Exploited vulnerabilityWed, 28 Oct 2026
Exploited PAN-OS management interfaces: restrict access and patch by release branch
Palo Alto Networks observed exploitation targeting exposed management interfaces. Restrict access to the web UI and XML API, preserve evidence and apply the correct fix.
Article
Palo Alto Networks updated its advisory on October 27. It scores the appliance-specific impact of PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 at CVSS v4.0 9.2. The advisory covers PA-Series, VM-Series and Panorama, including virtual and M-Series deployments.
An attacker needs access to the affected management interface. Check the vendor’s branch-specific hotfix table and upgrade sequence for HA and Panorama.
- 01
Reach a vulnerable web UI or XML API
- 02
Trigger the PHP memory flaw and potentially execute code without signing in
- 03
Access or modify rules, configuration, API keys or other management credentials
- 01
Restrict sources and preserve evidence
Limit access to the web UI and XML API. Isolate suspected compromises as appropriate and preserve logs.
See what to doResources: 1
TWISA member solutions
Restrict sources and preserve evidence
Limit access to the web UI and XML API. Isolate suspected compromises as appropriate and preserve logs.
- 02
Update affected appliances
Verify the installed release, available hotfix and HA or Panorama upgrade order.
See what to doResources: 1
TWISA member solutions
Update affected appliances
Verify the installed release, available hotfix and HA or Panorama upgrade order.
- 03
Investigate configuration and management credentials
Check accounts, API keys, rules and unusual connections. Revoke or rotate credentials based on evidence.
See what to doResources: 1
TWISA member solutions
Investigate configuration and management credentials
Check accounts, API keys, rules and unusual connections. Revoke or rotate credentials based on evidence.
- 04
Recover from a trusted baseline and retest
Follow vendor recovery guidance. Verify access restrictions, running versions and business functions.
See what to doResources: 1
TWISA member solutions
Recover from a trusted baseline and retest
Follow vendor recovery guidance. Verify access restrictions, running versions and business functions.
Allow authorized traffic and apply controls at each layer.
- 01
Restrict sources and preserve evidence
Limit access to the web UI and XML API. Isolate suspected compromises as appropriate and preserve logs.
- 02
Update affected appliances
Verify the installed release, available hotfix and HA or Panorama upgrade order.
- 03
Investigate configuration and management credentials
Check accounts, API keys, rules and unusual connections. Revoke or rotate credentials based on evidence.
Feed logs and traffic data from each layer into monitoring and response.
- Recover from a trusted baseline and retestFollow vendor recovery guidance. Verify access restrictions, running versions and business functions.
TWISA member solutions
Restrict sources and preserve evidence
Limit access to the web UI and XML API. Isolate suspected compromises as appropriate and preserve logs.
Update affected appliances
Verify the installed release, available hotfix and HA or Panorama upgrade order.
Investigate configuration and management credentials
Check accounts, API keys, rules and unusual connections. Revoke or rotate credentials based on evidence.
Recover from a trusted baseline and retest
Follow vendor recovery guidance. Verify access restrictions, running versions and business functions.
Sources and further reading
Alert updated: 2026/10/29. Check the vendor’s latest guidance for product support and patch status.