This page records Innomate’s assessment of significant publicly disclosed vulnerabilities and whether they affect the Innomesh platform. It is intended for security and risk teams assessing their exposure through Innomesh. The newest advisories are listed first.
To request a formal statement for your organisation, contact your Innomate account manager.
Summary
| Advisory | Component | Innomesh status | Customer action |
|---|---|---|---|
| CVE-2026-98432 | Linux kernel | Not exploitable | None |
| CVE-2026-109618, CVE-2026-109619 | PHP | Not affected | None |
CVE-2026-98432 (Linux kernel)
Status: Not exploitable in the Innomesh platform. Updates are being applied as part of routine maintenance.
Last reviewed: 6 November 2026
To exploit this vulnerability, an attacker must open a direct network connection to an affected server. No Innomesh server accepts such a connection.
- Room control servers accept no inbound connections. They only make outbound connections to the devices in each room, so an attacker has no path to reach them.
- Cloud services (Innomesh Portal, the Platform API, and data services) accept connections only through managed cloud provider services: load balancing, content delivery, and a web application firewall. These services handle every inbound connection before it reaches an Innomesh server, and the cloud provider has confirmed they are not exposed to this vulnerability.
Although no Innomesh service can be exploited through this vulnerability, Innomate is applying the relevant updates across the platform as part of its regular patching and maintenance.
No customer action is required.
CVE-2026-109618 and CVE-2026-109619 (PHP)
Status: Not affected.
Last reviewed: 22 October 2026
These critical vulnerabilities affect applications built with the PHP programming language, from PHP 5 onwards. The Innomesh platform does not use PHP, so no Innomesh service is exposed.
Innomate’s other services that use PHP sit outside the Innomesh platform and hold no customer data. They were updated on 22 October 2026, the day the vulnerabilities were disclosed.
No customer action is required.