Skip to main content

PowerManage 4.20.15 and 5.0.45

· 2 min read
Dmytro Dudnyk
Dmytro Dudnyk
L3 Technical Support | Team Lead
Vadym Haidamaka
Vadym Haidamaka
Senior DevOps Engineer | Team Lead
Vladyslav Yelchenko
Vladyslav Yelchenko
L3 Technical Support
Immediate action required

PowerManage 4.20.15 and 5.0.45 address two critical PHP remote code execution (RCE) vulnerabilities: CVE-2026-109618 and CVE-2026-109619.

These vulnerabilities may allow an unauthenticated attacker with network access to execute arbitrary code on an affected system. Upgrade to the applicable patched version as soon as possible. Until the upgrade is complete, treat affected systems as at risk.

PowerManage 4.20.15 and 5.0.45 (light) PowerManage 4.20.15 and 5.0.45 (dark)

Patched vulnerabilities​

  • [RCE] RCE via OOM corruption - CVE-2026-109618
  • [RCE] RCE via stale global state - CVE-2026-109619

Upgrade guidance​

Schedule maintenance windows at the earliest opportunity. Prioritize the upgrade because these vulnerabilities may allow an unauthenticated attacker with network access to execute arbitrary code on an affected system.

Officially allowed upgrade paths​

tip

If you are running a version not listed below, upgrade to the nearest supported base version first.

  1. PowerManage 4.18.23 -> 4.20.15
  2. PowerManage 4.20.14 -> 4.20.15
  3. PowerManage 4.20.14 -> 5.0.45
  4. PowerManage 5.0.44 -> 5.0.45
info

Both incremental upgrade and backup/restore procedures have been tested and verified for these paths.

Clean installation of PowerManage 4.20.15/5.0.45 is also supported.