What ClickShare devices are affected by PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619?

Affected products

The following ClickShare product families have been identified as affected by the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619:

• C-series
• CX-series
• Bar Core & Bar Pro
• CS(E)-series
• CSC-1 & CSM-1
• wePresent (WiPG) series

Mitigation recommendations

Exploitation of these vulnerabilities requires access to the affected web configurator. Applying the mitigation measures below can significantly reduce the potential attack surface until a software update addressing these vulnerabilities becomes available.

1. Restrict access to ClickShare Configurator

Ensure appropriate network security controls, such as firewalls and network segmentation, are in place to limit access to the ClickShare Configurator wherever possible.

2. Restrict direct access via the ClickShare Wi‑Fi network

• Change the default Wi-Fi password
• Where operationally feasible:
  • Disable the internal ClickShare Wi‑Fi when using Network Integration.
  • Limit access to the ClickShare Configurator from devices connected through the ClickShare Wi‑Fi network by unchecking the checkbox in front of ClickShare Configurator available via Wi-Fi option.

    For instructions, refer to the following product manuals:

    • C-series, CX-series, Bar Core & Bar Pro
    • CS(E)-series

Product status

ClickShare C-series, CX-series, Bar Core & Bar Pro

• A software hotfix (v2.27.01.0009) is now available through XMS Cloud and can also be downloaded from the Barco website, click here.

ClickShare CS(E)-series

• The CS(E)-series reached End of Software Support in December 2024. No software fix will be provided for these products.
• For more information, see KB5660.

ClickShare CSC-1 & CSM-1

• The CSC-1 and CSM-1 product ranges have reached their respective End of Support. No software fix will be provided for these products.
• For additional information, see the dedicated articles for CSC-1 (see KB3307) and CSM-1 (see KB3885).

wePresent (WiPG) series

• The wePresent (WiPG) product range has reached its End of Support. No software fix will be provided for these products.
• For additional information, see KB3186.

ClickShare Hub Core & Hub Pro

• Not impacted

XMS Cloud & XMS Edge

• Not impacted