CVE-2026-109619CWE-1325CWE-416CWE-755CWE-824

CVE-2026-109619

High · published October 21, 2026

CVSS v3.1
8.1
EPSS
6%
Percentile
93.0
In the wild
Unconfirmed
What it is

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.2 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.05757 · 93.0th percentile
Weaknesses
CWE-1325 · Improperly Controlled Sequential Memory Allocation; CWE-416 · Use After Free; CWE-755 · Improper Handling of Exceptional Conditions; CWE-824 · Access of Uninitialized Pointer
Published
2026-10-21T18:17Z
Affected products (298)
ProductVersionsFixed in
php/php≥ 5.4.0, < 8.2.358.2.35
php/php≥ 8.3.0, < 8.3.368.3.36
php/php≥ 8.4.0, < 8.4.278.4.27
php/php≥ 8.5.0, < 8.5.128.5.12
siemens/ruggedcom_ape1808_firmwareall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-os≥ 10.2.0, < 10.2.710.2.7
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-os≥ 11.1.0, < 11.1.411.1.4
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-os≥ 11.2.0, < 11.2.411.2.4
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-os≥ 12.1.0, < 12.1.412.1.4
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-os≥ 12.2.0, < 12.2.412.2.4
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/panorama_virtual_applianceall versions—
paloaltonetworks/pan-osall versions—
References (14)
EPSS history
Timeline
  • 23 OCT 03:54Z
    EPSS moved — → 6%
    epss
  • 21 OCT 13:54Z
    RCE via stale global state
    cvelistv5
  • 21 OCT 13:54Z
    RCE via stale global state
    cvelistv5