Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN1098 _____________________________________________________________________ DATE : 28/10/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): PAN-OS. ==================================================================== https://security.paloaltonetworks.com/CVE-2026-109618 _____________________________________________________________________ CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products Urgency HIGHEST 047910 Severity 9.2 · CRITICAL Exploit Maturity ATTACKED Response Effort MODERATE Recovery USER Value Density DIFFUSE Attack Vector NETWORK Attack Complexity HIGH Attack Requirements NONE Automatable NO User Interaction NONE Product Confidentiality HIGH Product Integrity HIGH Product Availability HIGH Privileges Required NONE Subsequent Confidentiality NONE Subsequent Integrity NONE Subsequent Availability NONE CVE JSON CSAF Published 2026-10-21 Updated 2026-10-28 Discovered internally Description Palo Alto Networks is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, allowing attackers to reliably achieve RCE using out-of-memory (OOM) triggers. CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be read or branched on during subsequent requests, enabling attackers to execute arbitrary code. Palo Alto Networks has conducted an evaluation of our product portfolio regarding this issue; a summary of the status across products is provided in the table below. We will update the below table when we get more information. Product Status Versions Affected Unaffected Bridgecrew None All Cloud NGFW None All Cortex Cloud None All Cortex XCORE (SaaS) None * All * Cortex XDR Agent None All Cortex XDR Broker VM None All Cortex XSIAM None All Cortex XSOAR None All Cortex Xpanse None All GlobalProtect App None All Idira None All Koi None All Next Generation Trust Security None All PAN-OS 12.2 < 12.2.4-h1 >= 12.2.4-h1 PAN-OS 12.1 < 12.1.4-h13 < 12.1.7-h11 < 12.1.10-h3 >= 12.1.4-h13 (ETA: 10/29) >= 12.1.7-h11 >= 12.1.10-h3 (ETA: 10/30) PAN-OS 11.2 < 11.2.4-h23 < 11.2.7-h23 < 11.2.10-h16 < 11.2.13-h4 < 11.2.16-h1 >= 11.2.4-h23 (ETA: 10/30) >= 11.2.7-h23 >= 11.2.10-h16 >= 11.2.13-h4 >= 11.2.16-h1 PAN-OS 11.1 < 11.1.4-h38 < 11.1.6-h40 < 11.1.7-h12 < 11.1.10-h36 < 11.1.13-h16 < 11.1.16-h4 >= 11.1.4-h38 >= 11.1.6-h40 >= 11.1.7-h12 (ETA: 10/30) >= 11.1.10-h36 >= 11.1.13-h16 >= 11.1.16-h4 PAN-OS 10.2 < 10.2.7-h39 < 10.2.10-h42 < 10.2.13-h27 < 10.2.16-h12 < 10.2.18-h13 >= 10.2.7-h39 (ETA: 10/30) >= 10.2.10-h42 (ETA: 10/29) >= 10.2.13-h27 >= 10.2.16-h12 >= 10.2.18-h13 Prisma Access Agent None All Prisma AIRS AI Gateway None All Prisma Cloud None All Prisma Access None All Prisma SD-WAN Controller None All Prisma SD-WAN ION None All Prisma SD-WAN On-Prem Controller None All Strata Cloud Manager None All Trust Protection Foundation None All WildFire Appliance WF-500 and WF-500-B None All WildFire Cloud None ** All ** * Although Cortex XCORE (SaaS) was previously impacted, a remediation patch was deployed on October 21, 2026. ** Although WildFire Cloud was previously impacted, a remediation patch was deployed on October 22, 2026. Note: This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Required Configuration for Exposure No special configuration is required to be affected by this issue. Severity: CRITICAL, Suggested Urgency: HIGHEST The risk is highest on PAN-OS when you allow access to the management interface from external IP addresses on the internet. Based on our assessment the CVSS score of this issue in our product is CRITICAL - CVSS-BT: 9.2 /CVSS-B: 9.2 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:D/RE:M/U:Red) You can reduce the risk of exploitation by restricting access to a jump box that is the only system allowed to access the management interface. MEDIUM - CVSS-BT: 5.2 /CVSS-B: 7.7 (CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber) Vendor CVSS-B: 9.2 (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red) Exploitation Status Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet. Weakness Type and Impact CWE-754 Improper Check for Unusual or Exceptional Conditions CAPEC-153 Input Data Manipulation Solution PAN-OS This issue will be fixed in the upcoming releases of PAN-OS. This advisory will be updated with fixed versions and release estimates as they become available. Until PAN-OS fix versions are available we recommend implementing the workaround and mitigations listed below. See https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/ for more details on the Palo Alto Networks product capabilities to protect against attacks that exploit this issue. Version Minor Version Suggested Solution PAN-OS 12.2 12.2.0 through 12.2.4-h* Upgrade to 12.2.4-h1 or later. PAN-OS 12.1 12.1.8 through 12.1.10-h* Upgrade to 12.1.10-h3 or later. 12.1.5 through 12.1.7-h* Upgrade to 12.1.7-h11 or 12.1.10-h3 or later. 12.1.2 through 12.1.4-h* Upgrade to 12.1.4-h13 or 12.1.10-h3 or later. PAN-OS 11.2 11.2.14 through 11.2.16-h* Upgrade to 11.2.16-h1 or later. 11.2.11 through 11.2.13-h* Upgrade to 11.2.13-h4 or 11.2.16-h1 or later. 11.2.8 through 11.2.10-h* Upgrade to 11.2.10-h16 or 11.2.16-h1 or later. 11.2.5 through 11.2.7-h* Upgrade to 11.2.7-h23 or 11.2.16-h1 or later. 11.2.0 through 11.2.4-h* Upgrade to 11.2.4-h23 or 11.2.16-h1 or later. PAN-OS 11.1 11.1.14 through 11.1.16-h* Upgrade to 11.1.16-h4 or later. 11.1.11 through 11.1.13-h* Upgrade to 11.1.13-h16 or 11.1.16-h4 or later. 11.1.8 through 11.1.10-h* Upgrade to 11.1.10-h36 or 11.1.16-h4 or later. 11.1.7 through 11.1.7-h* Upgrade to 11.1.7-h12 or 11.1.16-h4 or later. 11.1.5 through 11.1.6-h* Upgrade to 11.1.6-h40 or 11.1.16-h4 or later. 11.1.0 through 11.1.4-h* Upgrade to 11.1.4-h38 or 11.1.16-h4 or later. PAN-OS 10.2 10.2.17 through 10.2.18-h* Upgrade to 10.2.18-h13 or later. 10.2.14 through 10.2.16-h* Upgrade to 10.2.16-h12 or 10.2.18-h13 or later. 10.2.11 through 10.2.13-h* Upgrade to 10.2.13-h27 or 10.2.18-h13 or later. 10.2.8 through 10.2.10-h* Upgrade to 10.2.10-h42 or 10.2.18-h13 or later. 10.2.0 through 10.2.7-h* Upgrade to 10.2.7-h39 or 10.2.18-h13 or later. All older unsupported PAN-OS versions Upgrade to a supported fixed version. Workarounds and Mitigations Customers with Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 and later versions received advance coverage, released via Threat ID 543004, which was released at 10:21 PM PT on Oct 20. Customers with a Threat Prevention subscription are provided with coverage against this vulnerability by enabling Threat ID 543004, 97622, 97623, 97624, 97625, 97643, 97647, 97649, 97652, 97653, 97656, 97657, 97658, 97659, 97662, 97663, 97664, 97670, 97671, 97672, 97673, 97674, 97676, 97677, 97678 (from Applications and Threats content version 9162, 9163, 9164 and later). For these Threat IDs to protect against attacks for this vulnerability: Route incoming traffic for the MGT port through a DP port, e.g., enabling management profile on a DP interface for management access. Replace the Certificate for Inbound Traffic Management. Decrypt inbound traffic to the management interface so the firewall can inspect it. Enable threat prevention on the inbound traffic to management services. The security risk posed by this issue on PAN-OS and Panorama is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines. Frequently Asked Questions Q. Is GlobalProtect™ impacted? GlobalProtect portal, gateway and Clientless VPN are not impacted. Q. Is Captive Portal impacted? The captive portal is not impacted. Q. Which part of the PAN-OS® product is affected? This issue strictly affects the management web interface, which includes the HTTPS web UI and XML API service. Q. Does it affect any standard dataplane interface, or specifically ones with a management profile attached? It affects the dataplane interface only if a management profile is attached to it. Q. When will PAN-OS fixes be available? Patches will be made available as quickly as possible. Please monitor the security advisory for the latest information on mitigations and updates. Q. Are any of our products affected by the new vulnerability (CVE-2026-115560) announced by PHP? Current analysis shows no impact of CVE-2026-115560 on PAN-OS (NGFW and Panorama). This CVE is related to an uncommon configuration that is not used by PAN-OS. A review of impact to other products is underway. Q. Along with the PHP vulnerability, now there is a vulnerability in the brotli compression library used by Node.js. Will I need to do two updates? No, the same hotfix covers both the PHP and brotli vulnerabilities. The only exception is 11.2.10-h16 which only includes the fix for PHP vulnerabilities; 11.2.10-h17 includes fixes for both vulnerabilities. CPEs cpe:2.3:o:palo_alto_networks:pan-os:12.2.3:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.2.2:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.9:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.8:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h1:*:*:*:*:*:* CPE Applicability cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)12.2.4 and up to (excluding)12.2.4-h1 ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)12.1.10 and up to (excluding)12.1.10-h3 ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)12.1.7 and up to (excluding)12.1.7-h11 ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)12.1.4 and up to (excluding)12.1.4-h13 ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.2.16 and up to (excluding)11.2.16-h1 ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.2.13 and up to (excluding)11.2.13-h4 ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.2.10 and up to (excluding)11.2.10-h16 ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.2.7 and up to (excluding)11.2.7-h23 ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.2.4 and up to (excluding)11.2.4-h23 ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.1.16 and up to (excluding)11.1.16-h4 ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.1.13 and up to (excluding)11.1.13-h16 ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.1.10 and up to (excluding)11.1.10-h36 ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.1.7 and up to (excluding)11.1.7-h12 ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.1.6 and up to (excluding)11.1.6-h40 ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.1.4 and up to (excluding)11.1.4-h38 ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)10.2.18 and up to (excluding)10.2.18-h13 ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)10.2.16 and up to (excluding)10.2.16-h12 ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)10.2.13 and up to (excluding)10.2.13-h27 ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)10.2.10 and up to (excluding)10.2.10-h42 ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)10.2.7 and up to (excluding)10.2.7-h39 Timeline 2026-10-28 Removed ETAs for 11.2.7-h23, 11.2.13-h4 and 11.2.16-h1 as these versions are released 2026-10-27 Severity Updated to Critical and Urgency updated as Highest 2026-10-27 Removed the ETAs for 12.1.7-h11 and 12.2.4-h1 as these versions are released. 2026-10-27 Removed the ETAs for 10.2.13-h27 and 10.2.16-h12 as these versions are released. Also updated the Frequently Asked question (FAQ) section. Updated the status of Koi. 2026-10-26 Removed the ETAs for 11.1.4-h38, 11.1.6-h40, 11.1.10-h36 and 11.1.13-h16 as these versions are released 2026-10-25 Updated the Frequently Asked question (FAQ) section. Also, removed the ETA for 10.2.18-h13, 11.1.16-h4 and 11.2.10-h16 as these versions are released 2026-10-24 Added updated threat signature and content version release details 2026-10-23 Updated the status of Prisma SD-WAN ION, Prisma SD-WAN Controller, Prisma SD-WAN On-Prem Controller, Next Generation Trust Security and Trust Protection Foundation as not impacted. Also made the correction to the status of WildFire Appliance WF-500 and WF-500-B impact. 2026-10-23 Added estimated availability dates (ETAs) for hotfix releases across supported PAN-OS versions. 2026-10-23 Updated the status of Cortex XDR Broker VM, Cortex XCORE (SaaS), Strata Cloud Manager, WildFire Appliance WF-500 and WF-500-B and WildFire Cloud. Also updated the Frequently Asked question (FAQ) section. 2026-10-22 Threat ID released and details updated 2026-10-21 Updated the status of Cortex XSIAM and Prisma Cloud as not impacted 2026-10-21 Updated the status of GlobalProtect App and Prisma Access Agent as not impacted. Also updated the Frequently Asked question (FAQ) section. 2026-10-21 Initial Publication ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================