1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)
Initial AccessExploit Public-Facing Application
Initial Access TA0001
T1190Exploit Public-Facing Application×1
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Palo Alto Networks' advisory of 2026-10-21 lists every release of PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2 and of Panorama as affected by CVE-2026-109618 and CVE-2026-109619, with no fixed build released (Palo Alto Networks, 2026-10-21); the revision of 2026-10-23 adds the WildFire appliances WF-500 and WF-500-B, all versions, gives estimated dates from 2026-10-26 to 2026-10-30 for hotfix builds of every PAN-OS train, leaves Panorama and WF-500 undated, and notes that Cortex XCORE (SaaS) and WildFire Cloud were remediated on 2026-10-21 and 2026-10-22 (Palo Alto Networks, 2026-10-23). The two flaws are the unauthenticated remote-code-execution bugs in the PHP runtime that the PHP project fixed in its releases of the same day (PHP, 2026-10-21). Palo Alto says no special configuration is required to be affected, that the issue strictly affects the management web interface, which includes the HTTPS web UI and the XML API service, and that a dataplane interface is affected only where a management profile is attached to it (Palo Alto Networks, 2026-10-21). It states that the GlobalProtect portal and gateway and the captive portal are not impacted (Palo Alto Networks, 2026-10-21).
Palo Alto describes the flaws as remote code execution but scores their impact on its own product CVSS-B 8.7 (severity high, urgency moderate), with high availability impact and none on confidentiality or integrity, against a vendor-level 9.2 with high impact on all three, and says the risk is highest where management access is allowed from external addresses on the internet; restricting management to a single jump box lowers its rating to 7.1, and it is not aware of any malicious exploitation against its products (Palo Alto Networks, 2026-10-21). Unit 42 says it has seen proof of concept of the PHP flaws (Unit 42, 2026-10-21). Until fixes ship, Palo Alto recommends restricting management access to trusted internal addresses and offers Threat Prevention coverage (Threat IDs 543004, 97622, 97623, 97624 and 97625, Applications and Threats content version 9162 and later) that applies only when management traffic is routed through a dataplane interface, the certificate for inbound management traffic has been replaced, and threat prevention is enabled on that traffic (Palo Alto Networks, 2026-10-21).
This issue strictly affects the management web interface, which includes the HTTPS web UI and XML API service.
This issue will be fixed in the upcoming releases of PAN-OS.
Palo Alto Networks is not aware of any malicious exploitation of this issue against our products.
No special configuration is required to be affected by this issue.
Palo Alto Networks revised its advisory on 2026-10-23: the WildFire appliances WF-500 and WF-500-B are now listed as affected in all versions, and the footnotes say Cortex XCORE (SaaS) was remediated on 2026-10-21 and WildFire Cloud on 2026-10-22 (Palo Alto Networks, 2026-10-23). The advisory now also gives estimated availability dates for hotfix builds of every supported PAN-OS train, from 2026-10-26 (for example 10.2.18-h13, 11.1.16-h4 and 11.2.10-h16) to 2026-10-30, while Panorama and the WildFire appliances remain with no date (Palo Alto Networks, 2026-10-23). Palo Alto still states that it is not aware of malicious exploitation against its products, and the Threat Prevention coverage and the jump-box restriction are unchanged (Palo Alto Networks, 2026-10-23). The advisory names the management web interface only for PAN-OS and does not say which interface of the WildFire appliances is reachable.