A firewall is designed to protect an organization’s network, but vulnerabilities in its own management interface can create a serious security risk. Newly disclosed PHP remote code execution vulnerabilities have prompted Palo Alto Networks to issue security guidance for PAN-OS and Panorama, highlighting the importance of securing administrative access and responding quickly to emerging threats.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, affect PHP’s handling of certain memory-related errors. Although Palo Alto Networks has not reported malicious exploitation of these flaws against its own products, proof-of-concept exploits for the broader PHP vulnerabilities have been observed by security researchers.
For organizations that depend on network security appliances to protect critical infrastructure, the situation is a reminder that security controls must be protected and maintained just like the systems they defend.
1. Understanding the PHP Remote Code Execution Vulnerabilities
Remote code execution (RCE) vulnerabilities can allow an attacker to execute unauthorized code on a vulnerable system over a network. Depending on the affected service and its privileges, successful exploitation can potentially lead to system disruption or further compromise.
The two vulnerabilities involve PHP’s handling of exceptional conditions during memory management.
CVE-2026-109618: Improper memory handling during out-of-memory errors
This vulnerability can arise when an out-of-memory condition interrupts request processing and leaves memory in an unsafe state. Subsequent cleanup operations may interact with uninitialized memory, potentially creating a path to remote code execution.
CVE-2026-109619: References to memory that has already been released
This flaw involves references that continue pointing to memory after it has been freed. If subsequent operations use these stale references, an attacker may be able to trigger unsafe program behavior and execute code.
The underlying PHP vulnerabilities have a reported CVSS 4.0 score of 9.2. Palo Alto Networks assesses the impact on its own affected products at 8.7, classifying it as high severity.
The product-specific assessment identifies availability as the principal security impact. This means that the expected impact on PAN-OS differs from the broader potential consequences associated with remote code execution in other environments.
2. Which Palo Alto Networks Products Are Affected?
Palo Alto Networks’ advisory identifies affected versions across multiple PAN-OS release branches and Panorama deployments.
The affected environments include:
- PAN-OS 10.2
- PAN-OS 11.1
- PAN-OS 11.2
- PAN-OS 12.1
- PAN-OS 12.2
- Panorama, including virtual and M-Series deployments
The issue applies to PAN-OS software running on PA-Series and VM-Series firewalls. According to the vendor, no special configuration is required for the software to be affected.
However, the exposure is specifically associated with the management web interface, including the HTTPS administrative interface and XML API.
The vendor has stated that GlobalProtect portals and gateways, Clientless VPN, and Captive Portal are not affected by these particular vulnerabilities. Several other Palo Alto Networks products are also listed as unaffected in its advisory.
Organizations should consult the official product status and version information rather than assuming that every product in the vendor’s portfolio is vulnerable.
3. Why Exposed Management Interfaces Increase Risk
Management interfaces provide administrators with the ability to configure security policies, monitor devices, and control critical network functions. If these interfaces are accessible from untrusted networks, they can create an unnecessary attack path.
Palo Alto Networks identifies internet-accessible management interfaces as the highest-risk exposure scenario for this issue.
Potential consequences of exploiting a vulnerable management service can include:
Service disruption: Exploitation may affect the availability of a firewall or its management functions.
Administrative control risks: A compromised management environment can undermine confidence in the configuration and security posture of a network appliance.
Operational impact: Disruption to firewall administration can complicate incident response, troubleshooting, and recovery.
Broader security exposure: If a network appliance is compromised, defenders may need to investigate connected infrastructure and determine whether additional systems were affected.
These are potential risks associated with vulnerable network management services. Palo Alto Networks has stated that it is not aware of malicious exploitation of these specific vulnerabilities against its products.
4. What Should Organizations Do Immediately?
As of October 24, 2026, Palo Alto Networks has published estimated dates for several PAN-OS hotfixes, but the listed fixes are still scheduled rather than universally available. Administrators should check the latest vendor advisory before selecting a release or planning an upgrade.
Recommended immediate actions
1. Restrict access to management interfaces
Allow management access only from trusted internal IP addresses or a dedicated, secured jump host. Remove unnecessary internet exposure and review any dataplane interfaces configured with management profiles.
2. Identify affected versions
Inventory PAN-OS deployments and Panorama systems, including virtual appliances and disaster recovery environments. Compare installed versions against the vendor’s current affected-version matrix.
3. Apply the appropriate fixed release
Monitor the official advisory for confirmed hotfix availability. Once the appropriate fix is available, follow the vendor’s upgrade guidance and the organization’s change-management process.
4. Review available threat prevention protections
Palo Alto Networks has published Threat Prevention coverage for these vulnerabilities. Customers using the relevant protections should follow the vendor’s technical requirements for traffic routing, inbound certificate configuration, HTTPS decryption, and threat prevention inspection.
These requirements matter because the protective signatures may not inspect management traffic unless the environment is configured appropriately.
5. Investigate suspicious activity
Review relevant management access logs, authentication events, administrative actions, and unusual network requests. Prioritize systems whose management interfaces were exposed to the internet.
6. Preserve evidence if suspicious activity is identified
Retain logs and relevant telemetry before making significant changes. If signs of compromise are found, follow the organization’s incident response procedures and investigate whether additional systems or credentials may have been affected.
7. Validate remediation
After applying the appropriate updates, verify the installed software version, confirm that management access is restricted, and ensure that monitoring and security protections are functioning as expected.
Temporary access restrictions and threat prevention measures can reduce exposure, but they should not be treated as substitutes for installing the vendor’s permanent fix.
5. Lessons for Network Security and Vulnerability Management
This incident highlights several broader lessons for security teams responsible for enterprise infrastructure.
Administrative services need additional protection. Management interfaces should not be treated like ordinary user-facing services. They require strict access controls, limited exposure, and continuous monitoring.
Asset inventories must be accurate. Organizations need to know which software versions are deployed, where they are running, and which interfaces are accessible from external networks.
Patch planning should be risk-based. Vulnerability severity is important, but exposure, asset criticality, available mitigations, and operational impact should also guide remediation priorities.
Security controls must be validated. Having a threat prevention subscription or firewall policy does not automatically guarantee protection. Teams must confirm that the necessary traffic inspection and configuration requirements are satisfied.
Incident response must include network appliances. Firewalls and other security products are critical infrastructure assets. Response plans should cover the investigation, containment, recovery, and validation of these devices.
6. Which Industries Should Pay Attention?
The risks associated with vulnerable network management interfaces extend across sectors that rely on secure and highly available infrastructure.
- Financial services: Protect network security appliances supporting banking platforms, payment systems, and sensitive customer information.
- Healthcare: Maintain the availability and security of network infrastructure supporting clinical systems and patient services.
- Manufacturing and energy: Reduce the risk of disruption to enterprise networks and infrastructure supporting operational environments.
- Government: Strengthen administrative access controls and maintain documented vulnerability remediation procedures.
- Technology and managed service providers: Review management exposure across customer environments and ensure consistent patching and monitoring practices.
Organizations should evaluate their actual deployments and exposure rather than assuming that the same risk applies uniformly to every environment.
Conclusion: Secure the Security Infrastructure
The PHP remote code execution vulnerabilities affecting PAN-OS and Panorama demonstrate why organizations must protect the management interfaces of their own security infrastructure.
Although Palo Alto Networks has not reported malicious exploitation of these vulnerabilities against its products, the availability of proof-of-concept exploits for the broader PHP flaws reinforces the importance of acting promptly.
Security teams should restrict management access, verify affected software versions, monitor vendor updates, apply the appropriate fixes when available, and investigate suspicious activity.
A strong cybersecurity strategy does not rely on firewalls alone. It requires secure administration, proactive vulnerability management, validated defensive controls, and continuous improvement.
Protecting the systems that protect your organization is an essential part of building cyber resilience.
About COE Security
COE Security partners with organizations in financial services, healthcare, retail, manufacturing, and government to secure AI-powered systems and ensure compliance.
Our offerings include:
- AI-enhanced threat detection and real-time monitoring
- Data governance aligned with GDPR, HIPAA, and PCI DSS
- Secure model validation to guard against adversarial attacks
- Customized training to embed AI security best practices
- Penetration Testing (Mobile, Web, AI, Product, IoT, Network & Cloud)
- Secure Software Development Consulting (SSDLC)
- Customized CyberSecurity Services
Follow COE Security on LinkedIn for ongoing insights into safe, compliant AI adoption.
COE Security helps organizations identify vulnerabilities, assess network and application security, evaluate exposure, and strengthen incident response capabilities. Our penetration testing, security consulting, and compliance-focused services support organizations in identifying weaknesses and improving their overall security posture.
Follow COE Security on LinkedIn for timely cybersecurity updates, practical security guidance, and insights to help your organization stay informed and cyber safe.
Click to read our LinkedIn feature article