[Palo Alto Networks Security Advisories] CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618,CVE-2026-109619) on Palo Alto Networks Products

Palo Alto Networks Security Advisories / CVE-2026-109618 CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products UrgencyMODERATE 0 4 7 9 10 Severity8.7 ·HIGH Exploit Maturity N/A Response Effort MODERATE Recovery USER Value Density DIFFUSE Attack Vector NETWORK Attack Complexity LOW Attack Requirements NONE Automatable NO User Interaction NONE Product Confidentiality NONE Product Integrity NONE Product Availability HIGH Privileges Required NONE Subsequent Confidentiality NONE Subsequent Integrity NONE Subsequent Availability NONE CVE JSON CSAF Published Updated Discovered internally Description Palo Alto Networks is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, allowing attackers to reliably achieve RCE using out-of-memory (OOM) triggers. CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be read or branched on during subsequent requests, enabling attackers to execute arbitrary code. Palo Alto Networks has conducted an evaluation of our product portfolio regarding this issue; a summary of the status across products is provided in the table below. We will update the below table when we get more information. Product Status Versions Affected Unaffected Bridgecrew None All Cloud NGFW None All Cortex XDR Agent None All Cortex XSOAR None All Cortex Xpanse None All Idira None All PAN-OS All None (ETA: TBD) Panorama All None (ETA: TBD) Prisma Access None All Required Configuration for Exposure No special configuration is required to be affected by this issue. Severity:HIGH, Suggested Urgency:MODERATE The risk is highest on PAN-OS when you allow access to the management interface from external IP addresses on the internet. Based on our assessment the CVSS score of this issue in our product is CVSS-B: 8.7 ( CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber ) You can reduce the risk of exploitation by restricting access to a jump box that is the only system allowed to access the management interface. CVSS-B: 7.1 ( CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber ) Vendor CVSS-B: 9.2 ( CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N ) Exploitation Status Palo Alto Networks is not aware of any malicious exploitation of this issue against our products. Weakness Type and Impact CWE-754 Improper Check for Unusual or Exceptional Conditions CAPEC-153 Input Data Manipulation Solution PAN-OS This issue will be fixed in the upcoming releases of PAN-OS. This advisory will be updated with fixed versions and release estimates as they become available. Until PAN-OS fix versions are available we recommend implementing the workaround and mitigations listed below. See for more details on the Palo Alto Networks product capabilities to protect against attacks that exploit this issue. Workarounds and Mitigations Customers with Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 received advance coverage, released via Threat ID 543004, which was released at 10:21 PM PT on Oct 20. After publication of the vulnerability and patches, Advanced Threat Prevention (ATP) will release standard IPS coverage (via signatures 543004, 97622, 97623, 97624, 97625), on Oct 21st. The security risk posed by this issue on PAN-OS is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines . CPE Applicability cpe:2.3:a:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)all or cpe:2.3:a:palo_alto_networks:panorama:*:*:*:*:*:*:*:* is vulnerable from (including)all Timeline Initial Publication

CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products

Palo Alto Networks is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619.

CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, allowing attackers to reliably achieve RCE using out-of-memory (OOM) triggers.

CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be read or branched on during subsequent requests, enabling attackers to execute arbitrary code.

Palo Alto Networks has conducted an evaluation of our product portfolio regarding this issue; a summary of the status across products is provided in the table below. We will update the below table when we get more information.

Required Configuration for Exposure

No special configuration is required to be affected by this issue.

Severity:HIGH, Suggested Urgency:MODERATE

The risk is highest on PAN-OS when you allow access to the management interface from external IP addresses on the internet. Based on our assessment the CVSS score of this issue in our product is CVSS-B: 8.7 ( CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber )

You can reduce the risk of exploitation by restricting access to a jump box that is the only system allowed to access the management interface. CVSS-B: 7.1 ( CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber )

Vendor CVSS-B: 9.2 ( CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N )

Palo Alto Networks is not aware of any malicious exploitation of this issue against our products.

Weakness Type and Impact

CWE-754 Improper Check for Unusual or Exceptional Conditions

CAPEC-153 Input Data Manipulation

This issue will be fixed in the upcoming releases of PAN-OS. This advisory will be updated with fixed versions and release estimates as they become available.

Until PAN-OS fix versions are available we recommend implementing the workaround and mitigations listed below. See for more details on the Palo Alto Networks product capabilities to protect against attacks that exploit this issue.

Workarounds and Mitigations

Customers with Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 received advance coverage, released via Threat ID 543004, which was released at 10:21 PM PT on Oct 20.

After publication of the vulnerability and patches, Advanced Threat Prevention (ATP) will release standard IPS coverage (via signatures 543004, 97622, 97623, 97624, 97625), on Oct 21st.

The security risk posed by this issue on PAN-OS is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines .

cpe:2.3:a:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)all

cpe:2.3:a:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)all

or cpe:2.3:a:palo_alto_networks:panorama:*:*:*:*:*:*:*:* is vulnerable from (including)all

cpe:2.3:a:palo_alto_networks:panorama:*:*:*:*:*:*:*:* is vulnerable from (including)all

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.