{"document":{"category":"csaf_vex","csaf_version":"2.1","notes":[{"category":"summary","text":"Palo Alto Networks PSIRT provided VEX document. This document is autogenerated.","title":"Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products "}],"publisher":{"category":"vendor","name":"Palo Alto Networks","namespace":"https://security.paloaltonetworks.com"},"title":"Palo Alto Networks PSIRT provided VEX document: CVE-2026-109618","distribution":{"text":"Copyright © 2024 Palo Alto Networks. All rights reserved.","tlp":{"label":"CLEAR","url":"https://www.first.org/tlp/"}},"tracking":{"current_release_date":"2026-11-10T07:00:06.278Z","generator":{"date":"2026-11-10T07:00:06.278Z","engine":{"name":"Vulnogram","version":"0.1.0-dev"}},"id":"CVE-2026-109618","initial_release_date":"2026-10-21T16:00:00.000Z","revision_history":[{"number":"1","date":"2026-10-21T09:00:00.000Z","summary":"Initial Publication"},{"number":"2","date":"2026-10-21T12:18:00.000Z","summary":"Updated the status of GlobalProtect App and Prisma Access Agent as not impacted. Also updated the Frequently Asked question (FAQ) section."},{"number":"3","date":"2026-10-21T14:07:00.000Z","summary":"Updated the status of Cortex XSIAM and Prisma Cloud as not impacted"},{"number":"4","date":"2026-10-21T16:33:00.000Z","summary":"Threat ID released and details updated"},{"number":"5","date":"2026-10-22T17:25:00.000Z","summary":"Updated the status of Cortex XDR Broker VM, Cortex XCORE (SaaS), Strata Cloud Manager, WildFire Appliance WF-500 and WF-500-B and WildFire Cloud. Also updated the Frequently Asked question (FAQ) section."},{"number":"6","date":"2026-10-22T20:45:00.000Z","summary":"Added estimated availability dates (ETAs) for hotfix releases across supported PAN-OS versions."},{"number":"7","date":"2026-10-23T10:10:00.000Z","summary":"Updated the status of Prisma SD-WAN ION, Prisma SD-WAN  Controller, Prisma SD-WAN On-Prem Controller, Next Generation Trust Security and Trust Protection Foundation as not impacted. Also made the correction to the status of WildFire Appliance WF-500 and WF-500-B impact."},{"number":"8","date":"2026-10-23T17:01:00.000Z","summary":" Added updated threat signature and content version release details"},{"number":"9","date":"2026-10-24T22:25:00.000Z","summary":"Updated the Frequently Asked question (FAQ) section. Also, removed the ETA for 10.2.18-h13, 11.1.16-h4 and 11.2.10-h16 as these versions are released"},{"number":"10","date":"2026-10-25T22:45:00.000Z","summary":"Removed the ETAs for 11.1.4-h38, 11.1.6-h40, 11.1.10-h36 and 11.1.13-h16 as these versions are released"},{"number":"11","date":"2026-10-26T17:10:00.000Z","summary":"Removed the ETAs for 10.2.13-h27 and 10.2.16-h12 as these versions are released. Also updated the Frequently Asked question (FAQ) section. Updated the status of Koi."},{"number":"12","date":"2026-10-26T21:03:00.000Z","summary":"Removed the ETAs for 12.1.7-h11 and 12.2.4-h1 as these versions are released."},{"number":"13","date":"2026-10-27T09:40:00.000Z","summary":"Severity Updated to Critical and Urgency updated as Highest"},{"number":"14","date":"2026-10-27T22:15:00.000Z","summary":"Removed ETAs for 11.2.7-h23, 11.2.13-h4 and 11.2.16-h1 as these versions are released"},{"number":"15","date":"2026-10-28T22:20:00.000Z","summary":"Removed ETAs for 10.2.7-h39, 10.2.10-h42, 11.2.4-h23, 12.1.4-h13 and 12.1.10-h3 as these versions are released"},{"number":"16","date":"2026-10-29T16:54:00.000Z","summary":"Removed ETAs for 11.1.7-h12 as the version is released. Also updated the Frequently Asked question (FAQ) section. "}],"status":"final","version":"1"}},"product_tree":{"branches":[{"name":"Palo Alto Networks","category":"vendor","branches":[{"name":"Bridgecrew","category":"product_name","branches":[{"category":"product_version","name":"Bridgecrew All","product":{"name":"Palo Alto Networks Bridgecrew","product_id":"PANW-Bridgecrew-1"}}]},{"name":"Cloud NGFW","category":"product_name","branches":[{"category":"product_version","name":"Cloud NGFW All","product":{"name":"Palo Alto Networks Cloud NGFW","product_id":"PANW-Cloud-NGFW-1"}}]},{"name":"Cortex Cloud","category":"product_name","branches":[{"category":"product_version","name":"Cortex Cloud All","product":{"name":"Palo Alto Networks Cortex Cloud","product_id":"PANW-Cortex-Cloud-1"}}]},{"name":"Cortex XDR Agent","category":"product_name","branches":[{"category":"product_version","name":"Cortex XDR Agent All","product":{"name":"Palo Alto Networks Cortex XDR Agent","product_id":"PANW-Cortex-XDR-Agent-1"}}]},{"name":"Cortex XDR Broker VM","category":"product_name","branches":[{"category":"product_version","name":"Cortex XDR Broker VM All","product":{"name":"Palo Alto Networks Cortex XDR Broker VM","product_id":"PANW-Cortex-XDR-Broker-VM-10"}}]},{"name":"Cortex XSIAM","category":"product_name","branches":[{"category":"product_version","name":"Cortex XSIAM All","product":{"name":"Palo Alto Networks Cortex XSIAM","product_id":"PANW-Cortex-XSIAM-1"}}]},{"name":"Cortex XSOAR","category":"product_name","branches":[{"category":"product_version","name":"Cortex XSOAR All","product":{"name":"Palo Alto Networks Cortex XSOAR","product_id":"PANW-Cortex-XSOAR-4"}}]},{"name":"Cortex Xpanse","category":"product_name","branches":[{"category":"product_version","name":"Cortex Xpanse All","product":{"name":"Palo Alto Networks Cortex Xpanse","product_id":"PANW-Cortex-Xpanse-1"}}]},{"name":"Cortex XCORE (SaaS)","category":"product_name","branches":[{"category":"product_version","name":"Cortex XCORE (SaaS) All","product":{"name":"Palo Alto Networks Cortex XCORE (SaaS)","product_id":"PANW-Cortex-XCORE-(SaaS)-1"}}]},{"name":"GlobalProtect App","category":"product_name","branches":[{"category":"product_version","name":"GlobalProtect App All","product":{"name":"Palo Alto Networks GlobalProtect App","product_id":"PANW-GlobalProtect-App-1"}}]},{"name":"Idira","category":"product_name","branches":[{"category":"product_version","name":"Idira All","product":{"name":"Palo Alto Networks Idira","product_id":"PANW-Idira-1"}}]},{"name":"Koi","category":"product_name","branches":[{"category":"product_version","name":"Koi All","product":{"name":"Palo Alto Networks Koi","product_id":"PANW-Koi-1"}}]},{"name":"PAN-OS","category":"product_name","branches":[{"category":"product_version_range","name":"vers:generic/PAN-OS<12.2.4-h1","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-926"}},{"category":"product_version_range","name":"vers:generic/PAN-OS>=12.2.4-h1","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-926"}},{"category":"product_version_range","name":"vers:generic/PAN-OS<12.1.4-h13","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-927"}},{"category":"product_version_range","name":"vers:generic/PAN-OS>=12.1.10-h3","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-929"}},{"category":"product_version_range","name":"vers:generic/PAN-OS>=12.1.7-h11","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-928"}},{"category":"product_version_range","name":"vers:generic/PAN-OS>=12.1.4-h13","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-927"}},{"category":"product_version_range","name":"vers:generic/PAN-OS<11.2.4-h23","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-930"}},{"category":"product_version_range","name":"vers:generic/PAN-OS>=11.2.16-h1","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-934"}},{"category":"product_version_range","name":"vers:generic/PAN-OS>=11.2.13-h4","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-933"}},{"category":"product_version_range","name":"vers:generic/PAN-OS>=11.2.10-h16","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-932"}},{"category":"product_version_range","name":"vers:generic/PAN-OS>=11.2.7-h23","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-931"}},{"category":"product_version_range","name":"vers:generic/PAN-OS>=11.2.4-h23","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-930"}},{"category":"product_version_range","name":"vers:generic/PAN-OS<11.1.4-h38","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-935"}},{"category":"product_version_range","name":"vers:generic/PAN-OS>=11.1.16-h4","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-940"}},{"category":"product_version_range","name":"vers:generic/PAN-OS>=11.1.13-h16","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-939"}},{"category":"product_version_range","name":"vers:generic/PAN-OS>=11.1.10-h36","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-938"}},{"category":"product_version_range","name":"vers:generic/PAN-OS>=11.1.7-h12","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-937"}},{"category":"product_version_range","name":"vers:generic/PAN-OS>=11.1.6-h40","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-936"}},{"category":"product_version_range","name":"vers:generic/PAN-OS>=11.1.4-h38","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-935"}},{"category":"product_version_range","name":"vers:generic/PAN-OS<10.2.7-h39","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-941"}},{"category":"product_version_range","name":"vers:generic/PAN-OS>=10.2.18-h13","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-945"}},{"category":"product_version_range","name":"vers:generic/PAN-OS>=10.2.16-h12","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-944"}},{"category":"product_version_range","name":"vers:generic/PAN-OS>=10.2.13-h27","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-943"}},{"category":"product_version_range","name":"vers:generic/PAN-OS>=10.2.10-h42","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-942"}},{"category":"product_version_range","name":"vers:generic/PAN-OS>=10.2.7-h39","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-941"}}]},{"name":"Prisma Cloud","category":"product_name","branches":[{"category":"product_version","name":"Prisma Cloud All","product":{"name":"Palo Alto Networks Prisma Cloud","product_id":"PANW-Prisma-Cloud-1"}}]},{"name":"Prisma Access","category":"product_name","branches":[{"category":"product_version","name":"Prisma Access All","product":{"name":"Palo Alto Networks Prisma Access","product_id":"PANW-Prisma-Access-1"}}]},{"name":"Prisma Access Agent","category":"product_name","branches":[{"category":"product_version","name":"Prisma Access Agent All","product":{"name":"Palo Alto Networks Prisma Access Agent","product_id":"PANW-Prisma-Access-Agent-2"}}]},{"name":"Prisma AIRS AI Gateway","category":"product_name","branches":[{"category":"product_version","name":"Prisma AIRS AI Gateway All","product":{"name":"Palo Alto Networks Prisma AIRS AI Gateway","product_id":"PANW-Prisma-AIRS-AI-Gateway-1"}}]},{"name":"Prisma SD-WAN ION","category":"product_name","branches":[{"category":"product_version","name":"Prisma SD-WAN ION All","product":{"name":"Palo Alto Networks Prisma SD-WAN ION","product_id":"PANW-Prisma-SD-WAN-ION-1"}}]},{"name":"Prisma SD-WAN  Controller","category":"product_name","branches":[{"category":"product_version","name":"Prisma SD-WAN  Controller All","product":{"name":"Palo Alto Networks Prisma SD-WAN  Controller","product_id":"PANW-Prisma-SD-WAN--Controller-1"}}]},{"name":"Prisma SD-WAN On-Prem Controller","category":"product_name","branches":[{"category":"product_version","name":"Prisma SD-WAN On-Prem Controller All","product":{"name":"Palo Alto Networks Prisma SD-WAN On-Prem Controller","product_id":"PANW-Prisma-SD-WAN-On-Prem-Controller-1"}}]},{"name":"Strata Cloud Manager","category":"product_name","branches":[{"category":"product_version","name":"Strata Cloud Manager All","product":{"name":"Palo Alto Networks Strata Cloud Manager","product_id":"PANW-Strata-Cloud-Manager-1"}}]},{"name":"Next Generation Trust Security","category":"product_name","branches":[{"category":"product_version","name":"Next Generation Trust Security All","product":{"name":"Palo Alto Networks Next Generation Trust Security","product_id":"PANW-Next-Generation-Trust-Security-1"}}]},{"name":"Trust Protection Foundation","category":"product_name","branches":[{"category":"product_version","name":"Trust Protection Foundation All","product":{"name":"Palo Alto Networks Trust Protection Foundation","product_id":"PANW-Trust-Protection-Foundation-5"}}]},{"name":"WildFire Appliance WF-500 and WF-500-B","category":"product_name","branches":[{"category":"product_version","name":"WildFire Appliance WF-500 and WF-500-B All","product":{"name":"Palo Alto Networks WildFire Appliance WF-500 and WF-500-B","product_id":"PANW-WildFire-Appliance-WF-500-and-WF-500-B-1"}}]},{"name":"WildFire Cloud","category":"product_name","branches":[{"category":"product_version","name":"WildFire Cloud All","product":{"name":"Palo Alto Networks WildFire Cloud","product_id":"PANW-WildFire-Cloud-1"}}]}]}]},"vulnerabilities":[{"cve":"CVE-2026-109618","product_status":{"fixed":["PANW-PAN-OS-926","PANW-PAN-OS-929","PANW-PAN-OS-928","PANW-PAN-OS-927","PANW-PAN-OS-934","PANW-PAN-OS-933","PANW-PAN-OS-932","PANW-PAN-OS-931","PANW-PAN-OS-930","PANW-PAN-OS-940","PANW-PAN-OS-939","PANW-PAN-OS-938","PANW-PAN-OS-937","PANW-PAN-OS-936","PANW-PAN-OS-935","PANW-PAN-OS-945","PANW-PAN-OS-944","PANW-PAN-OS-943","PANW-PAN-OS-942","PANW-PAN-OS-941"],"known_affected":["PANW-PAN-OS-926","PANW-PAN-OS-927","PANW-PAN-OS-930","PANW-PAN-OS-935","PANW-PAN-OS-941"],"known_not_affected":["PANW-Bridgecrew-1","PANW-Cloud-NGFW-1","PANW-Cortex-Cloud-1","PANW-Cortex-XDR-Agent-1","PANW-Cortex-XDR-Broker-VM-10","PANW-Cortex-XSIAM-1","PANW-Cortex-XSOAR-4","PANW-Cortex-Xpanse-1","PANW-Cortex-XCORE-(SaaS)-1","PANW-GlobalProtect-App-1","PANW-Idira-1","PANW-Koi-1","PANW-Prisma-Cloud-1","PANW-Prisma-Access-1","PANW-Prisma-Access-Agent-2","PANW-Prisma-AIRS-AI-Gateway-1","PANW-Prisma-SD-WAN-ION-1","PANW-Prisma-SD-WAN--Controller-1","PANW-Prisma-SD-WAN-On-Prem-Controller-1","PANW-Strata-Cloud-Manager-1","PANW-Next-Generation-Trust-Security-1","PANW-Trust-Protection-Foundation-5","PANW-WildFire-Appliance-WF-500-and-WF-500-B-1","PANW-WildFire-Cloud-1"]},"notes":[{"category":"description","text":"Palo Alto Networks is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619.\n\nCVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, allowing attackers to reliably achieve RCE using out-of-memory (OOM) triggers.\n\nCVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be read or branched on during subsequent requests, enabling attackers to execute arbitrary code.\n\nPalo Alto Networks has conducted an evaluation of our product portfolio regarding this issue; a summary of the status across products is provided in the table below. We will update the below table when we get more information."}],"references":[{"category":"external","summary":"NVD - CVE-2026-109618","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109618"},{"category":"self","summary":"Palo Alto Networks Security Advisory CVE-2026-109618","url":"https://security.paloaltonetworks.com/CVE-2026-109618"}],"threats":[{"category":"impact","description":"Palo Alto Networks is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619.\n\nCVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, allowing attackers to reliably achieve RCE using out-of-memory (OOM) triggers.\n\nCVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be read or branched on during subsequent requests, enabling attackers to execute arbitrary code.\n\nPalo Alto Networks has conducted an evaluation of our product portfolio regarding this issue; a summary of the status across products is provided in the table below. We will update the below table when we get more information."}],"scores":[{"cvss_v4":{"version":"4.0","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","Safety":"NOT_DEFINED","Automatable":"NO","Recovery":"USER","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"RED","exploitMaturity":"ATTACKED","baseSeverity":"CRITICAL","baseScore":9.2,"threatSeverity":"CRITICAL","threatScore":9.2,"vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:D/RE:M/U:Red"},"products":["PANW-PAN-OS-926","PANW-PAN-OS-927","PANW-PAN-OS-930","PANW-PAN-OS-935","PANW-PAN-OS-941"]},{"cvss_v4":{"version":"4.0","attackVector":"ADJACENT","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","Safety":"NOT_DEFINED","Automatable":"NO","Recovery":"USER","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"AMBER","exploitMaturity":"UNREPORTED","baseSeverity":"HIGH","baseScore":7.7,"threatSeverity":"MEDIUM","threatScore":5.2,"vectorString":"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber"},"products":["PANW-PAN-OS-926","PANW-PAN-OS-927","PANW-PAN-OS-930","PANW-PAN-OS-935","PANW-PAN-OS-941"]},{"cvss_v4":{"version":"4.0","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"RED","exploitMaturity":"ATTACKED","baseSeverity":"CRITICAL","baseScore":9.2,"threatSeverity":"CRITICAL","threatScore":9.2,"vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red"},"products":["PANW-PAN-OS-926","PANW-PAN-OS-927","PANW-PAN-OS-930","PANW-PAN-OS-935","PANW-PAN-OS-941"]}]}]}