PAN-OS Memory Corruption Flaws: Exploitation and Fixes
Published · Palo Alto Networks · 2 CVEs · NVD and CISA KEV checked October 30, 2026
In short Palo Alto Networks PAN-OS has critical memory corruption flaws known to be exploited. Check affected releases and fixes.
What happened
Palo Alto Networks has identified memory corruption vulnerabilities affecting PAN-OS. Think of request memory as a temporary workspace: trouble starts when software reads notes that were never filled in or keeps using notes after the workspace has been cleared. These flaws can lead to remote code execution, meaning an attacker could cause the affected software to run code.
The advisory covers CVE-2026-109618 and CVE-2026-109619 across affected releases of PAN-OS 12.2, PAN-OS 12.1, PAN-OS 11.2, PAN-OS 11.1 and PAN-OS 10.2. NVD published both entries on 2026-10-21 and lists each as CRITICAL, with a CVSS 4.0 score of 9.2. Their affected-version ranges and fixes match in the vendor's advisory table.
Both vulnerabilities are known to be exploited. CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalog on 2026-10-26, with a listed due date of 2026-10-29. CISA lists known ransomware use as Unknown, which does not establish whether ransomware operators have used them. KISA, Korea's Internet & Security Agency, also published an advisory on 2026-10-29.
Technical details
These are memory corruption flaws involving PHP request handling. NVD associates both with CWE-1325, Improperly Controlled Sequential Memory Allocation; CWE-416, Use After Free; CWE-755, Improper Handling of Exceptional Conditions; and CWE-824, Access of Uninitialized Pointer. In plain language, these categories concern memory allocation, continued access to released memory, error handling and references that have not been properly initialized.
CVE-2026-109618 involves the way PHP exits request processing when memory runs out. Its longjmp() mechanism transfers execution out of the current processing context. Some contexts do not fully account for that interruption, allowing request memory to remain uninitialized. Cleanup can then read that memory or use it to decide what to do next. The NVD description says multiple ways of causing an out-of-memory condition can reliably produce this situation and lead to remote code execution.
CVE-2026-109619 involves shared PHP state that temporarily refers to memory belonging to a request. That state may survive a reset or be populated again after resetting, leaving references to memory that has already been released. Later requests can encounter those stale references before the state is properly initialized. NVD describes multiple ways to trigger this behavior and achieve remote code execution.
Exploitation depends on reaching the vulnerable request-processing behavior and triggering the relevant memory conditions. The descriptions do not identify a specific PAN-OS feature, required configuration, authentication requirement or exposed interface, so they do not support assuming that every affected installation is equally reachable. The CVSS 4.0 score of 9.2 expresses critical technical severity; it is not a probability of compromise or evidence that a particular device has been attacked. The separate CISA KEV listings establish known exploitation.
Weakness types: Memory corruption
Who is affected
Everyday users
For everyday users, the practical question is whether the organization responsible for your PAN-OS deployment has checked its exact release and installed an applicable fix. The affected products listed here are PAN-OS releases; the advisory does not call for updating a personal browser or changing a password.
Known exploitation makes remediation a priority, but it does not establish that your organization's device has been compromised. If you depend on a service managed by an IT team, ask whether its PAN-OS systems have been checked against the vendor's affected-version table.
Developers
For junior developers, these flaws illustrate why error handling and request cleanup are security-sensitive. Running out of memory can interrupt normal initialization, while shared state can outlive the request memory it references. A cleanup operation or a later request may then use memory whose contents are no longer valid.
Developers supporting an affected deployment should coordinate with the PAN-OS administrator about the installed release and its update. The descriptions do not establish that application-code changes would fix the affected PAN-OS software, or that a particular application is necessary to exploit it.
Server and IT admins
Administrators should inventory exact PAN-OS versions, including the suffix beginning with -h. The branch name alone is insufficient: PAN-OS 12.1, PAN-OS 11.2, PAN-OS 11.1 and PAN-OS 10.2 each have multiple affected intervals and corresponding fixes. A fix listed for an earlier interval must not be treated as covering every later release in that branch.
Use the vendor's advisory as the primary guide to selecting and installing a fixed release. The version mapping below applies to both CVE-2026-109618 and CVE-2026-109619. Where an entry says 'and later,' keep that wording within the named PAN-OS branch and confirm the intended target against the advisory.
What to do now
- Check the exact installed PAN-OS release using the allowed CLI command below. Record the full version, including any suffix, and compare it with the applicable interval. In the mappings below, 'at least' includes the starting version and 'below' excludes the ending version.
- For PAN-OS 12.2: releases at least 12.2.0 and below 12.2.4-h1 are affected. The listed fix is 12.2.4-h1 and later.
- For PAN-OS 12.1: releases at least 12.1.2 and below 12.1.4-h13 are affected; the listed fix is 12.1.4-h13 or 12.1.10-h3 and later. Releases at least 12.1.5 and below 12.1.7-h11 are affected; the listed fix is 12.1.7-h11 or 12.1.10-h3 and later. Releases at least 12.1.8 and below 12.1.10-h3 are affected; the listed fix is 12.1.10-h3 and later.
- For PAN-OS 11.2: releases at least 11.2.0 and below 11.2.4-h23 are affected; the listed fix is 11.2.4-h23 or 11.2.16-h1 and later. Releases at least 11.2.5 and below 11.2.7-h23 are affected; the listed fix is 11.2.7-h23 or 11.2.16-h1 and later. Releases at least 11.2.8 and below 11.2.10-h16 are affected; the listed fix is 11.2.10-h16 or 11.2.16-h1 and later. Releases at least 11.2.11 and below 11.2.13-h4 are affected; the listed fix is 11.2.13-h4 or 11.2.16-h1 and later. Releases at least 11.2.14 and below 11.2.16-h1 are affected; the listed fix is 11.2.16-h1 and later.
- For PAN-OS 11.1: releases at least 11.1.0 and below 11.1.4-h38 are affected; the listed fix is 11.1.4-h38 or 11.1.16-h4 and later. Releases at least 11.1.5 and below 11.1.6-h40 are affected; the listed fix is 11.1.6-h40 or 11.1.16-h4 and later. Releases at least 11.1.7 and below 11.1.7-h12 are affected; the listed fix is 11.1.7-h12 or 11.1.16-h4 and later. Releases at least 11.1.8 and below 11.1.10-h36 are affected; the listed fix is 11.1.10-h36 or 11.1.16-h4 and later. Releases at least 11.1.11 and below 11.1.13-h16 are affected; the listed fix is 11.1.13-h16 or 11.1.16-h4 and later. Releases at least 11.1.14 and below 11.1.16-h4 are affected; the listed fix is 11.1.16-h4 and later.
- For PAN-OS 10.2: releases at least 10.2.0 and below 10.2.7-h39 are affected; the listed fix is 10.2.7-h39 or 10.2.18-h13 and later. Releases at least 10.2.8 and below 10.2.10-h42 are affected; the listed fix is 10.2.10-h42 or 10.2.18-h13 and later. Releases at least 10.2.11 and below 10.2.13-h27 are affected; the listed fix is 10.2.13-h27 or 10.2.18-h13 and later. Releases at least 10.2.14 and below 10.2.16-h12 are affected; the listed fix is 10.2.16-h12 or 10.2.18-h13 and later. Releases at least 10.2.17 and below 10.2.18-h13 are affected; the listed fix is 10.2.18-h13 and later.
- Select a fixed release applicable to your installed version and follow the update steps in the vendor's advisory. Prioritize affected deployments because CISA KEV confirms known exploitation of both vulnerabilities. After updating, confirm the running version rather than relying solely on an update-completion message.
Check the PAN-OS version (CLI) · official docs
show system infoIf you can't update yet
- If an update must wait, check the vendor advisory for guidance on restricting access and reducing internet exposure. Treat those as general exposure-reduction principles; the vulnerability descriptions do not establish a specific configuration workaround or show that access restrictions eliminate these flaws.
How to confirm the fix
- Run the version-check command after completing the vendor's update steps and confirm the full running release, including its suffix.
- Match that release to the vendor's fixed-version guidance for the applicable branch and affected interval. Both CVE-2026-109618 and CVE-2026-109619 have the same version mapping.
- Repeat the version check for each PAN-OS system in your inventory. Confirming a fixed release establishes the software version; it does not by itself determine whether exploitation occurred before the update.
NVD scores and CISA KEV status
Listed in CISA's Known Exploited Vulnerabilities catalog: CVE-2026-109618 (added October 26, 2026), CVE-2026-109619 (added October 26, 2026). CISA adds a CVE only when it has evidence of exploitation in the real world.
| CVE | CVSS | Severity | Weakness (CWE) | KEV |
|---|---|---|---|---|
| CVE-2026-109618 | 9.2 (v4.0) | Critical | CWE-1325, CWE-416, CWE-755, CWE-824 | Listed |
| CVE-2026-109619 | 9.2 (v4.0) | Critical | CWE-1325, CWE-416, CWE-755, CWE-824 | Listed |
Affected products and fixed versions 40 rows
| Product | Affected versions | Fixed version / action | CVE |
|---|---|---|---|
| PAN-OS 12.2 | >= 12.2.0 and < 12.2.4-h1 | 12.2.4-h1 and later | CVE-2026-109618 |
| PAN-OS 12.1 | >= 12.1.2 and < 12.1.4-h13 | 12.1.4-h13 or 12.1.10-h3 and later | CVE-2026-109618 |
| PAN-OS 12.1 | >= 12.1.5 and < 12.1.7-h11 | 12.1.7-h11 or 12.1.10-h3 and later | CVE-2026-109618 |
| PAN-OS 12.1 | >= 12.1.8 and < 12.1.10-h3 | 12.1.10-h3 and later | CVE-2026-109618 |
| PAN-OS 11.2 | >= 11.2.0 and < 11.2.4-h23 | 11.2.4-h23 or 11.2.16-h1 and later | CVE-2026-109618 |
| PAN-OS 11.2 | >= 11.2.5 and < 11.2.7-h23 | 11.2.7-h23 or 11.2.16-h1 and later | CVE-2026-109618 |
| PAN-OS 11.2 | >= 11.2.8 and < 11.2.10-h16 | 11.2.10-h16 or 11.2.16-h1 and later | CVE-2026-109618 |
| PAN-OS 11.2 | >= 11.2.11 and < 11.2.13-h4 | 11.2.13-h4 or 11.2.16-h1 and later | CVE-2026-109618 |
| PAN-OS 11.2 | >= 11.2.14 and < 11.2.16-h1 | 11.2.16-h1 and later | CVE-2026-109618 |
| PAN-OS 11.1 | >= 11.1.0 and < 11.1.4-h38 | 11.1.4-h38 or 11.1.16-h4 and later | CVE-2026-109618 |
| PAN-OS 11.1 | >= 11.1.5 and < 11.1.6-h40 | 11.1.6-h40 or 11.1.16-h4 and later | CVE-2026-109618 |
| PAN-OS 11.1 | >= 11.1.7 and < 11.1.7-h12 | 11.1.7-h12 or 11.1.16-h4 and later | CVE-2026-109618 |
| PAN-OS 11.1 | >= 11.1.8 and < 11.1.10-h36 | 11.1.10-h36 or 11.1.16-h4 and later | CVE-2026-109618 |
| PAN-OS 11.1 | >= 11.1.11 and < 11.1.13-h16 | 11.1.13-h16 or 11.1.16-h4 and later | CVE-2026-109618 |
| PAN-OS 11.1 | >= 11.1.14 and < 11.1.16-h4 | 11.1.16-h4 and later | CVE-2026-109618 |
| PAN-OS 10.2 | >= 10.2.0 and < 10.2.7-h39 | 10.2.7-h39 or 10.2.18-h13 and later | CVE-2026-109618 |
| PAN-OS 10.2 | >= 10.2.8 and < 10.2.10-h42 | 10.2.10-h42 or 10.2.18-h13 and later | CVE-2026-109618 |
| PAN-OS 10.2 | >= 10.2.11 and < 10.2.13-h27 | 10.2.13-h27 or 10.2.18-h13 and later | CVE-2026-109618 |
| PAN-OS 10.2 | >= 10.2.14 and < 10.2.16-h12 | 10.2.16-h12 or 10.2.18-h13 and later | CVE-2026-109618 |
| PAN-OS 10.2 | >= 10.2.17 and < 10.2.18-h13 | 10.2.18-h13 and later | CVE-2026-109618 |
| PAN-OS 12.2 | >= 12.2.0 and < 12.2.4-h1 | 12.2.4-h1 and later | CVE-2026-109619 |
| PAN-OS 12.1 | >= 12.1.2 and < 12.1.4-h13 | 12.1.4-h13 or 12.1.10-h3 and later | CVE-2026-109619 |
| PAN-OS 12.1 | >= 12.1.5 and < 12.1.7-h11 | 12.1.7-h11 or 12.1.10-h3 and later | CVE-2026-109619 |
| PAN-OS 12.1 | >= 12.1.8 and < 12.1.10-h3 | 12.1.10-h3 and later | CVE-2026-109619 |
| PAN-OS 11.2 | >= 11.2.0 and < 11.2.4-h23 | 11.2.4-h23 or 11.2.16-h1 and later | CVE-2026-109619 |
Show 15 more rows
| Product | Affected versions | Fixed version / action | CVE |
|---|---|---|---|
| PAN-OS 11.2 | >= 11.2.5 and < 11.2.7-h23 | 11.2.7-h23 or 11.2.16-h1 and later | CVE-2026-109619 |
| PAN-OS 11.2 | >= 11.2.8 and < 11.2.10-h16 | 11.2.10-h16 or 11.2.16-h1 and later | CVE-2026-109619 |
| PAN-OS 11.2 | >= 11.2.11 and < 11.2.13-h4 | 11.2.13-h4 or 11.2.16-h1 and later | CVE-2026-109619 |
| PAN-OS 11.2 | >= 11.2.14 and < 11.2.16-h1 | 11.2.16-h1 and later | CVE-2026-109619 |
| PAN-OS 11.1 | >= 11.1.0 and < 11.1.4-h38 | 11.1.4-h38 or 11.1.16-h4 and later | CVE-2026-109619 |
| PAN-OS 11.1 | >= 11.1.5 and < 11.1.6-h40 | 11.1.6-h40 or 11.1.16-h4 and later | CVE-2026-109619 |
| PAN-OS 11.1 | >= 11.1.7 and < 11.1.7-h12 | 11.1.7-h12 or 11.1.16-h4 and later | CVE-2026-109619 |
| PAN-OS 11.1 | >= 11.1.8 and < 11.1.10-h36 | 11.1.10-h36 or 11.1.16-h4 and later | CVE-2026-109619 |
| PAN-OS 11.1 | >= 11.1.11 and < 11.1.13-h16 | 11.1.13-h16 or 11.1.16-h4 and later | CVE-2026-109619 |
| PAN-OS 11.1 | >= 11.1.14 and < 11.1.16-h4 | 11.1.16-h4 and later | CVE-2026-109619 |
| PAN-OS 10.2 | >= 10.2.0 and < 10.2.7-h39 | 10.2.7-h39 or 10.2.18-h13 and later | CVE-2026-109619 |
| PAN-OS 10.2 | >= 10.2.8 and < 10.2.10-h42 | 10.2.10-h42 or 10.2.18-h13 and later | CVE-2026-109619 |
| PAN-OS 10.2 | >= 10.2.11 and < 10.2.13-h27 | 10.2.13-h27 or 10.2.18-h13 and later | CVE-2026-109619 |
| PAN-OS 10.2 | >= 10.2.14 and < 10.2.16-h12 | 10.2.16-h12 or 10.2.18-h13 and later | CVE-2026-109619 |
| PAN-OS 10.2 | >= 10.2.17 and < 10.2.18-h13 | 10.2.18-h13 and later | CVE-2026-109619 |
The vendor's advisory is the authority on affected and fixed versions. If a cell says “See the vendor advisory”, check it there.
Frequently asked questions
Are these vulnerabilities actually being exploited?
Yes. CISA KEV lists both CVE-2026-109618 and CVE-2026-109619 as known exploited vulnerabilities, added on 2026-10-26. The catalog lists a due date of 2026-10-29. It marks known ransomware use as Unknown and does not establish who exploited them or how.
Do both flaws require the same PAN-OS update?
The vendor's table gives identical affected ranges and fixes for both CVE IDs. Selecting an applicable fixed release therefore addresses both entries according to that table. The exact target depends on the installed branch and version interval.
Does a critical score mean my PAN-OS system has been compromised?
No. Each vulnerability has a CVSS 4.0 score of 9.2 and a CRITICAL severity rating, which describe technical severity. CISA KEV separately confirms exploitation has occurred, but neither the score nor the catalog entry proves that a particular installation was attacked.
References
- Palo Alto Networks advisory: https://security.paloaltonetworks.com/CVE-2026-109618
- Palo Alto Networks advisory: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
- Palo Alto Networks advisory: https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
- NVD: CVE-2026-109618
- NVD: CVE-2026-109619
- CISA Known Exploited Vulnerabilities catalog
- Also reported by KISA (Korea Internet & Security Agency) on October 29, 2026: KISA advisory (Korean)
How this page is made: versions and CVE IDs come from the vendor advisory table; CVSS scores and weakness types from NVD; exploitation status only from CISA KEV. The explainer is written with AI from those facts and published only after an automated check matches every version, CVE, score and command against the sources. Commands are limited to ones in official documentation. Always follow the vendor's advisory. Read in Korean.