/Severity NetEye Product Security has rated this update as having a medium security impact. Topic An update for the glpi packages is now available for NetEye 4. Security Fix for NetEye 4.50 glpi-11.0.11_neteye1.25.5-1 glpi-autosetup-11.0.11_neteye1.25.5-1 glpi-configurator-11.0.11_neteye1.25.5-1 glpi-neteye-config-11.0.11_neteye1.25.5-1 Summary The list Read More
03. 10. 2026 Bug Fixes, NetEye

NetEye 4 – Security Advisory (GLPI)

Important: GLPI security update Type/Severity NetEye Product Security has rated this update as having a high security impact. Topic An update for the glpi packages is now available for NetEye 4. Security Fix for NetEye 4.50 glpi-11.0.11_neteye1.25.3-1 glpi-autosetup-11.0.11_neteye1.25.3-1 glpi-configurator-11.0.11_neteye1.25.3-1 glpi-neteye-config-11.0.11_neteye1.25.3-1 Summary This is Read More
30. 09. 2026 Asset Management, GLPI, Knowledge Management, Service Management

GLPI 12: A Practical Review of the Major Changes

New features, remaining gaps to the roadmap, and operating-system compatibility Starting in 2026, Teclib, the company behind GLPI, is moving from major releases every three to four years to a fixed annual release cycle, with a new major version planned Read More
28. 09. 2026 Asset Management, NetEye

How to Associate Custom Fields with New Itemtypes in GLPI (Fields Plugin)

When you create custom fields with the Fields plugin for GLPI, the container defines which itemtypes show the new tab. If you later need to add more itemtypes (for example Certificate or Domain), the web interface isn't enough: you have Read More
21. 09. 2026 Bug Fixes, NetEye

NetEye 4 – Security Advisory (GLPI)

Important: GLPI security update Type/Severity NetEye Product Security has rated this update as having a high security impact. Topic An update for the glpi packages is now available for NetEye 4. Security Fix for NetEye 4.49 glpi-11.0.9_neteye1.20.3-2 glpi-autosetup-11.0.9_neteye1.20.3-2 glpi-configurator-11.0.9_neteye1.20.3-2 Summary This is the Read More

Leave a Reply

Your email address will not be published. Required fields are marked *

Search by technology

Contact

Contact us
Serviceportal

Archive