Palo Alto Networks Prisma Access and SD-WAN affected by PHP out-of-memory code execution (CVE-2026-109618)

What happened

CVE-2026-109618 is a flaw in PHP's out-of-memory (OOM) handling. PHP uses longjmp() to leave the current context when an OOM error occurs and abort the request. In some paths the request memory is not fully initialised before a later allocation, and the subsequent cleanup procedure can read or branch on that memory. Multiple OOM strategies can trigger the condition, leading to remote code execution.

The CVE record rates this 9.2 critical under CVSS 4.0. The vector describes an unauthenticated network-based attack with no user interaction, high attack complexity and a required set of conditions, and a successful exploit can compromise confidentiality, integrity and availability. CISA added it to the Known Exploited Vulnerabilities catalog on 26 October 2026, with a due date of 29 October 2026. Palo Alto Networks says it is not aware of malicious exploitation of this issue against its products.

Who is affected

The vulnerable component is PHP. The CVE lists PHP 8.2.* before 8.2.35, 8.3.* before 8.3.36, 8.4.* before 8.4.27 and 8.5.* before 8.5.12. Palo Alto Networks maps the issue to Prisma Access and Prisma SD-WAN ION product lines. If you run these products, check the fixed releases in the next section. Palo Alto Networks rates the impact High for its products, while the CVE record rates the underlying PHP flaw critical.

What to do now

1. Apply the vendor's fixed release if you run Palo Alto Networks affected products: Prisma Access 11.2.10-h16 or later; Prisma Access Agent 11.1.4-h38, 11.1.6-h40, 11.1.10-h36, 11.1.13-h16, or 11.1.16-h4 or later; Prisma SD-WAN ION 10.2.13-h27, 10.2.16-h12, or 10.2.18-h13 or later. If you operate PHP directly, update to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12.
2. If patching must wait, enable the vendor's threat prevention coverage. Palo Alto Networks says Frontier Virtual Patching on PAN-OS 12.2.4 and later received advance coverage through Threat ID 543004. Threat Prevention subscriptions can use that ID and the other listed Threat IDs from Applications and Threats content version 9162, 9163, 9164 or later.
3. For that coverage to inspect attacks, route incoming traffic for the MGT port through a DP port as described in Palo Alto Networks' administrative access best practices.
4. CISA's KEV entry requires applying mitigations in accordance with vendor instructions and BOD 26-04. The CISA due date is 29 October 2026.

How to detect it

Check whether affected Prisma Access or SD-WAN ION releases are still present in your estate. The vendor's guidance depends on routing management-port traffic through a data plane port; if the MGT port is directly reachable from untrusted networks, that is an exposure to review. Confirm that the relevant Applications and Threats content version is active on inspection points if you rely on Threat Prevention while patching.

Beyond the patch

Because CISA KEV lists this as exploited, detection and response are part of the response, not a follow-up. For Prisma Access and SD-WAN deployments at the network edge, confirm that affected appliances are inventoried and monitored. Our Managed Detection & Response (MDR) provides detection and response for post-exploitation activity, and Virtual CISO Services can help prioritise remediation and review exposure for internet-reachable management interfaces.