Raritan continues to strengthen its commitment to product security, reliability and performance with several important updates announced in October and November 2026. These include confirmation that Raritan products are unaffected by the recently identified PHP2Shell vulnerabilities, alongside new firmware releases for Raritan KVM and rack power distribution products.
In this article, we explore the latest announcements and highlight what they mean for customers managing their IT infrastructure and data centre environments.
1. Raritan & Server Technology Products Unaffected by PHP2Shell Vulnerabilities
Cybersecurity remains a key priority for organisations managing critical IT infrastructure. Following the discovery of two critical PHP vulnerabilities in October 2026, known collectively as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), Legrand has completed an assessment of its affected product portfolio.
The assessment confirmed that Raritan and Server Technology products are not affected by these vulnerabilities because they do not use PHP.
The assessment specifically covered:
- All Raritan KVM and Serial products and accessories.
- All Raritan rack power distribution and rack management products.
- All Server Technology rack power distribution products.
- Legrand sensors, door locks and other accessories.
- All Legrand Open Compute Power System products.
Consequently, no customer action is required in response to these particular PHP vulnerabilities.
Furthermore, Legrand continues to monitor emerging cybersecurity developments as part of its ongoing product security processes. Should any relevant information arise, further updates will be communicated accordingly.
2. Dominion KX IV-101 Firmware 4.6.1 Now Available
Raritan has also announced the general availability of firmware version 4.6.1 for its Dominion KX IV-101 KVM-over-IP switch.
This release introduces several enhancements designed to improve device management, security and configuration flexibility. In addition, it includes important security fixes and support for additional technologies.
Key release highlights include:
- JSON-API Support: Expanded integration and configuration capabilities.
- Bulk Configuration: Simplified management across multiple devices.
- Custom EDID Generator: Greater flexibility when configuring display settings.
- Task Scheduler: Improved automation and scheduling capabilities.
- FIPS 140-3 Support: Enhanced cryptographic security compliance.
- IPv6 Certification Support: Improved support for modern network environments.
- Nested Active Directory Groups: Greater flexibility when managing user permissions.
- Security Improvements: Additional fixes addressing several critical CVEs, including CVE-2026-43501, CVE-2026-46037 and CVE-2026-53275.
Important firmware upgrade information
Before installing the latest release, customers should check their existing firmware version to ensure they follow the correct upgrade sequence.
- Currently running version 4.5: Upgrade directly to 4.6, followed by 4.6.1.
- Currently running version 4.4 or earlier: Upgrade to 4.5 first, then 4.6, followed by 4.6.1.
Version 4.5 is a mandatory intermediate release (fence release) for customers upgrading to version 4.6.
Customers can visit Raritan’s official support resources to access the firmware download and installation guidance.
3. Raritan Rack Power Distribution Firmware 4.3.15 Released
Alongside the KVM update, Raritan has released Xerus firmware version 4.3.15, a general availability update for its rack power distribution and associated management products.
This release focuses primarily on cybersecurity improvements, addressing several Linux kernel vulnerabilities and potential weaknesses across various services.
Applicable products include:
- PX4 Rack PDUs.
- PX2, PX3, PXC and PXO Rack PDUs.
- PX4 Inline Meters.
- PX3 Inline Meters.
- PX3TS Rack Transfer Switches.
- BCM2 Branch Circuit Monitors.
- SRC Smart Rack Controllers.
Key security improvements
The latest firmware introduces several important security enhancements, including:
- An upgraded Linux kernel to address multiple Linux kernel vulnerabilities.
- Resolution of potential out-of-bound Element ID reads (CVE-2026-68402).
- Improved ACK validation (CVE-2026-68118).
- Fixes addressing potential causes of Linux kernel panics (CVE-2026-68136).
- Protection against crafted packets that could prematurely terminate active connections (CVE-2026-63913).
- Improvements to IPv6 packet handling (CVE-2026-64554).
- Fixes for vulnerabilities across various services that could potentially allow administrator users to execute root shell commands.
These improvements help strengthen the security and stability of Raritan rack power distribution infrastructure.
Customers operating compatible devices should review the release information and follow Raritan’s recommended firmware installation guidance.
Keeping Your Raritan Infrastructure Secure and Up to Date
These latest announcements demonstrate Raritan’s continued focus on cybersecurity, product reliability and ongoing product development.
From confirming that its products are unaffected by PHP2Shell to introducing new KVM functionality and addressing vulnerabilities across its rack power distribution portfolio, these updates provide valuable information for organisations maintaining critical IT infrastructure.
However, keeping devices up to date is only one part of maintaining a secure and reliable environment. Organisations should also regularly review their firmware versions, follow manufacturer guidance and ensure that their infrastructure is maintained in line with recommended security practices.
Need assistance with Raritan products or firmware updates?
As a UK distributor of Raritan solutions, Mediatron provides specialist support and product expertise to help customers and channel partners select, deploy and maintain their IT infrastructure.
Contact our team to discuss your Raritan requirements or explore our range of KVM, rack power distribution and data centre management solutions.
Visit KVM Choice or call 0345 899 5010 to speak with our team.