CVE-2026-109618 Impact of Critical Vulnerabilities in ...

CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products

Palo Alto Networks is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, allowing attackers to reliably achieve RCE using out-of-memory (OOM) triggers. CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be read or branched on during subsequent requests, enabling attackers to execute arbitrary code. Palo Alto Networks has conducted an evaluation of our product portfolio regarding this issue; a summary of the status across products is provided in the table below. We will update the below table when we get more information.

Palo Alto Networks is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619.

CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, allowing attackers to reliably achieve RCE using out-of-memory (OOM) triggers.

CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be read or branched on during subsequent requests, enabling attackers to execute arbitrary code.

Palo Alto Networks has conducted an evaluation of our product portfolio regarding this issue; a summary of the status across products is provided in the table below. We will update the below table when we get more information.

Required Configuration for Exposure

No special configuration is required to be affected by this issue.

Severity: HIGH, Suggested Urgency: MODERATE

The risk is highest on PAN-OS when you allow access to the management interface from external IP addresses on the internet. Based on our assessment the CVSS score of this issue in our product is CVSS-B: 8.7 ( CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber )

You can reduce the risk of exploitation by restricting access to a jump box that is the only system allowed to access the management interface. CVSS-B: 7.1 ( CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber )

Vendor CVSS-B: 9.2 ( CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N )

Palo Alto Networks is not aware of any malicious exploitation of this issue against our products.

Weakness Type and Impact

CWE-754 Improper Check for Unusual or Exceptional Conditions

CAPEC-153 Input Data Manipulation

PAN-OS This issue will be fixed in the upcoming releases of PAN-OS. This advisory will be updated with fixed versions and release estimates as they become available. Until PAN-OS fix versions are available we recommend implementing the workaround and mitigations listed below. See for more details on the Palo Alto Networks product capabilities to protect against attacks that exploit this issue.

This issue will be fixed in the upcoming releases of PAN-OS. This advisory will be updated with fixed versions and release estimates as they become available.

Until PAN-OS fix versions are available we recommend implementing the workaround and mitigations listed below. See for more details on the Palo Alto Networks product capabilities to protect against attacks that exploit this issue.

Workarounds and Mitigations

Customers with Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 received advance coverage, released via Threat ID 543004, which was released at 10:21 PM PT on Oct 20. After publication of the vulnerability and patches, Advanced Threat Prevention (ATP) will release standard IPS coverage (via signatures 543004, 97622, 97623, 97624, 97625), on Oct 21st. The security risk posed by this issue on PAN-OS is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines .

Customers with Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 received advance coverage, released via Threat ID 543004, which was released at 10:21 PM PT on Oct 20.

After publication of the vulnerability and patches, Advanced Threat Prevention (ATP) will release standard IPS coverage (via signatures 543004, 97622, 97623, 97624, 97625), on Oct 21st.

The security risk posed by this issue on PAN-OS is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines .

cpe:2.3:a:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)all

cpe:2.3:a:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)all

or cpe:2.3:a:palo_alto_networks:panorama:*:*:*:*:*:*:*:* is vulnerable from (including)all

cpe:2.3:a:palo_alto_networks:panorama:*:*:*:*:*:*:*:* is vulnerable from (including)all