PHP Vulnerability Responses by Company

Extreme Networks

Global cloud / infrastructure
Aliases / services
Extreme Networks / Extreme Networks Inc. / ExtremeControl / HiveOS / WiNG / extremenetworks.com
Official website
https://www.extremenetworks.com/

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

ExtremeControl for Site Engine

Response status
Affected; field patch available
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Enterprise networking hardware and management services.

The October 26 SA-2026-194/195 updates mark ExtremeControl affected and link a PHP 8.1 field patch. The fixed 26.11.10 release is planned for November; availability of instructions does not mean customer installations are patched.

Scope: The field patch targets ExtremeControl 24.10+ on Ubuntu 22.04 LTS. XIQ-SE itself and IQ Engine/WiNG have different assessments.

What users should do

Follow KB 000139710 after VM snapshots, applying and restarting every Control Engine. The procedure was tested only on 26.08.12.09; consult GTAC for other environments or issues.

Official service URL

Source URLs

  1. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685Response evidence
  2. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686Response evidence
  3. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139710https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139710Response evidence
  4. https://community.extremenetworks.com/t5/security-advisories-formerly/bg-p/Security_Advisorieshttps://community.extremenetworks.com/t5/security-advisories-formerly/bg-p/Security_AdvisoriesService and operation documentation

ExtremeAnalytics for Site Engine

Response status
Unaffected
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

ExtremeAnalytics for Site Engine is explicitly marked unaffected by both CVEs in the October 26 SA-2026-194/195 updates.

Scope: Limited to this product in the official impact table. Unlisted and end-of-maintenance products are not evaluated, not assumed unaffected.

What users should do

No PHP2Shell fix is required for this product; assess other deployed products separately.

Source URLs

  1. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685Response evidence
  2. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686Response evidence

ExtremeCloud IQ (XIQ)

Response status
Unaffected
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

ExtremeCloud IQ (XIQ) is explicitly marked unaffected by both CVEs in the October 26 SA-2026-194/195 updates.

Scope: Limited to this product in the official impact table. Unlisted and end-of-maintenance products are not evaluated, not assumed unaffected.

What users should do

No PHP2Shell fix is required for this product; assess other deployed products separately.

Source URLs

  1. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685Response evidence
  2. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686Response evidence

ExtremeCloud IQ - Site Engine (XIQ-SE)

Response status
Unaffected
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

ExtremeCloud IQ - Site Engine (XIQ-SE) is explicitly marked unaffected by both CVEs in the October 26 SA-2026-194/195 updates.

Scope: Limited to this product in the official impact table. Unlisted and end-of-maintenance products are not evaluated, not assumed unaffected.

What users should do

No PHP2Shell fix is required for this product; assess other deployed products separately.

Source URLs

  1. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685Response evidence
  2. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686Response evidence

ExtremeCloud Orchestrator (XCO/EFA)

Response status
Unaffected
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

ExtremeCloud Orchestrator (XCO/EFA) is explicitly marked unaffected by both CVEs in the October 26 SA-2026-194/195 updates.

Scope: Limited to this product in the official impact table. Unlisted and end-of-maintenance products are not evaluated, not assumed unaffected.

What users should do

No PHP2Shell fix is required for this product; assess other deployed products separately.

Source URLs

  1. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685Response evidence
  2. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686Response evidence

Extreme Platform ONE

Response status
Unaffected
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Extreme Platform ONE is explicitly marked unaffected by both CVEs in the October 26 SA-2026-194/195 updates.

Scope: Limited to this product in the official impact table. Unlisted and end-of-maintenance products are not evaluated, not assumed unaffected.

What users should do

No PHP2Shell fix is required for this product; assess other deployed products separately.

Source URLs

  1. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685Response evidence
  2. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686Response evidence

Extreme AirDefense

Response status
Unaffected
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Extreme AirDefense is explicitly marked unaffected by both CVEs in the October 26 SA-2026-194/195 updates.

Scope: Limited to this product in the official impact table. Unlisted and end-of-maintenance products are not evaluated, not assumed unaffected.

What users should do

No PHP2Shell fix is required for this product; assess other deployed products separately.

Source URLs

  1. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685Response evidence
  2. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686Response evidence

ExtremeCloud A3

Response status
Unaffected
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

ExtremeCloud A3 is explicitly marked unaffected by both CVEs in the October 26 SA-2026-194/195 updates.

Scope: Limited to this product in the official impact table. Unlisted and end-of-maintenance products are not evaluated, not assumed unaffected.

What users should do

No PHP2Shell fix is required for this product; assess other deployed products separately.

Source URLs

  1. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685Response evidence
  2. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686Response evidence

ExtremeCloud Universal ZTNA

Response status
Unaffected
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

ExtremeCloud Universal ZTNA is explicitly marked unaffected by both CVEs in the October 26 SA-2026-194/195 updates.

Scope: Limited to this product in the official impact table. Unlisted and end-of-maintenance products are not evaluated, not assumed unaffected.

What users should do

No PHP2Shell fix is required for this product; assess other deployed products separately.

Source URLs

  1. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685Response evidence
  2. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686Response evidence

ExtremeCloud SD-WAN Appliance

Response status
Unaffected
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

ExtremeCloud SD-WAN Appliance is explicitly marked unaffected by both CVEs in the October 26 SA-2026-194/195 updates.

Scope: Limited to this product in the official impact table. Unlisted and end-of-maintenance products are not evaluated, not assumed unaffected.

What users should do

No PHP2Shell fix is required for this product; assess other deployed products separately.

Source URLs

  1. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685Response evidence
  2. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686Response evidence

ExtremeCloud SD-WAN Orchestrator

Response status
Unaffected
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

ExtremeCloud SD-WAN Orchestrator is explicitly marked unaffected by both CVEs in the October 26 SA-2026-194/195 updates.

Scope: Limited to this product in the official impact table. Unlisted and end-of-maintenance products are not evaluated, not assumed unaffected.

What users should do

No PHP2Shell fix is required for this product; assess other deployed products separately.

Source URLs

  1. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685Response evidence
  2. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686Response evidence

Extreme OS ONE

Response status
Unaffected
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Extreme OS ONE is explicitly marked unaffected by both CVEs in the October 26 SA-2026-194/195 updates.

Scope: Limited to this product in the official impact table. Unlisted and end-of-maintenance products are not evaluated, not assumed unaffected.

What users should do

No PHP2Shell fix is required for this product; assess other deployed products separately.

Source URLs

  1. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685Response evidence
  2. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686Response evidence

Fabric Engine (VOSS)

Response status
Unaffected
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Fabric Engine (VOSS) is explicitly marked unaffected by both CVEs in the October 26 SA-2026-194/195 updates.

Scope: Limited to this product in the official impact table. Unlisted and end-of-maintenance products are not evaluated, not assumed unaffected.

What users should do

No PHP2Shell fix is required for this product; assess other deployed products separately.

Source URLs

  1. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685Response evidence
  2. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686Response evidence

SLX-OS

Response status
Unaffected
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

SLX-OS is explicitly marked unaffected by both CVEs in the October 26 SA-2026-194/195 updates.

Scope: Limited to this product in the official impact table. Unlisted and end-of-maintenance products are not evaluated, not assumed unaffected.

What users should do

No PHP2Shell fix is required for this product; assess other deployed products separately.

Source URLs

  1. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685Response evidence
  2. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686Response evidence

Switch Engine (EXOS)

Response status
Unaffected
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Switch Engine (EXOS) is explicitly marked unaffected by both CVEs in the October 26 SA-2026-194/195 updates.

Scope: Limited to this product in the official impact table. Unlisted and end-of-maintenance products are not evaluated, not assumed unaffected.

What users should do

No PHP2Shell fix is required for this product; assess other deployed products separately.

Source URLs

  1. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685Response evidence
  2. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686Response evidence

CampusWirelessAP

Response status
Unaffected
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

CampusWirelessAP is explicitly marked unaffected by both CVEs in the October 26 SA-2026-194/195 updates.

Scope: Limited to this product in the official impact table. Unlisted and end-of-maintenance products are not evaluated, not assumed unaffected.

What users should do

No PHP2Shell fix is required for this product; assess other deployed products separately.

Source URLs

  1. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685Response evidence
  2. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686Response evidence

ExtremeCloud IQ Controller (IQC/XCC)

Response status
Unaffected
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

ExtremeCloud IQ Controller (IQC/XCC) is explicitly marked unaffected by both CVEs in the October 26 SA-2026-194/195 updates.

Scope: Limited to this product in the official impact table. Unlisted and end-of-maintenance products are not evaluated, not assumed unaffected.

What users should do

No PHP2Shell fix is required for this product; assess other deployed products separately.

Source URLs

  1. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685Response evidence
  2. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686Response evidence

IQ Engine (HiveOS)

Response status
Impact under investigation
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

IQ Engine (HiveOS) remains under investigation in the current SA-2026-194/195 impact tables. Neither an unaffected determination nor patch completion is announced.

Scope: This product's assessment is separate from ExtremeControl and XIQ-SE.

What users should do

Follow PSIRT updates and GTAC guidance. Do not apply the ExtremeControl-specific field patch to this product.

Source URLs

  1. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685Response evidence
  2. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686Response evidence

WiNG

Response status
Impact under investigation
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

WiNG remains under investigation in the current SA-2026-194/195 impact tables. Neither an unaffected determination nor patch completion is announced.

Scope: This product's assessment is separate from ExtremeControl and XIQ-SE.

What users should do

Follow PSIRT updates and GTAC guidance. Do not apply the ExtremeControl-specific field patch to this product.

Source URLs

  1. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139685Response evidence
  2. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139686Response evidence
Related official sources
  1. PHP2Shell response and scopeOfficial notice
  2. CVE-2026-109619 product scopeOfficial notice

Comments