CVE-2026-109619

RCE via stale global state

View on CVE.org
Published Oct 21, 2026 CVSS 4.0 · 9.2 Critical EPSS 100.0% KEV · Listed
Description
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

Remediation

Vendor Workaround

Check the GitHub Security Advisory for mitigation strategies.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4848-1 php8.2 security update
Debian DSA Debian DSA DSA-6574-1 php8.4 security update
Ubuntu USN Ubuntu USN USN-8948-1 PHP vulnerabilities
Ubuntu USN Ubuntu USN USN-8948-2 PHP vulnerabilities
History
Type Values Removed Values Added
First Time appeared Siemens amis Ts
Siemens blueplanet 360 Nx3 M6 Wm Od Iisx
Siemens blueplanet 360 Nx3 M6 Wm Od Iisx-s
Siemens blueplanet 360 Nx3 M6 Wm Od Iisx-s Firmware
Siemens blueplanet 360 Nx3 M6 Wm Od Iisx Firmware
Siemens energy Engage
Siemens spectrum Power 3
Siemens spectrum Power 4
Siemens spectrum Power 7
Siemens spectrum Power Tg
CPEs cpe:2.3:a:siemens:amis_ts:-:*:*:*:*:*:*:*
cpe:2.3:a:siemens:energy_engage:2.0:service_pack9:*:*:*:*:*:*
cpe:2.3:a:siemens:energy_engage:3.1:service_pack1:*:*:*:*:*:*
cpe:2.3:a:siemens:spectrum_power_3:-:*:*:*:*:*:*:*
cpe:2.3:a:siemens:spectrum_power_4:-:*:*:*:*:*:*:*
cpe:2.3:a:siemens:spectrum_power_7:-:*:*:*:*:*:*:*
cpe:2.3:a:siemens:spectrum_power_tg:-:*:*:*:*:*:*:*
cpe:2.3:h:siemens:blueplanet_360_nx3_m6_wm_od_iisx-s:-:*:*:*:*:*:*:*
cpe:2.3:h:siemens:blueplanet_360_nx3_m6_wm_od_iisx:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:blueplanet_360_nx3_m6_wm_od_iisx-s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:blueplanet_360_nx3_m6_wm_od_iisx_firmware:-:*:*:*:*:*:*:*
Vendors & Products Siemens amis Ts
Siemens blueplanet 360 Nx3 M6 Wm Od Iisx
Siemens blueplanet 360 Nx3 M6 Wm Od Iisx-s
Siemens blueplanet 360 Nx3 M6 Wm Od Iisx-s Firmware
Siemens blueplanet 360 Nx3 M6 Wm Od Iisx Firmware
Siemens energy Engage
Siemens spectrum Power 3
Siemens spectrum Power 4
Siemens spectrum Power 7
Siemens spectrum Power Tg
Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Metrics kev

{'dateAdded': '2026-10-26T00:00:00+00:00', 'dueDate': '2026-10-29T00:00:00+00:00'}
Type Values Removed Values Added
First Time appeared Paloaltonetworks
Paloaltonetworks pan-os
Paloaltonetworks panorama M-200
Paloaltonetworks panorama M-300
Paloaltonetworks panorama M-500
Paloaltonetworks panorama M-600
Paloaltonetworks panorama M-700
Paloaltonetworks panorama Virtual Appliance
Paloaltonetworks wf-500
Paloaltonetworks wf-500-b
Siemens
Siemens ruggedcom Ape1808
Siemens ruggedcom Ape1808 Firmware
CPEs cpe:2.3:a:paloaltonetworks:panorama_virtual_appliance:-:*:*:*:*:*:*:*
cpe:2.3:h:paloaltonetworks:panorama_m-200:-:*:*:*:*:*:*:*
cpe:2.3:h:paloaltonetworks:panorama_m-300:-:*:*:*:*:*:*:*
cpe:2.3:h:paloaltonetworks:panorama_m-500:-:*:*:*:*:*:*:*
cpe:2.3:h:paloaltonetworks:panorama_m-600:-:*:*:*:*:*:*:*
cpe:2.3:h:paloaltonetworks:panorama_m-700:-:*:*:*:*:*:*:*
cpe:2.3:h:paloaltonetworks:wf-500-b:-:*:*:*:*:*:*:*
cpe:2.3:h:paloaltonetworks:wf-500:-:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_ape1808:-:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:-:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h10:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h11:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h12:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h13:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h14:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h17:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h18:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h1:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h21:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h27:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h2:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h30:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h31:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h36:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h37:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h39:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h3:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h40:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h41:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h4:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h5:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h6:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h7:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h8:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h9:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h10:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h15:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h16:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h18:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h1:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h21:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h22:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h23:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h24:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h26:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h2:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h3:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h4:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h5:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h7:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.14:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.15:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h10:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h11:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h1:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h4:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h6:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h7:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h8:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h9:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.17:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h10:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h12:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h1:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h5:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h6:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h7:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h8:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h9:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h10:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h11:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h12:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h13:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h14:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h15:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h16:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h17:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h18:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h19:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h1:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h20:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h21:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h22:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h23:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h24:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h2:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h32:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h34:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h35:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h36:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h37:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h38:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h3:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h4:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h5:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h6:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h7:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h8:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h9:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h10:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h12:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h1:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h21:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h25:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h26:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h27:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h28:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h30:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h32:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h33:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h35:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h4:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h5:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h7:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h9:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.11:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.12:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h10:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h11:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h12:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h15:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h1:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h2:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h3:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h5:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h6:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h7:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h8:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h9:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.14:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.15:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.16:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.16:h1:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.16:h2:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.16:h3:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h10:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h11:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h12:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h13:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h15:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h16:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h17:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h18:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h1:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h25:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h27:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h2:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h32:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h33:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h34:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h35:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h36:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h37:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h3:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h4:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h5:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h6:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h7:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h8:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h9:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.5:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h10:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h14:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h17:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h18:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h19:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h1:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h20:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h21:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h22:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h23:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h25:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h29:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h2:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h32:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h33:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h34:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h35:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h36:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h38:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h39:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h3:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h4:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h5:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h6:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h7:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:h10:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:h11:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:h1:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:h2:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:h4:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:h6:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:h8:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.8:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.9:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h10:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h12:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h13:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h1:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h2:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h3:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h4:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h5:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h6:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h7:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h8:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h9:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.11:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.12:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.13:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.13:h1:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.13:h2:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.13:h3:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.15:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.16:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h10:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h11:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h12:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h14:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h15:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h17:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h18:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h1:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h20:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h2:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h3:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h4:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h5:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h6:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h7:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h8:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h9:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.5:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.6:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h10:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h11:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h12:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h13:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h14:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h15:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h16:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h17:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h18:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h19:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h1:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h2:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h3:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h4:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h7:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h8:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.8:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.9:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:12.1.10:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:12.1.10:h2:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h10:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h11:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h12:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h2:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h3:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h5:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h6:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h7:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h8:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h9:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:12.1.5:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:12.1.6:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:12.1.7:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:12.1.7:h1:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:12.1.7:h2:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:12.1.7:h3:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:12.1.7:h5:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:12.1.7:h6:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:12.1.7:h8:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:12.1.7:h9:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:12.1.8:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:12.1.9:-:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:12.2.4:-:*:*:*:*:*:*
cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:*:*:*:*:*:*:*
Vendors & Products Paloaltonetworks
Paloaltonetworks pan-os
Paloaltonetworks panorama M-200
Paloaltonetworks panorama M-300
Paloaltonetworks panorama M-500
Paloaltonetworks panorama M-600
Paloaltonetworks panorama M-700
Paloaltonetworks panorama Virtual Appliance
Paloaltonetworks wf-500
Paloaltonetworks wf-500-b
Siemens
Siemens ruggedcom Ape1808
Siemens ruggedcom Ape1808 Firmware
Type Values Removed Values Added
References
Type Values Removed Values Added
References
Type Values Removed Values Added
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
First Time appeared Redhat
Redhat enterprise Linux
Redhat hummingbird
CPEs cpe:/a:redhat:enterprise_linux:8
cpe:/a:redhat:enterprise_linux:9
cpe:/a:redhat:hummingbird:1
cpe:/o:redhat:enterprise_linux:10.2
Vendors & Products Redhat
Redhat enterprise Linux
Redhat hummingbird
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
References
Type Values Removed Values Added
References
Type Values Removed Values Added
References
Type Values Removed Values Added
First Time appeared Php
Php php
CPEs cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Vendors & Products Php
Php php
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Title RCE via stale global state
Weaknesses CWE-1325
CWE-1419
CWE-416
CWE-755
CWE-824
References
Metrics cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}
Earlier changes (10)
Weaknesses

Sources

Status
PUBLISHED
Assigner
php
Published
Updated
Nov 5, 2026, 6:17 PM
Reserved
Oct 12, 2026, 9:04 PM

View source JSON

Updated
Oct 23, 2026, 2:07 PM

JSON

Status
Analyzed
Published
Oct 21, 2026, 2:17 PM
Modified
Nov 5, 2026, 7:17 PM

View source JSON

Severity
Important
Public date
Oct 21, 2026, 2:00 PM

View source Bugzilla JSON

Updated
Oct 27, 2026, 8:00 AM

JSON