{"document":{"category":"csaf_vex","csaf_version":"2.1","notes":[{"category":"summary","text":"Palo Alto Networks PSIRT provided VEX document. This document is autogenerated.","title":"Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products "}],"publisher":{"category":"vendor","name":"Palo Alto Networks","namespace":"https://security.paloaltonetworks.com"},"title":"Palo Alto Networks PSIRT provided VEX document: CVE-2026-109618","distribution":{"text":"Copyright © 2024 Palo Alto Networks. All rights reserved.","tlp":{"label":"CLEAR","url":"https://www.first.org/tlp/"}},"tracking":{"current_release_date":"2026-10-21T23:40:41.630Z","generator":{"date":"2026-10-21T23:40:41.630Z","engine":{"name":"Vulnogram","version":"0.1.0-dev"}},"id":"CVE-2026-109618","initial_release_date":"2026-10-21T16:00:00.000Z","revision_history":[{"number":"1","date":"2026-10-21T09:00:00.000Z","summary":"Initial Publication"},{"number":"2","date":"2026-10-21T12:18:00.000Z","summary":"Updated the status of GlobalProtect App and Prisma Access Agent as not impacted. Also updated the Frequently Asked question (FAQ) section."},{"number":"3","date":"2026-10-21T14:07:00.000Z","summary":"Updated the status of Cortex XSIAM and Prisma Cloud as not impacted."},{"number":"4","date":"2026-10-21T16:33:00.000Z","summary":"Threat ID released and details updated."}],"status":"final","version":"1"}},"product_tree":{"branches":[{"name":"Palo Alto Networks","category":"vendor","branches":[{"name":"Bridgecrew","category":"product_name","branches":[{"category":"product_version","name":"Bridgecrew All","product":{"name":"Palo Alto Networks Bridgecrew","product_id":"PANW-Bridgecrew-1"}}]},{"name":"Cloud NGFW","category":"product_name","branches":[{"category":"product_version","name":"Cloud NGFW All","product":{"name":"Palo Alto Networks Cloud NGFW","product_id":"PANW-Cloud-NGFW-1"}}]},{"name":"Cortex XDR Agent","category":"product_name","branches":[{"category":"product_version","name":"Cortex XDR Agent All","product":{"name":"Palo Alto Networks Cortex XDR Agent","product_id":"PANW-Cortex-XDR-Agent-1"}}]},{"name":"Cortex XSIAM","category":"product_name","branches":[{"category":"product_version","name":"Cortex XSIAM All","product":{"name":"Palo Alto Networks Cortex XSIAM","product_id":"PANW-Cortex-XSIAM-1"}}]},{"name":"Cortex XSOAR","category":"product_name","branches":[{"category":"product_version","name":"Cortex XSOAR All","product":{"name":"Palo Alto Networks Cortex XSOAR","product_id":"PANW-Cortex-XSOAR-4"}}]},{"name":"Cortex Xpanse","category":"product_name","branches":[{"category":"product_version","name":"Cortex Xpanse All","product":{"name":"Palo Alto Networks Cortex Xpanse","product_id":"PANW-Cortex-Xpanse-1"}}]},{"name":"GlobalProtect App","category":"product_name","branches":[{"category":"product_version","name":"GlobalProtect App All","product":{"name":"Palo Alto Networks GlobalProtect App","product_id":"PANW-GlobalProtect-App-1"}}]},{"name":"Idira","category":"product_name","branches":[{"category":"product_version","name":"Idira All","product":{"name":"Palo Alto Networks Idira","product_id":"PANW-Idira-1"}}]},{"name":"PAN-OS ","category":"product_name","branches":[{"category":"product_version","name":"PAN-OS  12.2 All","product":{"name":"Palo Alto Networks PAN-OS ","product_id":"PANW-PAN-OS--2"}},{"category":"product_version","name":"PAN-OS  12.1 All","product":{"name":"Palo Alto Networks PAN-OS ","product_id":"PANW-PAN-OS--3"}},{"category":"product_version","name":"PAN-OS  11.2 All","product":{"name":"Palo Alto Networks PAN-OS ","product_id":"PANW-PAN-OS--4"}},{"category":"product_version","name":"PAN-OS  11.1 All","product":{"name":"Palo Alto Networks PAN-OS ","product_id":"PANW-PAN-OS--5"}},{"category":"product_version","name":"PAN-OS  10.2 All","product":{"name":"Palo Alto Networks PAN-OS ","product_id":"PANW-PAN-OS--6"}}]},{"name":"Panorama","category":"product_name","branches":[{"category":"product_version","name":"Panorama All","product":{"name":"Palo Alto Networks Panorama","product_id":"PANW-Panorama-1"}}]},{"name":"Prisma Cloud","category":"product_name","branches":[{"category":"product_version","name":"Prisma Cloud All","product":{"name":"Palo Alto Networks Prisma Cloud","product_id":"PANW-Prisma-Cloud-1"}}]},{"name":"Prisma Access","category":"product_name","branches":[{"category":"product_version","name":"Prisma Access All","product":{"name":"Palo Alto Networks Prisma Access","product_id":"PANW-Prisma-Access-1"}}]},{"name":"Prisma Access Agent","category":"product_name","branches":[{"category":"product_version","name":"Prisma Access Agent All","product":{"name":"Palo Alto Networks Prisma Access Agent","product_id":"PANW-Prisma-Access-Agent-2"}}]}]}]},"vulnerabilities":[{"cve":"CVE-2026-109618","product_status":{"known_affected":["PANW-PAN-OS--2","PANW-PAN-OS--3","PANW-PAN-OS--4","PANW-PAN-OS--5","PANW-PAN-OS--6","PANW-Panorama-1"],"known_not_affected":["PANW-Bridgecrew-1","PANW-Cloud-NGFW-1","PANW-Cortex-XDR-Agent-1","PANW-Cortex-XSIAM-1","PANW-Cortex-XSOAR-4","PANW-Cortex-Xpanse-1","PANW-GlobalProtect-App-1","PANW-Idira-1","PANW-Prisma-Cloud-1","PANW-Prisma-Access-1","PANW-Prisma-Access-Agent-2"]},"notes":[{"category":"description","text":"Palo Alto Networks is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619.\n\nCVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, allowing attackers to reliably achieve RCE using out-of-memory (OOM) triggers.\n\nCVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be read or branched on during subsequent requests, enabling attackers to execute arbitrary code.\n\nPalo Alto Networks has conducted an evaluation of our product portfolio regarding this issue; a summary of the status across products is provided in the table below. We will update the below table when we get more information."}],"references":[{"category":"external","summary":"NVD - CVE-2026-109618","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109618"},{"category":"self","summary":"Palo Alto Networks Security Advisory CVE-2026-109618","url":"https://security.paloaltonetworks.com/CVE-2026-109618"}],"threats":[{"category":"impact","description":"Palo Alto Networks is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619.\n\nCVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, allowing attackers to reliably achieve RCE using out-of-memory (OOM) triggers.\n\nCVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be read or branched on during subsequent requests, enabling attackers to execute arbitrary code.\n\nPalo Alto Networks has conducted an evaluation of our product portfolio regarding this issue; a summary of the status across products is provided in the table below. We will update the below table when we get more information."}],"scores":[{"cvss_v4":{"version":"4.0","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","Safety":"NOT_DEFINED","Automatable":"NO","Recovery":"USER","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"AMBER","exploitMaturity":"NOT_DEFINED","baseSeverity":"HIGH","baseScore":8.7,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber"},"products":["PANW-PAN-OS--2","PANW-PAN-OS--3","PANW-PAN-OS--4","PANW-PAN-OS--5","PANW-PAN-OS--6","PANW-Panorama-1"]},{"cvss_v4":{"version":"4.0","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","Safety":"NOT_DEFINED","Automatable":"NO","Recovery":"USER","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"AMBER","exploitMaturity":"NOT_DEFINED","baseSeverity":"HIGH","baseScore":7.1,"vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber"},"products":["PANW-PAN-OS--2","PANW-PAN-OS--3","PANW-PAN-OS--4","PANW-PAN-OS--5","PANW-PAN-OS--6","PANW-Panorama-1"]},{"cvss_v4":{"version":"4.0","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","baseSeverity":"CRITICAL","baseScore":9.2,"vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},"products":["PANW-PAN-OS--2","PANW-PAN-OS--3","PANW-PAN-OS--4","PANW-PAN-OS--5","PANW-PAN-OS--6","PANW-Panorama-1"]}]}]}