Critical Remote Code Execution Vulnerabilities in Belden macmon and NRSW (CVE‑2026‑109618/109619)

What happened

On 22 October 2026, Belden’s PSIRT released a bulletin detailing two critical PHP vulnerabilities affecting its macmon and NRSW products. The flaws enable an unauthenticated attacker to execute arbitrary code on the host via crafted HTTP requests. The CVEs assigned are CVE‑2026‑109618 and CVE‑2026‑109619.

Both vulnerabilities stem from insufficient input validation in the web interfaces of macmon and NRSW. Attackers can exploit them without needing valid credentials, making the risk immediate and severe for any exposed installations.

Who is affected

macmon users running version 6.x or 7.x that have not applied the latest security patch are vulnerable. Belden recommends upgrading to macmon 7.x before applying the patch; the patch is only compatible with 7.x releases.

NRSW installations with a version number lower than 5.0.0.104 are also at risk. The vulnerability is present in all earlier releases and is not mitigated by later minor updates.

Impact

Successful exploitation results in full remote code execution with the privileges of the web server process. An attacker can install backdoors, exfiltrate data, or pivot to other network assets.

Because the flaws are in the web layer, the attack surface is the publicly reachable or internally exposed management interfaces. In environments where these interfaces are isolated, the risk is reduced but not eliminated.

Exposure

Exploitation requires only an HTTP request to the vulnerable endpoint. No authentication or additional privileges are needed, which means that any network segment that can reach the interface is a potential attack vector.

In many deployments, macmon and NRSW are used as part of industrial control or network monitoring stacks. A compromise could therefore provide an attacker with a foothold into critical infrastructure.

What to do

Immediate actions for defenders:

• Verify the version of macmon and NRSW on all managed devices.
• For macmon 6.x users, upgrade to the latest 7.x release before applying the patch.
• Apply the Belden security patch for macmon 7.x and NRSW 5.0.0.104 or newer.
• Block inbound traffic to the management interfaces from untrusted networks until the patch is applied.
• Monitor logs for anomalous PHP execution or unexpected file modifications on the affected servers.

After patching, perform a post‑deployment scan to confirm that the vulnerabilities are no longer present and that no backdoors remain.

What to watch

Keep an eye on the Belden PSIRT channel for any follow‑up advisories or additional mitigations. Verify that the patch does not introduce regressions in your environment.

Monitor threat intelligence feeds for indicators of compromise related to these CVEs, such as new exploit code or active scanning campaigns targeting macmon and NRSW interfaces.