CVE intelligence

CVE-2026-109618

Vulnerability intelligence

Published Oct 21, 2026Sources checked Oct 21, 2026

9.2CRITICALCVSS out of 10

What this means

Review the available evidence

CVE-2026-109618 and is rated Critical severity with a CVSS score of 9.2. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Palo Alto Networks Security Advisories guidance

Vendor revision: Oct 21, 2026

Vendor remediation details

PAN-OS This issue will be fixed in the upcoming releases of PAN-OS. This advisory will be updated with fixed versions and release estimates as they become available. Until PAN-OS fix versions are available we recommend implementing the workaround and mitigations listed below. See https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/ for more details on the Palo Alto Networks product capabilities to protect against attacks that exploit this issue.

Vendor-listed releases

Bridgecrew All
Cloud NGFW All
Cortex XDR Agent All
Cortex XSOAR All
Cortex Xpanse All
GlobalProtect App All
Idira All
PAN-OS 12.2 None (ETA: TBD), 12.1 None (ETA: TBD), 11.2 None (ETA: TBD), 11.1 None (ETA: TBD), 10.2 None (ETA: TBD)
Panorama None (ETA: TBD)
Prisma Access All
Prisma Access Agent All

Ubuntu Security Notices guidance

Vendor revision: Oct 21, 2026

USN-8948-1 fixed vulnerabilities in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10.

CISA KEVNot listedBased on the latest collected catalog

EPSSUnavailableNo current score collected

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-109618?

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation.

The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Source: NVD