CVE-2026-0307: GlobalProtect App: Local Privilege Escalation Vulnerabilities
CVE-2026-0307
Summary
Palo Alto Networks is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619.
CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, allowing attackers to reliably achieve RCE using out-of-memory (OOM) triggers.
CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be read or branched on during subsequent requests, enabling attackers to execute arbitrary code.
Palo Alto Networks has conducted an evaluation of our product portfolio regarding this issue; a summary of the status across products is provided in the table below. We will update the below table when we get more information.
Products covered
Bridgecrew
Cloud NGFW
Cortex XDR Agent
Cortex XSOAR
Cortex Xpanse
Idira
PAN-OS
Panorama
Show 1 more products
Prisma Access
Remediation
PAN-OS
This issue will be fixed in the upcoming releases of PAN-OS. This advisory will be updated with fixed versions and release estimates as they become available.
Until PAN-OS fix versions are available we recommend implementing the workaround and mitigations listed below.
See https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/ for more details on the Palo Alto Networks product capabilities to protect against attacks that exploit this issue.
Vendor-listed fixes
Bridgecrew All
Cloud NGFW All
Cortex XDR Agent All
Cortex XSOAR All
Cortex Xpanse All
Idira All
PAN-OS None
Panorama None
Show 1 more fixes
Prisma Access All
CVEs in this advisory 2
Updates
- Published by Palo Alto Networks
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.