Following the disclosure of two critical PHP vulnerabilities on October 21, 2026—CVE-2026-109618 and CVE-2026-109619—Sangfor has immediately initiated a comprehensive security evaluation across its entire product portfolio to assess potential exposure and safeguard customer environments.
Based on our thorough technical verification, Sangfor confirms that the following products and cloud-delivered services are unaffected by these vulnerabilities, and no action is required for these deployments:
- Sangfor Athena XDR
- Sangfor Athena MDR
- Sangfor Athena SASE
- Sangfor BBC
- Sangfor aTrust
- Sangfor HCI / aSV
- Sangfor SCP
- Sangfor SCC
- Sangfor EDS / aStor
For any Sangfor products not listed above, Sangfor has already completed the development of the corresponding security patches. Please contact your local Sangfor office team to obtain the latest patches and proceed with the update.
For further assistance, please contact your local Sangfor representative or reach out via the Sangfor Customer Support Portal.