PatchTheCEVpan-os vulnerabilities and fixes
Recent CVEs affecting pan-os, with upgrade or downgrade steps. 3 tracked.
pan-os has 3 tracked vulnerabilities, 1 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 3. Most recent: 2026-10-21. Highest priority: CVE-2026-109618 (score 71/100).
- CVE-2026-109618 CRITICAL 9.8 UPGRADE MITIGATE PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the reques
- CVE-2026-109619 HIGH 8.1 UPGRADE MITIGATE PHP has various global state that temporarily points into request memory
- CVE-2026-0322 HIGH 7.2 EXPLOITED UPGRADE Palo Alto Networks PAN-OS Code Injection Vulnerability
FAQ
How do I fix pan-os vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is pan-os being exploited right now?
Yes: 1 pan-os CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.
Which pan-os CVE should I patch first?
CVE-2026-109618 currently ranks highest (71/100): PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the reques.