Act today Critical Known exploited Patch available CVSS up to 9.8
ABB gateway and NAM products hit by PHP flaws now listed as exploited
ABB PSIRTABBCVE-2026-109618, CVE-2026-109619
What happened. New: CISA now lists these PHP flaws as known exploited. ABB says an attacker could insert and run arbitrary code on affected products. The highest stated CVSS score is 9.8. Covers CVE-2026-109618 and CVE-2026-109619.
Who is affected. Users of ABB GW102, GWDD-02, GWDD-03, GWDC-06, GWDD-A03, GW502A and NAM, in the versions listed in the advisory.
What to do. Check whether you run the listed ABB GW and NAM versions, then apply the vendor patch from the ABB advisory.
When to act. Act today: on CISA's list of known exploited flaws
Editor's reading
Forasset ownerOT security lead
- Purdue level
- L3.5
- L3
Why: The report names gateway and network-manager products but not their exact placement, so L3 and L3.5 are a reading based on the gateway role.
- Are you exposed?
Search your asset inventory for ABB GW102, GWDD-02, GWDD-03, GWDC-06, GWDD-A03, GW502A and NAM and compare firmware to the listed versions.
- If you cannot fix it yet
- Block access to the web interfaces of the affected ABB devices from the enterprise network and internet.
- Restrict access to the devices to known management hosts through an OT firewall.
- Watch for
- Unexpected web requests or new files appearing on the affected ABB gateway and NAM devices.
- Unexpected outbound connections from these devices, which could mean injected code is running.
- ATT&CK for ICS
- T0866Exploitation of Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: ABB PSIRT (opens search.abb.com)
More on ABB CVE-2026-109618 CVE-2026-109619