T
Threats
Palo Alto Networks PAN-OS and Panorama PHP Remote Code Execution Vulnerabilities
Overview
Severity: Critical
Vendor urgency: HIGHEST
Date: 29 October 2026
Vendor advisory published: 21 October 2026 (updated 28 October 2026)
Exploitation status: Active exploitation observed by the vendor against management interfaces exposed to the internet
Palo Alto Networks has assigned a suggested urgency rating of HIGHEST to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Both allow remote code execution without authentication, and no special configuration is required to be affected. The risk is highest where the management interface is reachable from the internet, and the vendor has observed active exploitation of exposed interfaces.
Affected Versions
The issue affects the PAN-OS management web interface (HTTPS web UI and XML API service). Fixes are being released as hotfixes per branch. Some releases are still pending, with vendor ETAs shown below. All older unsupported PAN-OS versions are affected and should be upgraded to a supported fixed version.
PAN-OS 12.2
Affected: Versions earlier than 12.2.4-h1 (12.2.0 through 12.2.4-h*)
Fixed: 12.2.4-h1 or later
Not affected: Versions at or above the fixed releases listed
Source: Palo Alto Networks Security Advisory CVE-2026-109618
PAN-OS 12.1
Affected: Versions earlier than 12.1.4-h13, 12.1.7-h11 or 12.1.10-h3 (12.1.2 through 12.1.10-h*)
Fixed: 12.1.4-h13 (ETA 29 October 2026), 12.1.7-h11, or 12.1.10-h3 or later (ETA 30 October 2026)
Not affected: Versions at or above the fixed releases listed
Source: Palo Alto Networks Security Advisory CVE-2026-109618
PAN-OS 11.2
Affected: Versions earlier than 11.2.4-h23, 11.2.7-h23, 11.2.10-h16, 11.2.13-h4 or 11.2.16-h1 (11.2.0 through 11.2.16-h*)
Fixed: 11.2.4-h23 (ETA 30 October 2026), 11.2.7-h23, 11.2.10-h16, 11.2.13-h4, or 11.2.16-h1 or later. The vendor notes 11.2.10-h16 covers the PHP fix only; 11.2.10-h17 also covers the separate brotli fix.
Not affected: Versions at or above the fixed releases listed
Source: Palo Alto Networks Security Advisory CVE-2026-109618
PAN-OS 11.1
Affected: Versions earlier than 11.1.4-h38, 11.1.6-h40, 11.1.7-h12, 11.1.10-h36, 11.1.13-h16 or 11.1.16-h4 (11.1.0 through 11.1.16-h*)
Fixed: 11.1.4-h38, 11.1.6-h40, 11.1.7-h12 (ETA 30 October 2026), 11.1.10-h36, 11.1.13-h16, or 11.1.16-h4 or later
Not affected: Versions at or above the fixed releases listed
Source: Palo Alto Networks Security Advisory CVE-2026-109618
PAN-OS 10.2
Affected: Versions earlier than 10.2.7-h39, 10.2.10-h42, 10.2.13-h27, 10.2.16-h12 or 10.2.18-h13 (10.2.0 through 10.2.18-h*)
Fixed: 10.2.7-h39 (ETA 30 October 2026), 10.2.10-h42 (ETA 29 October 2026), 10.2.13-h27, 10.2.16-h12, or 10.2.18-h13 or later
Not affected: Versions at or above the fixed releases listed
Source: Palo Alto Networks Security Advisory CVE-2026-109618
Other Palo Alto Networks products
Affected: None other than PAN-OS and Panorama. Cortex XCORE (SaaS) and WildFire Cloud were previously impacted and were remediated by the vendor on 21 and 22 October 2026 respectively.
Not affected: Prisma Access, Cloud NGFW, GlobalProtect App, Cortex XDR, Cortex XSIAM, Cortex XSOAR, Cortex Xpanse, Prisma Cloud, Prisma SD-WAN, Strata Cloud Manager and WildFire Appliance (WF-500 and WF-500-B), as listed by the vendor. GlobalProtect portal, gateway and Clientless VPN, and Captive Portal, are not impacted.
Source: Palo Alto Networks Security Advisory CVE-2026-109618
Vulnerability Breakdown
CVE-2026-109618 - PHP out-of-memory handling remote code execution
Severity: Critical
CVSS: 9.2 (CVSS 4.0, Critical)
Description: Handling of out-of-memory errors via longjmp() leaves request memory uninitialised due to improper control flow management. Attackers can use out-of-memory triggers to achieve remote code execution.
Impact: Remote code execution on the affected PAN-OS or Panorama management interface, risking system and configuration compromise.
Conditions: Network reachable management web interface. No privileges, user interaction or special configuration required. The vendor rates attack complexity as high.
Notes: The vendor rates the weakness as CWE-754 (Improper Check for Unusual or Exceptional Conditions). If access is limited to a trusted jump box, the vendor rates the adjusted risk as Medium (CVSS-B 7.7).
CVE-2026-109619 - PHP longjmp() fatal error handling remote code execution
Severity: Critical
CVSS: 9.2 (CVSS 4.0, Critical), as published for the vendor's combined assessment and the Unit 42 Threat Brief
Description: Fatal error handling via longjmp() leaves global memory pointing to freed memory regions. These regions can later be read or branched on during subsequent requests, enabling arbitrary code execution.
Impact: Remote code execution on the affected PAN-OS or Panorama management interface.
Conditions: Same as CVE-2026-109618. The management web interface must be reachable by the attacker.
Notes: The vendor handles both CVEs in a single advisory and the same hotfixes address both.
Mitigation
Upgrade PAN-OS to the fixed version for your branch, as listed under Affected Versions. Where the fixed release is not yet available, apply the mitigations below until it is published.
Restrict access to the management interface to trusted internal IP addresses only. Do not expose it to the internet.
Where possible, limit management access to a single jump box.
Customers with a Threat Prevention subscription can enable Threat ID 543004 and the additional Threat IDs listed in the vendor advisory (Applications and Threats content version 9162, 9163, 9164 and later). To be effective, route incoming MGT port traffic through a data plane port, replace the certificate for inbound traffic management, decrypt inbound traffic to the management interface, and enable threat prevention on inbound management traffic.
Customers with Frontier Virtual Patching (Advanced Threat Prevention Plus) on PAN-OS 12.2.4 and later received advance coverage through Threat ID 543004.
Review management interface and PHP worker process activity for signs of compromise. See the Unit 42 Threat Brief for hunting guidance.
Summary for IT Teams
Products: Palo Alto Networks PAN-OS and Panorama
Threat Level: Critical, CVSS 9.2
Vendor urgency: HIGHEST
Action Required: Remove internet access to the management interface now, apply the fixed PAN-OS release for your branch as it becomes available, and enable the vendor's Threat Prevention coverage where licensed.
