CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products
Description
Palo Alto Networks is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619.
CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, allowing attackers to reliably achieve RCE using out-of-memory (OOM) triggers.
CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be read or branched on during subsequent requests, enabling attackers to execute arbitrary code.
Palo Alto Networks has conducted an evaluation of our product portfolio regarding this issue; a summary of the status across products is provided in the table below. We will update the below table when we get more information.
Product Status
| Versions | Affected | Unaffected |
|---|---|---|
| Bridgecrew | None | All |
| Cloud NGFW | None | All |
| Cortex Cloud | None | All |
| Cortex XCORE (SaaS) | None * | All * |
| Cortex XDR Agent | None | All |
| Cortex XDR Broker VM | None | All |
| Cortex XSIAM | None | All |
| Cortex XSOAR | None | All |
| Cortex Xpanse | None | All |
| GlobalProtect App | None | All |
| Idira | None | All |
| Koi | None | All |
| Next Generation Trust Security | None | All |
| PAN-OS 12.2 | < 12.2.4-h1 | >= 12.2.4-h1 |
| PAN-OS 12.1 | < 12.1.4-h13 < 12.1.7-h11 < 12.1.10-h3 | >= 12.1.4-h13 >= 12.1.7-h11 >= 12.1.10-h3 |
| PAN-OS 11.2 | < 11.2.4-h23 < 11.2.7-h23 < 11.2.10-h16 < 11.2.13-h4 < 11.2.16-h1 | >= 11.2.4-h23 >= 11.2.7-h23 >= 11.2.10-h16 >= 11.2.13-h4 >= 11.2.16-h1 |
| PAN-OS 11.1 | < 11.1.4-h38 < 11.1.6-h40 < 11.1.7-h12 < 11.1.10-h36 < 11.1.13-h16 < 11.1.16-h4 | >= 11.1.4-h38 >= 11.1.6-h40 >= 11.1.7-h12 >= 11.1.10-h36 >= 11.1.13-h16 >= 11.1.16-h4 |
| PAN-OS 10.2 | < 10.2.7-h39 < 10.2.10-h42 < 10.2.13-h27 < 10.2.16-h12 < 10.2.18-h13 | >= 10.2.7-h39 >= 10.2.10-h42 >= 10.2.13-h27 >= 10.2.16-h12 >= 10.2.18-h13 |
| Prisma Access Agent | None | All |
| Prisma AIRS AI Gateway | None | All |
| Prisma Cloud | None | All |
| Prisma Access | None | All |
| Prisma SD-WAN Controller | None | All |
| Prisma SD-WAN ION | None | All |
| Prisma SD-WAN On-Prem Controller | None | All |
| Strata Cloud Manager | None | All |
| Trust Protection Foundation | None | All |
| WildFire Appliance WF-500 and WF-500-B | None | All |
| WildFire Cloud | None ** | All ** |
* Although Cortex XCORE (SaaS) was previously impacted, a remediation patch was deployed on October 21, 2026.
** Although WildFire Cloud was previously impacted, a remediation patch was deployed on October 22, 2026.
Note: This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
Required Configuration for Exposure
No special configuration is required to be affected by this issue.
Severity: CRITICAL, Suggested Urgency: HIGHEST
The risk is highest on PAN-OS when you allow access to the management interface from external IP addresses on the internet. Based on our assessment the CVSS score of this issue in our product is
CRITICAL
- CVSS-BT: 9.2 /CVSS-B: 9.2 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:D/RE:M/U:Red)
You can reduce the risk of exploitation by restricting access to a jump box that is the only system allowed to access the management interface.
MEDIUM
- CVSS-BT: 5.2 /CVSS-B: 7.7 (CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber)
Vendor
CRITICAL
- CVSS-BT: 9.2 /CVSS-B: 9.2 (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red)
Exploitation Status
Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet.
Weakness Type and Impact
CWE-754 Improper Check for Unusual or Exceptional Conditions
CAPEC-153 Input Data Manipulation
Solution
PAN-OS
This issue will be fixed in the upcoming releases of PAN-OS. This advisory will be updated with fixed versions and release estimates as they become available.
Until PAN-OS fix versions are available we recommend implementing the workaround and mitigations listed below.
See https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/ for more details on the Palo Alto Networks product capabilities to protect against attacks that exploit this issue.
| Version | Minor Version | Suggested Solution |
|---|---|---|
| PAN-OS 12.2 |
12.2.0 through 12.2.4-h* | Upgrade to 12.2.4-h1 or later. |
| PAN-OS 12.1 |
12.1.8 through 12.1.10-h* | Upgrade to 12.1.10-h3 or later. |
| 12.1.5 through 12.1.7-h* | Upgrade to 12.1.7-h11 or 12.1.10-h3 or later. | |
| 12.1.2 through 12.1.4-h* | Upgrade to 12.1.4-h13 or 12.1.10-h3 or later. | |
| PAN-OS 11.2 |
11.2.14 through 11.2.16-h* |
Upgrade to 11.2.16-h1 or later. |
| 11.2.11 through 11.2.13-h* | Upgrade to 11.2.13-h4 or 11.2.16-h1 or later. | |
| 11.2.8 through 11.2.10-h* | Upgrade to 11.2.10-h16 or 11.2.16-h1 or later. | |
| 11.2.5 through 11.2.7-h* | Upgrade to 11.2.7-h23 or 11.2.16-h1 or later. | |
| 11.2.0 through 11.2.4-h* | Upgrade to 11.2.4-h23 or 11.2.16-h1 or later. | |
| PAN-OS 11.1 |
11.1.14 through 11.1.16-h* |
Upgrade to 11.1.16-h4 or later. |
| 11.1.11 through 11.1.13-h* | Upgrade to 11.1.13-h16 or 11.1.16-h4 or later. | |
| 11.1.8 through 11.1.10-h* | Upgrade to 11.1.10-h36 or 11.1.16-h4 or later. | |
| 11.1.7 through 11.1.7-h* | Upgrade to 11.1.7-h12 or 11.1.16-h4 or later. | |
| 11.1.5 through 11.1.6-h* | Upgrade to 11.1.6-h40 or 11.1.16-h4 or later. | |
| 11.1.0 through 11.1.4-h* | Upgrade to 11.1.4-h38 or 11.1.16-h4 or later. | |
| PAN-OS 10.2 |
10.2.17 through 10.2.18-h* |
Upgrade to 10.2.18-h13 or later. |
| 10.2.14 through 10.2.16-h* | Upgrade to 10.2.16-h12 or 10.2.18-h13 or later. | |
| 10.2.11 through 10.2.13-h* | Upgrade to 10.2.13-h27 or 10.2.18-h13 or later. | |
| 10.2.8 through 10.2.10-h* | Upgrade to 10.2.10-h42 or 10.2.18-h13 or later. | |
| 10.2.0 through 10.2.7-h* | Upgrade to 10.2.7-h39 or 10.2.18-h13 or later. | |
| All older unsupported PAN-OS versions | Upgrade to a supported fixed version. |
Workarounds and Mitigations
Customers with Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 and later versions received advance coverage, released via Threat ID 543004, which was released at 10:21 PM PT on Oct 20.
Customers with a Threat Prevention subscription are provided with coverage against this vulnerability by enabling Threat ID 543004, 97622, 97623, 97624, 97625, 97643, 97647, 97649, 97652, 97653, 97656, 97657, 97658, 97659, 97662, 97663, 97664, 97670, 97671, 97672, 97673, 97674, 97676, 97677, 97678 (from Applications and Threats content version 9162, 9163, 9164 and later). For these Threat IDs to protect against attacks for this vulnerability:
- Route incoming traffic for the MGT port through a DP port, e.g., enabling management profile on a DP interface for management access.
- Replace the Certificate for Inbound Traffic Management.
- Decrypt inbound traffic to the management interface so the firewall can inspect it.
- Enable threat prevention on the inbound traffic to management services.
Frequently Asked Questions
Q. Is GlobalProtect™ impacted?
GlobalProtect portal, gateway and Clientless VPN are not impacted.
Q. Is Captive Portal impacted?
The captive portal is not impacted.
Q. Which part of the PAN-OS® product is affected?
This issue strictly affects the management web interface, which includes the HTTPS web UI and XML API service.
Q. Does it affect any standard dataplane interface, or specifically ones with a management profile attached?
It affects the dataplane interface only if a management profile is attached to it.
Q. When will PAN-OS fixes be available?
Patches will be made available as quickly as possible. Please monitor the security advisory for the latest information on mitigations and updates.
Q. Are any of our products affected by the new vulnerability (CVE-2026-115560) announced by PHP?
Current analysis shows no impact of CVE-2026-115560 on PAN-OS (NGFW and Panorama). This CVE is related to an uncommon configuration that is not used by PAN-OS. A review of impact to other products is underway.
Q. Along with the PHP vulnerability, now there is a vulnerability in the brotli compression library used by Node.js. Will I need to do two updates?
No, the same hotfix covers both the PHP and brotli vulnerabilities. The only exception is 11.2.10-h16 which only includes the fix for PHP vulnerabilities; 11.2.10-h17 includes fixes for both vulnerabilities.
Q. Do the PAN-OS fixes address both PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619)?
Yes. The released hotfixes address both CVE-2026-109618 and CVE-2026-109619.
CPEs
cpe:2.3:o:palo_alto_networks:pan-os:12.2.3:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.2.2:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:-:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.9:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.8:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h6:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h5:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h3:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h2:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h1:*:*:*:*:*:*
CPE Applicability
- cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)12.2.4 and up to (excluding)12.2.4-h1
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)12.1.10 and up to (excluding)12.1.10-h3
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)12.1.7 and up to (excluding)12.1.7-h11
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)12.1.4 and up to (excluding)12.1.4-h13
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.2.16 and up to (excluding)11.2.16-h1
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.2.13 and up to (excluding)11.2.13-h4
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.2.10 and up to (excluding)11.2.10-h16
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.2.7 and up to (excluding)11.2.7-h23
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.2.4 and up to (excluding)11.2.4-h23
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.1.16 and up to (excluding)11.1.16-h4
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.1.13 and up to (excluding)11.1.13-h16
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.1.10 and up to (excluding)11.1.10-h36
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.1.7 and up to (excluding)11.1.7-h12
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.1.6 and up to (excluding)11.1.6-h40
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.1.4 and up to (excluding)11.1.4-h38
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)10.2.18 and up to (excluding)10.2.18-h13
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)10.2.16 and up to (excluding)10.2.16-h12
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)10.2.13 and up to (excluding)10.2.13-h27
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)10.2.10 and up to (excluding)10.2.10-h42
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)10.2.7 and up to (excluding)10.2.7-h39