OTPulse

Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products

Plan PatchCVSS 8.7CVE-2026-109618Oct 21, 2026
Palo Alto Networks
IT in OT - Palo Alto firewalls are commonly deployed at IT/OT network boundaries
Summary

Two critical remote code execution vulnerabilities exist in PHP code used by PAN-OS and Panorama. CVE-2026-109618 allows attackers to trigger out-of-memory errors that leave request memory uninitialized, enabling reliable RCE. CVE-2026-109619 causes longjmp() error handling to leave global memory pointing to freed regions, which can be read or branched on during subsequent requests to execute arbitrary code. All PAN-OS versions 10.2 through 12.2 and all Panorama versions are affected. No vendor patch is currently available.

What this means
What could happen
An attacker with network access to the management interface of PAN-OS or Panorama firewalls could execute arbitrary code on the device, potentially gaining full control of the firewall and allowing them to inspect, modify, or block traffic passing through your network.
Who's at risk
Palo Alto Networks firewall administrators and network operators managing PAN-OS (versions 10.2, 11.1, 11.2, 12.1, 12.2) or Panorama multi-device management platforms should treat this as critical, as successful exploitation would compromise the security appliance protecting the entire network.
How it could be exploited
An attacker triggers an out-of-memory condition on the PAN-OS or Panorama management interface, causing PHP error handling via longjmp() to leave memory uninitialized or pointing to freed regions. On subsequent requests, the attacker can read or branch on this corrupted memory to reliably execute arbitrary code with firewall privileges.
Prerequisites
  • Network access to the PAN-OS or Panorama management interface (typically port 443)
  • Ability to send crafted HTTP requests to trigger out-of-memory conditions
remotely exploitablehigh CVSS score (8.7)affects network security appliancesno patch currently available
Exploitability
Some exploitation risk — EPSS score 5.8%
Public Proof-of-Concept (PoC) on GitHub (10 repositories)
Affected products (6)
6 pending
ProductAffected VersionsFix Status
PAN-OS12.1 AllNo fix yet
PAN-OS11.2 AllNo fix yet
PAN-OS11.1 AllNo fix yet
PAN-OS10.2 AllNo fix yet
PanoramaAllNo fix yet
PAN-OS12.2 AllNo fix yet
Remediation & Mitigation
0/4
Do now
0/2
PAN-OS
HARDENINGIf running PAN-OS 12.2.4 or later with ATP Plus, verify that Frontier Virtual Patching (Threat ID 543004) is active and updated
All products
WORKAROUNDRestrict network access to the management interface (port 443) to only trusted internal IP addresses and management workstations using firewall rules and network segmentation
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

PAN-OS
HOTFIXMonitor Palo Alto Networks security advisories for patched PAN-OS and Panorama versions; apply updates via maintenance window once available
All products
HARDENINGEnable Advanced Threat Prevention (ATP) IPS signatures 543004, 97622, 97623, 97624, 97625 once released by Palo Alto Networks to detect exploitation attempts
View full vendor advisory
API: /api/v1/advisories/e0243a1b-aadf-435d-a25b-f0b4c62a72fc

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products | CVSS 8.7 - OTPulse