Palo Alto Networks Security Advisories / CVE-2026-109618

CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products

Description

Palo Alto Networks is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619.

CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, allowing attackers to reliably achieve RCE using out-of-memory (OOM) triggers.

CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be read or branched on during subsequent requests, enabling attackers to execute arbitrary code.

Palo Alto Networks has conducted an evaluation of our product portfolio regarding this issue; a summary of the status across products is provided in the table below. We will update the below table when we get more information.

Product Status

Versions	Affected	Unaffected
Bridgecrew	None	All
Cloud NGFW	None	All
Cortex XDR Agent	None	All
Cortex XSIAM	None	All
Cortex XSOAR	None	All
Cortex Xpanse	None	All
GlobalProtect App	None	All
Idira	None	All
PAN-OS	12.2 All 12.1 All 11.2 All 11.1 All 10.2 All	12.2 None (ETA: TBD) 12.1 None (ETA: TBD) 11.2 None (ETA: TBD) 11.1 None (ETA: TBD) 10.2 None (ETA: TBD)
Panorama	All	None (ETA: TBD)
Prisma Cloud	None	All
Prisma Access	None	All
Prisma Access Agent	None	All

Required Configuration for Exposure

No special configuration is required to be affected by this issue.

Severity: HIGH, Suggested Urgency: MODERATE

The risk is highest on PAN-OS when you allow access to the management interface from external IP addresses on the internet. Based on our assessment the CVSS score of this issue in our product is
CVSS-B: 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber)

You can reduce the risk of exploitation by restricting access to a jump box that is the only system allowed to access the management interface.
CVSS-B: 7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber)

Vendor
CVSS-B: 9.2 (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)

Exploitation Status

Palo Alto Networks is not aware of any malicious exploitation of this issue against our products.

Weakness Type and Impact

CWE-754 Improper Check for Unusual or Exceptional Conditions

CAPEC-153 Input Data Manipulation

Solution

PAN-OS

This issue will be fixed in the upcoming releases of PAN-OS. This advisory will be updated with fixed versions and release estimates as they become available.

Until PAN-OS fix versions are available we recommend implementing the workaround and mitigations listed below.

See https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/ for more details on the Palo Alto Networks product capabilities to protect against attacks that exploit this issue.

Workarounds and Mitigations

Customers with Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 and later versions received advance coverage, released via Threat ID 543004, which was released at 10:21 PM PT on Oct 20.

Customers with a Threat Prevention subscription are provided with coverage against this vulnerability by enabling Threat ID 543004, 97622, 97623, 97624 and 97625 (from Applications and Threats content version 9162 and later). For these Threat IDs to protect against attacks for this vulnerability:

• Route incoming traffic for the MGT port through a DP port, e.g., enabling management profile on a DP interface for management access.

• Replace the Certificate for Inbound Traffic Management.

• Decrypt inbound traffic to the management interface so the firewall can inspect it.

• Enable threat prevention on the inbound traffic to management services.

The security risk posed by this issue on PAN-OS and Panorama is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines.

Frequently Asked Questions

Q. Is GlobalProtect™ impacted?

GlobalProtect™ portal and gateway are not impacted.

Q. Is Captive Portal impacted?

The captive portal is not impacted.

Q. Which part of the PAN-OS® product is affected?

This issue strictly affects the management web interface, which includes the HTTPS web UI and XML API service.

Q. Does it affect any standard dataplane interface, or specifically ones with a management profile attached?

It affects the dataplane interface only if a management profile is attached to it.

Q. When will PAN-OS fixes be available?

Patches will be made available as quickly as possible. Please monitor the security advisory for the latest information on mitigations and updates.

CPE Applicability

• • cpe:2.3:a:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)12.2_all
  • ORcpe:2.3:a:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)12.1_all
  • ORcpe:2.3:a:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.2_all
  • ORcpe:2.3:a:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.1_all
  • ORcpe:2.3:a:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)10.2_all
• or
  • cpe:2.3:a:palo_alto_networks:panorama:*:*:*:*:*:*:*:* is vulnerable from (including)all

Timeline