#paloaltonetworks

Read Time:3 Minute, 49 Second

Palo Alto Networks has published an advisory confirming that a critical vulnerability in the open-source Brotli compression library reaches into some of its PAN-OS firewall deployments, along with a companion tool used in its Prisma Cloud offering. The flaw, tracked as CVE-2026-111497, carries a severity score of 9.2 out of 10 — putting it firmly in critical territory, even though Palo Alto itself has only assigned the issue moderate response urgency internally.

What the Bug Actually DoesThe root cause sits inside decode.c, part of Google’s Brotli decompression engine. A specially crafted compressed data stream can trigger what’s known as an out-of-bounds write — essentially tricking the decoder into writing data past the boundary of the memory buffer it’s supposed to stay inside. Depending on how that memory gets overwritten, the consequences can range from corrupting unrelated data and crashing a service, to exposing sensitive information, to a worst-case scenario of unauthenticated remote code execution.

Google has already shipped fixed versions of the underlying Brotli library — 1.0.10, 1.1.1, and 1.2.1, depending on the release branch — but because Brotli is embedded inside a wide range of downstream software, each vendor that bundled a vulnerable copy has to ship its own fix separately. This isn’t the first product caught up in the fallout: Node.js previously issued security updates addressing the same decoder flaw, underscoring how a single open-source dependency bug can ripple across unrelated products for weeks.

Who’s Actually ExposedFor PAN-OS customers, exposure isn’t universal — it depends entirely on configuration. A firewall is only at risk if both of the following are true:

Brotli traffic inspection is enabled on the dataplane (the component that actually processes network traffic)

TLS/SSL decryption is also enabled, since that’s what exposes the compressed content to inspection in the first place

Critically, Brotli inspection ships disabled by default and isn’t even supported on PAN-OS versions before 11.2.4. That means PAN-OS 11.1 and 10.2 branches are unaffected entirely, as are Panorama and M-Series management appliances. The firewall’s management web interface and API are also outside the blast radius — this is strictly a dataplane traffic-inspection issue.

Administrators running PAN-OS 11.2.4 or later can check their exposure directly with the command show system setting brotli. A result of Enabled: yes means Brotli inspection is active, though TLS/SSL decryption still needs to be confirmed separately to fully assess risk.

Workarounds Available Now, Patches Coming LaterBecause official hotfixes won’t be available until October 27–30 at the earliest, Palo Alto is urging customers to mitigate immediately rather than wait. The recommended workaround depends on the PAN-OS version:

Via CLI: run set system setting brotli-encoding disable, then confirm with show system setting brotli that it now reports Enabled: no

On PAN-OS 12.1.2 and later: navigate to Device > Setup > Content-ID, clear the “Allow Brotli Encoding” option, and commit the change

Customers subscribed to Threat Prevention get an additional, partial layer of coverage through Threat ID 97686, included in Applications and Threats content version 9165 or later — but Palo Alto is explicit that this signature-based protection is conditional on specific traffic routing, decryption, and policy settings, and should not be treated as a substitute for disabling the feature outright.

The planned hotfix builds span a wide swath of the PAN-OS release tree, including 12.2.4-h1, 12.1.4-h13, 12.1.10-h3, 11.2.4-h23, 11.2.10-h17, and 11.2.16-h1, among others. Palo Alto flags one easy-to-miss detail: 11.2.10-h16 only resolves a separate, unrelated PHP issue — it’s 11.2.10-h17 that adds the Brotli fix, so teams tracking build numbers should double-check they’re grabbing the right one.

Prisma Cloud Users Also AffectedOutside the firewall line, Palo Alto’s Prisma Cloud Application Security Transporter Client also ships a vulnerable Brotli copy and needs to be upgraded to version 0.2.9 or later. The company says several of its own cloud services — including ADEM, Cloud Identity Engine, Hub, and Prisma AIRS Gateway — have already been remediated on the backend, requiring no customer action.

With no confirmed exploitation in the wild but a critical severity score and a multi-day gap before official patches land, the practical move for affected organizations is straightforward: disable Brotli inspection now, verify the setting took effect, and schedule the hotfix once it’s confirmed available for the specific build in use.

Read Time:3 Minute, 58 Second

Palo Alto Networks has confirmed that a pair of critical remote-code-execution flaws in the PHP language runtime extend into its own PAN-OS firewall software and Panorama management platform, and that fixes won’t be fully available for roughly a week after the advisory update.

The two issues, tracked as CVE-2026-109618 and CVE-2026-109619, stem from how PHP handles severe internal errors through a function called longjmp(), which abruptly jumps program execution back to an earlier saved checkpoint. When that jump happens at the wrong moment, it can leave stale or uninitialized memory behind — memory that a later part of the program may then act on, opening a path for an attacker to run their own code.

Two Related but Distinct FlawsCVE-2026-109618 is triggered when the server runs out of memory partway through handling a request, leaving that request’s memory in an incomplete state. If cleanup routines later operate on that incomplete memory, an attacker who can reliably force memory exhaustion may be able to turn the resulting instability into remote code execution.

CVE-2026-109619 is a related but separate issue involving global memory references that continue pointing at memory after it has already been freed. A subsequent request that reads or acts on one of those dangling references can again give an attacker a route to execute arbitrary code.

Both flaws trace back to the broader PHP vulnerability research effort published under the name “PHP2Shell,” which carries a CVSS v4.0 base score of 9.2. Palo Alto has assessed its own product-specific exposure slightly lower, at 8.7, and notes that for its products the primarily affected security property is availability rather than confirmed data theft or configuration tampering — though the company is careful to frame that as the current assessment, not a guarantee against more severe impact.

Scope: Management Interfaces, Not GlobalProtectAccording to the updated advisory, the vulnerable surface is limited to PAN-OS management interfaces — the HTTPS administrative console and the XML API — rather than the data-plane components most organizations expose to end users. A dataplane interface is only affected if it has a management profile explicitly attached to it. Notably, GlobalProtect portals and gateways, Clientless VPN, and Captive Portal are all listed as unaffected, which should reduce panic for organizations whose remote-access infrastructure runs through those services.

Affected branches span a wide swath of PAN-OS releases, including 10.2, 11.1, 11.2, 12.1, and 12.2, running on PA-Series and VM-Series firewalls, as well as Panorama (including virtual and M-Series deployments). No unusual configuration is required to be vulnerable — any device on an affected branch with its management interface reachable is a candidate for exploitation.

Two cloud-delivered products, Cortex XCORE SaaS and WildFire Cloud, were also affected but have already received fixes, delivered on October 21 and October 22 respectively. Cloud NGFW, Cortex XDR, Cortex XSIAM, Prisma Cloud, Prisma Access, and the GlobalProtect App are all currently listed as unaffected by this issue.

Patches Are Still ComingAs of the October 24 advisory update, Palo Alto said it has no evidence of malicious exploitation against its own products — but that comes with an important caveat: security researchers at Unit 42 have already observed proof-of-concept exploit code circulating for the broader PHP2Shell vulnerabilities, meaning the gap between disclosure and active abuse could close quickly.

Firmware fixes are still on a rolling schedule rather than available today. The earliest hotfixes — versions 10.2.18-h13, 11.1.16-h4, and 11.2.10-h16 — are estimated for October 26, with PAN-OS 12.2.4-h1 targeted for October 28 and additional hotfixes planned through October 30. Palo Alto has emphasized that these dates are estimates and may shift.

What Administrators Should Do NowRestrict access to PAN-OS and Panorama management interfaces to trusted internal IP ranges or a dedicated jump host — internet-facing management interfaces represent the highest-risk configuration.

Where possible, enable Threat Prevention coverage for this issue, which Palo Alto has tied to signature 543004 and subsequent content updates (versions 9162 through 9164 and later). Doing so requires routing management traffic through a dataplane port, configuring an inbound certificate, and enabling HTTPS decryption and inspection.

Track each affected device’s specific hotfix path against Palo Alto’s advisory and Unit 42’s threat brief, since release timing varies by branch.

Treat access restrictions as a stopgap, not a substitute for installing the fixed release once it becomes available for each platform.

The disclosure is a reminder that vulnerabilities in widely used runtimes like PHP don’t stay contained to web applications — they can resurface inside the management stacks of the very security appliances organizations rely on to keep attackers out.

Read Time:3 Minute, 27 Second

Palo Alto Networks has disclosed an actively exploited PAN-OS vulnerability that can give a privileged attacker root-level code execution on affected firewalls. The flaw, tracked as CVE-2026-0322, targets the management interface and has received a CVSS 4.0 score of 8.6. The company describes observed exploitation as very limited, but has assigned its highest remediation urgency and advises customers to upgrade without delay.

The disclosure matters because a firewall is a central enforcement point for network traffic. Root access to the appliance can give an intruder exceptional visibility and control, potentially allowing configuration changes, persistence, or interference with security monitoring. Palo Alto Networks has not attributed the activity or said how many organizations were targeted.

How the PAN-OS flaw worksCVE-2026-0322 is a code-injection weakness classified as CWE-94. Exploitation requires network access to the PAN-OS management interface as well as an authenticated account with high privileges. A successful attacker can execute code as root without further user interaction.

Those prerequisites make this different from an unauthenticated internet-wide compromise. However, they do not make the issue harmless. Stolen administrator credentials, an insider, or an attacker who has already established a foothold could use the bug to turn limited access into full control of a security appliance. Internet-exposed management interfaces face the clearest risk.

Affected platforms include PA-Series hardware firewalls, VM-Series virtual firewalls, and Panorama on virtual systems or M-Series appliances. Palo Alto Networks says Cloud NGFW and Prisma Access are not affected. No unusual configuration is required for a vulnerable installation to be exposed to the weakness.

Fixed releases and affected branchesCustomers should consult the vendor advisory for the exact upgrade path for their branch. Fixed releases identified by Palo Alto Networks include:

PAN-OS 12.2.4;

PAN-OS 12.1.10-h2;

PAN-OS 11.1.16-h3;

PAN-OS 10.2.18-h12;

selected 11.2 hotfixes, including 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, and 11.2.13-h3.

The vendor says there is no workaround that eliminates the flaw. Restricting the management interface to trusted internal addresses and reaching it through a hardened jump host can reduce exposure, but those controls are not substitutes for installing a corrected build.

Before upgrading, operators should back up the current configuration and follow the normal high-availability sequence so paired devices do not lose protection at the same time. Afterward, verify the reported software version, confirm that policy synchronization and traffic processing are healthy, and record the change in the asset inventory. Any appliance that cannot be patched immediately should have management access reduced to the narrowest possible set of source addresses and monitored continuously until remediation is complete.

What defenders should investigatePalo Alto Networks linked three IP addresses to threat activity and limited exploit attempts: 66[.]42[.]72[.]14, 208[.]83[.]239[.]114, and 149[.]248[.]47[.]234. Security teams should search firewall management and upstream network logs for connections involving those addresses, while remembering that attackers can change infrastructure and that an indicator match is not required for compromise.

Defenders should also review administrator logins, unexpected configuration changes, newly created accounts, unusual processes, and management traffic from hosts that do not normally administer the appliance. Where possible, compare local evidence with independent logging because an attacker operating as root may be able to alter records on the device.

Priorities for firewall ownersOrganizations should inventory every physical firewall, virtual instance, and Panorama deployment, including disaster-recovery and lab systems that may still be reachable. Confirm the running version rather than relying on asset records, then apply the vendor-recommended fixed release. Management access should be limited to a small group of dedicated administrative systems protected with strong authentication.

Finally, teams should treat patching and compromise assessment as parallel tasks. Installing an update closes the known route but does not prove that earlier exploitation did not occur. Because the vulnerable component protects the network itself, any suspicious evidence deserves a broader incident-response review of credentials, configurations, and traffic that passed through the device.

Read Time:3 Minute, 19 Second

Ransomware operators are exploiting an authentication bypass in Palo Alto Networks’ remote-access products to enter corporate environments through connections that can resemble ordinary employee VPN traffic. The flaw, tracked as CVE-2026-0257, affects certain configurations of PAN-OS GlobalProtect and Prisma Access and has reportedly been used by groups including Qilin and Settra.

The activity raises the stakes beyond a conventional perimeter vulnerability. Once an unauthorized session is established through an organization’s own VPN infrastructure, subsequent traffic inherits a degree of trust. Attackers can use that position to seek credentials, map the environment, move laterally, collect data, and prepare encryption while blending into a familiar remote-access channel.

Why the GlobalProtect flaw is dangerousCVE-2026-0257 is rated High with a CVSS score of 7.8. It can allow an unauthenticated attacker to bypass security controls and create a VPN connection, but exposure depends on how the service is configured. The vulnerable condition involves authentication override cookies together with a particular certificate setup. Consequently, administrators need to inspect their actual deployments rather than assume every appliance—or no appliance—is affected.

The affected product families include several maintenance releases across PAN-OS 12.1, 11.2, 11.1, and 10.2, as well as Prisma Access 11.2 and 10.2. Panorama and Cloud NGFW are not listed as affected. Because fixed status varies by maintenance release, teams should compare every portal and gateway with Palo Alto Networks’ version table.

Authentication override cookies are intended to simplify authentication between GlobalProtect components. The weakness arose because cookies could be trusted without sufficient validation and integrity protection under the relevant configuration. An attacker able to exploit that behavior could obtain access without presenting legitimate user credentials.

Ransomware activity follows initial VPN accessReliaQuest observed the flaw in activity associated with Qilin and Settra and reported related use of offensive tools including Cobalt Strike, BloodHound, and SharpHound. Those tools can support command and control, Active Directory discovery, and attack-path mapping. Their presence shows why a successful VPN connection should be treated as the beginning of an investigation, not the end of an authentication check.

Earlier reporting linked Qilin intrusions using the same flaw to credential theft and eventual ransomware deployment. Evidence of use by another operation suggests the technique is spreading beyond one crew, potentially through initial-access brokers or shared playbooks. ReliaQuest expects exploitation to remain attractive over the coming months as attackers search for exposed, unpatched gateways.

Patch every component and remove old accessOrganizations should apply the vendor’s fixed releases across all internal and external portals and gateways that issue or accept the affected cookies. Hybrid Prisma Access environments may also require updates to on-premises firewalls. A partial upgrade can cause cookie compatibility problems, so remediation should be planned as an environment-wide change.

Disable authentication override cookies wherever the feature is not required.

Create a dedicated new certificate for cookie signing and do not reuse portal, gateway, or other service certificates.

Terminate active GlobalProtect sessions after patching so pre-remediation access cannot simply continue.

Review unexpected devices, source addresses, login times, and unusual hostnames, then correlate them with endpoint and identity telemetry.

Users will need to authenticate again after the updated components begin generating new cookies. That inconvenience is important: installing a patch does not automatically evict an intruder who established a session earlier.

Detection must extend beyond the gatewaySecurity teams should hunt for activity after suspicious VPN logins, including credential dumping, directory enumeration, remote service use, new administrative accounts, unusual data staging, and connections to systems the user does not normally access. A device name such as “kali” can be a useful lead, but it is not proof by itself and should be evaluated with other evidence.

The broader lesson is that trusted access infrastructure becomes an effective disguise when attackers bypass its identity controls. Rapid patching closes the entry point; session invalidation and retrospective investigation determine whether the organization has actually removed the threat.