PAN-OS and Panorama PHP flaws: hotfixes are out, rated Critical

PAN-OS and Panorama PHP flaws: hotfixes are out, rated Critical

21 October 2026: Palo Alto Networks says every supported line of PAN-OS (12.2, 12.1, 11.2, 11.1 and 10.2) and Panorama is affected by CVE-2026-109618 and CVE-2026-109619, the critical PHP flaws fixed on 21 October, and at first gave no date for fixed releases. It first scored the impact on its products at CVSS-B 8.7 with moderate urgency, said the risk was highest where the management interface can be reached from outside, and knew of no exploitation against its products.

Not yet independently verified. Palo Alto's advisory lists fixed PAN-OS hotfixes released between 25 and 29 October 2026 and rates the flaw Critical. It gives no separate Panorama version table, and we have not seen an independent report of exploitation. We will update this when it can be confirmed, and remove this note.

Update, 10 November 2026: The fixes have shipped, and Palo Alto has raised its rating. The advisory, last updated on 29 October, shows hotfixes released from 25 to 29 October and severity and urgency raised to Critical and Highest on 27 October. One version table covers PAN-OS on PA-Series and VM-Series firewalls and Panorama, virtual and M-Series. Fixed versions are 12.2.4-h1; 12.1.4-h13, 12.1.7-h11 and 12.1.10-h3; 11.2.4-h23, 11.2.7-h23, 11.2.10-h16 (11.2.10-h17 also covers the brotli flaw), 11.2.13-h4 and 11.2.16-h1; 11.1.4-h38, 11.1.6-h40, 11.1.10-h36, 11.1.13-h16 and 11.1.16-h4; and 10.2.7-h39, 10.2.10-h42, 10.2.13-h27, 10.2.16-h12 and 10.2.18-h13. Upgrade, and keep the management interface closed to the internet on anything not yet upgraded.

What is and is not affected

Palo Alto ties the exposure to the management interface of PAN-OS and Panorama, which is why access to it decides the risk. Palo Alto lists its cloud and agent products as unaffected: Cloud NGFW, Prisma Access, Prisma Access Agent, Prisma Cloud, the GlobalProtect app, Cortex XDR Agent, XSIAM, XSOAR, Xpanse, Bridgecrew and Idira. The score drops to 7.1 where management access is limited to a jump box, against PHP's own 9.2.

Stopgaps for systems not yet upgraded

Palo Alto offered three routes while fixed versions were pending, and they still apply to any system not yet upgraded:

• Threat Prevention: customers with the subscription can enable Threat IDs 543004, 97622, 97623, 97624 and 97625, in Applications and Threats content version 9162 or later; on PAN-OS 12.2.4 or later with Advanced Threat Prevention Plus, virtual patching through Threat ID 543004 has applied since late on 20 October, Pacific time
• Inspect management traffic: route management traffic through a dataplane port, replace the inbound management certificate, decrypt it and apply threat prevention to inbound management services
• Restrict access: allow the management interface only from trusted internal addresses

The last is the cheapest and closes the most serious path, since the PHP flaws need no login. The same lesson from this month's GlobalProtect ransomware cases applies: a firewall's management plane should not answer the internet at all.

Other vendors when we first reported

Cisco published its own advisory on the PHP flaws on 21 October and updated it the next morning. At that point it rated the issue Critical and listed no products confirmed affected, with a long list still under investigation, among them Identity Services Engine, Catalyst Center, Catalyst SD-WAN Manager, Expressway, AppDynamics and Webex. Appliances with PHP-based web consoles will keep surfacing for weeks, and every one needs the same question asked of its vendor. Our PHP emergency release advisory covers the flaws themselves.

Update, 24 October 2026: Palo Alto's advisory now lists fixed PAN-OS hotfixes with estimated release dates between 26 and 30 October, for example 12.2.4-h1 (28 October), 12.1.10-h3 (30 October), 11.2.16-h1 (28 October), 11.1.16-h4 (26 October) and 10.2.18-h13 (26 October). Panorama is named as affected but has no separate versions yet. The company still says it is not aware of malicious exploitation.

Sources

• Palo Alto Networks: Impact of critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks products, 21 October 2026
• Cisco: PHP vulnerabilities affecting Cisco products, October 2026 (cisco-sa-php-october26-Jj384Daq), 22 October 2026
• Palo Alto Networks: CVE-2026-109618 advisory (updated 29 October), 29 October 2026