CVE intelligence

CVE-2026-109619

Vulnerability intelligence

Published Oct 21, 2026Sources checked Oct 21, 2026

9.2CRITICALCVSS out of 10

What this means

Review the available evidence

CVE-2026-109619 and is rated Critical severity with a CVSS score of 9.2. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Palo Alto Networks Security Advisories guidance

Vendor revision: Oct 21, 2026

Vendor remediation details

PAN-OS This issue will be fixed in the upcoming releases of PAN-OS. This advisory will be updated with fixed versions and release estimates as they become available. Until PAN-OS fix versions are available we recommend implementing the workaround and mitigations listed below. See https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/ for more details on the Palo Alto Networks product capabilities to protect against attacks that exploit this issue.

Vendor-listed releases

Bridgecrew All
Cloud NGFW All
Cortex XDR Agent All
Cortex XSOAR All
Cortex Xpanse All
GlobalProtect App All
Idira All
PAN-OS 12.2 None (ETA: TBD), 12.1 None (ETA: TBD), 11.2 None (ETA: TBD), 11.1 None (ETA: TBD), 10.2 None (ETA: TBD)
Panorama None (ETA: TBD)
Prisma Access All
Prisma Access Agent All

Ubuntu Security Notices guidance

Vendor revision: Oct 21, 2026

USN-8948-1 fixed vulnerabilities in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10.

CISA KEVNot listedBased on the latest collected catalog

EPSSUnavailableNo current score collected

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-109619?

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset.

The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized.

Multiple strategies can trigger this condition and produce remote code execution (RCE).

Source: NVD