Three critical vulnerabilities were reported in October 2026, and many of you have asked how they affect the Rocket Software Host Connectivity products. The status differs for each vulnerability, so please review the details below and follow the linked articles for your products.
1. PHP Vulnerabilities: CVE-2026-109618 and CVE-2026-109619
Severity: 9.2 (both CVEs)
For impact details and guidance, see:
2. Certificate Validation Flaw in OpenJDK and Oracle Java: CVE-2026-91403
Severity: 9.1
Articles for the impacted Host Connectivity products, including manual "cacerts" mitigation steps:
- https://my.rocketsoftware.com/RocketCommunity/s/article/CVE-2026-91403-Manual-cacerts-mitigation-for-Rocket-Secure-Host-Access-25-1-6
- https://my.rocketsoftware.com/RocketCommunity/s/article/CVE-2026-91403-Manual-cacerts-mitigation-for-Host-Access-for-the-Cloud-MSS-Reflection-for-the-Web-RWeb-and-Secure-Host-Access-25-1-5-or-earlier
- CVE-2026-91403 - Manual "cacerts" mitigation for the Reflection for the Web (RWeb) Launcher
- https://my.rocketsoftware.com/RocketCommunity/s/article/CVE-2026-91403-Manual-mitigation-for-Reflection-X-Advantage
Products not impacted: Extra!, HostExplorer, InfoConnect Desktop, OnWeb Web-To-Host, PASSPORT, Reflection Desktop, Reflection for Secure IT PKID Services Manager, Reflection for Secure IT for Unix, Reflection for Secure IT for Windows, Rocket Terminal Emulator (Desktop Edition) (formerly BlueZone), Rumba, and WebConnect.
3. Node2Shell Vulnerability: CVE-2026-111497
Severity: 9.2
For impact details and guidance, see:
If you have questions about how these vulnerabilities affect your environment, please reply to this post or contact Rocket Software Support.
