Security Notice: PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619
Notice Published: October 22, 2026
Notice Version: 1.0
AvePoint is aware of recently disclosed vulnerabilities affecting PHP, identified as CVE-2026-109618 and CVE-2026-109619.
Are AvePoint services or customer data affected?
No. Based on our current assessment, AvePoint SaaS services and customer data are not affected by these vulnerabilities. Our primary corporate website, www.avepoint.com, also remains available and is operating normally.
The identified vulnerabilities affect PHP components used by a limited number of AvePoint legacy websites. These sites are informational in nature, are hosted separately from the AvePoint SaaS environment, and do not store or process customer data.
We are actively reviewing our supply chain to confirm whether any of our suppliers are impacted by the identified vulnerability.
Precautionary measures
As a precautionary security measure, AvePoint temporarily took the affected websites offline while our Security team applies the appropriate updates and completes validation activities.
This action was taken proactively to reduce potential exposure while remediation is underway. At this time, we have no indication that AvePoint SaaS services or customer data have been impacted in connection with these vulnerabilities.
Do customers need to take any action?
No action is required in connection with your AvePoint SaaS services.
Organizations that operate PHP within their own environments should review their PHP deployments and work with their IT or Security teams to ensure that applicable security updates and mitigations have been implemented.
AvePoint continues to monitor the situation and will take additional measures as appropriate. If you have questions regarding your AvePoint services, please contact your AvePoint representative or Support team.