> ## Documentation Index
> Fetch the complete documentation index at: https://support.i.moneyforward.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Response status for disclosed vulnerabilities

> Learn whether Admina is affected by disclosed vulnerabilities (CVEs) and how we respond to them.

This page lists our investigation results for disclosed vulnerabilities that customers frequently ask about.

To check whether Admina is affected, use the "Checklist" table for each vulnerability.

> [!NOTE]
>
> This page covers the Admina service that Money Forward i develops and operates. For external services that Admina uses and for services that Admina integrates with, see [Scope of impact](#php-2026-10-scope).

## Listed vulnerabilities

| Disclosed | Target | CVE | Impact on Admina | Response |
| - | - | - | - | - |
| 2026-10-21 | [PHP](#php-2026-10) | CVE-2026-109618, CVE-2026-109619 | None | Not required |

## PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)

**Checked**: 2026-10-21

The Admina service does not use PHP, so these vulnerabilities do not affect it.

| Checklist | Answer |
| - | - |
| Do you use PHP? | No |
| PHP version | Not applicable |
| Impact of the vulnerabilities | None |
| Response plan | Not required |
| Start date and time of the fix | Not applicable |
| Expected completion date and time of the fix | Not applicable |

### What we checked

We checked the Admina source code and the monitoring data of the production environment. We found no PHP programs, runtimes, or libraries.

### Scope of impact

| Target | Status |
| - | - |
| The Admina service (IT Management and AI Helpdesk) | Not affected because it does not use PHP |
| External services that Admina uses (support chat, Help Center, and others) | Each provider manages its own service. We have not received any reports from the providers about the impact of this issue |
| Services that Admina integrates with | Check with the provider of each service. If you run your own servers, such as [WordPress (self-hosted)](/en/integrations/l8rsks1rlt-wordpress-selfhost-api), check the impact on your side |

## FAQ

> **Do I need to take action in Admina if an integrated service is affected?**
>
> Admina operates integrated services through their APIs and other means. PHP does not run inside Admina, so Admina itself is not affected.
>
> However, if attackers exploit the vulnerability in the integrated service, the credentials used for the integration may be exposed. These include API keys and the ID and password of the integration account. Take action if the provider reports an impact, or if you find unauthorized access on a server that you run. Reissue the API key or change the password in the integrated service, then [re-link](/en/it-management/saas-management/93nahw45is-trouble#re-linking) the integration in Admina. Disable the old API key in the integrated service.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.