ABB MES DokuWiki Installations Require Critical PHP Updates
Tech GuruQuick Answer
ABB advisory 4hzk000017 covers CVE-2026-109618 and CVE-2026-109619 in MES installations supplied with DokuWiki. Identify the server PHP branch, install its fixed release through the operating system, validate DokuWiki help access, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory ABB MES environments supplied with DokuWiki, server operating systems, installed PHP packages and branches, network paths, owners, backups, and maintenance windows. Establish the installed PHP release on each DokuWiki server. ABB says applicability depends on the DokuWiki delivery and PHP build, not a named MES version; do not infer scope from MES presence alone. Update only the supported PHP packages on the DokuWiki server operating system to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12 as appropriate. If an immediate update is impossible, ABB's workaround is to shut down the DokuWiki servers temporarily. Confirm the loaded PHP version, restart affected services where required, test MES help and DokuWiki workflows, verify segmentation and access controls, monitor failures, and retain package and change evidence.
Last verified: 2026-10-24 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | ABB Manufacturing Execution System installations supplied with DokuWiki |
|---|---|
| Advisory | 4hzk000017 |
| CVEs | CVE-2026-109618, CVE-2026-109619 |
| Authoritative release date | 2026-10-23 00:30:00 UTC |
| Authority revision date | 2026-10-23 00:30:00 UTC |
| Affected versions | ABB MES installations with DokuWiki when the server operating system provides an affected PHP release; ABB does not tie the exposure to a particular MES release. |
| Fixed version | PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12, selected through the supported operating-system channel |
| CVSS base score | 9.8 (CVSS v3.1) |
| CVSS severity | Critical |
| Exploitation status | ABB states that it had received no reports of exploitation when the advisory was issued.; no exploitation claim is inferred. |
What Changed
ABB confirmed that MES DokuWiki servers using affected PHP builds can permit unauthenticated remote code execution when an attacker has network access to the system node.
What To Validate Now
- Inventory. Inventory ABB MES environments supplied with DokuWiki, server operating systems, installed PHP packages and branches, network paths, owners, backups, and maintenance windows.
- Establish applicability. Establish the installed PHP release on each DokuWiki server. ABB says applicability depends on the DokuWiki delivery and PHP build, not a named MES version; do not infer scope from MES presence alone.
- Remediate. Update only the supported PHP packages on the DokuWiki server operating system to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12 as appropriate. If an immediate update is impossible, ABB's workaround is to shut down the DokuWiki servers temporarily.
- Validate. Confirm the loaded PHP version, restart affected services where required, test MES help and DokuWiki workflows, verify segmentation and access controls, monitor failures, and retain package and change evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Do not replace the whole DokuWiki installation merely to address this advisory; ABB directs customers to update the operating-system PHP packages. Coordinate downtime and recovery for production MES dependencies.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
