Fresenius says Fresenius Kabi infusion, transfusion and compounding products are not affected by PHP2Shell

MedDevice Cyber Staff · 5 days ago · 2 min read · Via Fresenius PHP2Shell advisory

Fresenius published its PHP2Shell advisory on October 26, 2026. It covers CVE-2026-109618 and CVE-2026-109619 (EUVD-2026-107260 and EUVD-2026-107265), two PHP flaws with an overall CVSSv4.0 score of 9.2, rated critical. Both can lead to remote code execution in products that use affected PHP versions to serve web interfaces, applications or network services.

Fresenius Kabi products in three groups are listed as assessed and not affected in all versions. Infusion and nutrition systems include Agilia, Exelia, INfusia, Amika, Conox, the Ivenix IMS and LVP software and the Vigilant Software Suite. Transfusion and cell therapy systems include Amicus, Aurora, Cue and Lovo, and the compounding group holds KabiHelp Pro and KabiHelp Assist Pro. The rationale is a single line: the products do not rely on PHP.

A component-absent rationale is the strongest answer a manufacturer can give, provided the SBOM behind it is current. Any PHP running on hospital servers near these fleets still needs its own patch cycle.

Are you a representative of Fresenius Kabi? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Fresenius says no Fresenius Kabi product on its PHP2Shell list relies on PHP, so no device update is needed for CVE-2026-109618 or CVE-2026-109619. Patch PHP on any surrounding hospital servers separately. Fresenius recommends keeping its devices behind firewalls in dedicated medical networks.

File the assessment. Attach the October 26, 2026 Fresenius PHP2Shell advisory to the asset records for the listed Fresenius Kabi products.
Patch adjacent PHP. Find and update PHP on servers and portals that share the network with these devices.
Keep devices segmented. Place Fresenius devices behind firewalls in a dedicated medical network, as Fresenius recommends.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure.

Required

Web interface

Contributing

Off-the-shelf software

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Are Fresenius Kabi infusion pumps affected by PHP2Shell CVE-2026-109618 and CVE-2026-109619?

No. Fresenius's PHP2Shell advisory of October 26, 2026 lists Fresenius Kabi infusion and nutrition systems, including Agilia, Exelia, INfusia, Amika, Conox and the Ivenix software, as not affected in all versions because they do not rely on PHP.

Why does Fresenius say its products are safe from PHP2Shell?

Fresenius states the assessed Fresenius Kabi products do not rely on PHP, so none of the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, can be exploited on them. The advisory was published October 26, 2026.

← Back to Vulnerabilities