Palo Alto Networks Assesses PHP RCE Risk in PAN-OS and Panorama
Tech GuruQuick Answer
Palo Alto Networks published an initial advisory for CVE-2026-109618 and CVE-2026-109619 affecting all PAN-OS and Panorama versions. Fixed releases are pending; restrict management access, verify virtual-patching or IPS content, monitor logs, and retain evidence for follow-up remediation.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory PAN-OS and Panorama versions, management exposure, access paths, security content, owners, and maintenance windows; restrict the management plane; deploy applicable detection or prevention content; monitor vendor updates; review logs; and retain evidence.
Last verified: 2026-10-21 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | PAN-OS and Panorama |
|---|---|
| Advisory | Palo Alto Networks CVE-2026-109618 / GHSA-w8hw-w9fx-j79w / GHSA-6wmf-4rv5-p3rp |
| CVEs | CVE-2026-109618, CVE-2026-109619 |
| Authoritative release date | 2026-10-21 16:00:00 UTC |
| Authority revision date | 2026-10-21 16:00:00 UTC |
| Affected versions | All PAN-OS and Panorama versions according to the initial Palo Alto Networks advisory; the vendor lists its other evaluated product families as unaffected. |
| Fixed version | Fixed PAN-OS versions were not yet available at publication; restrict management-interface access to trusted internal addresses or a controlled jump box and apply vendor virtual-patching or IPS coverage while awaiting supported releases. |
| CVSS base score | 8.7 (CVSS v4.0) |
| CVSS severity | High |
| Exploitation status | Palo Alto Networks states that it is not aware of malicious exploitation against its products.; no exploitation claim is inferred. |
What Changed
Palo Alto Networks assessed the two critical PHP flaws as affecting all PAN-OS and Panorama versions. The vendor scores its product impact at CVSS 8.7 and says fixed PAN-OS releases are forthcoming; it provides management-interface restrictions and security-content coverage as interim controls.
What To Validate Now
- Inventory. Identify PAN-OS and Panorama systems, exact versions, management-interface reachability, administrative access paths, external exposure, installed Threat and ATP content, owners, and change windows.
- Establish applicability. Treat all PAN-OS and Panorama versions as affected under the initial advisory. Do not infer that other Palo Alto Networks product families are affected when the vendor table marks them unaffected.
- Remediate. Restrict management access to trusted internal addresses or a controlled jump box, deploy applicable Frontier Virtual Patching or ATP/IPS coverage, monitor the advisory, and install the supported fixed PAN-OS release when published.
- Validate. Confirm management-plane reachability and policy from an external vantage point, verify security-content versions and enforcement, review management and threat logs, document exceptions, and retain evidence for the later software update.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
No fixed PAN-OS versions were available in the initial advisory, so the workaround reduces exposure but does not resolve the vulnerable software. Palo Alto Networks says it is not aware of malicious exploitation against its products.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
