Dashboard / CVE-2026-109619

CVE-2026-109619

CRITICAL CISA KEV
ACT NOW Priority: 9.20 BB Relevance: 78/100
Published: 2026-10-21 Modified: 2026-10-28 First seen: 2026-10-29 Status: active

Attack Surface

Network No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: None
AT: Present
VC: High
VI: High
VA: High

Description

PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.

CISA Known Exploited Vulnerability

Vendor / Product PHP Group — PHP
Date Added 2026-10-26
Remediation Due 2026-10-29
This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.php.net/ ; https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-109619

Weakness Classification (5)

Affected Software (604)

VendorProductVersion
PHP Group PHP 8.2.* < 8.2.35
PHP Group PHP 8.3.* < 8.3.36
PHP Group PHP 8.4.* < 8.4.27
PHP Group PHP 8.5.* < 8.5.12
PHP Group PHP 8.2.* < 8.2.35
PHP Group PHP 8.3.* < 8.3.36
PHP Group PHP 8.4.* < 8.4.27
PHP Group PHP 8.5.* < 8.5.12
paloaltonetworks pan-os 10.2.0 – 10.2.7
paloaltonetworks pan-os 10.2.7
paloaltonetworks pan-os 10.2.7
paloaltonetworks pan-os 10.2.7
paloaltonetworks pan-os 10.2.7
paloaltonetworks pan-os 10.2.7
paloaltonetworks pan-os 10.2.7
paloaltonetworks pan-os 10.2.7
paloaltonetworks pan-os 10.2.7
paloaltonetworks pan-os 10.2.7
paloaltonetworks pan-os 10.2.7
paloaltonetworks pan-os 10.2.7
paloaltonetworks pan-os 10.2.7
paloaltonetworks pan-os 10.2.7
paloaltonetworks pan-os 10.2.7
paloaltonetworks pan-os 10.2.7
paloaltonetworks pan-os 10.2.7
paloaltonetworks pan-os 10.2.7
paloaltonetworks pan-os 10.2.7
paloaltonetworks pan-os 10.2.7
paloaltonetworks pan-os 10.2.7
paloaltonetworks pan-os 10.2.7
Showing 30 of 604 entries

References & Advisories (17)

Bug Bounty Relevance

78 / 100
✓ Network accessible
✓ No authentication
✓ No user interaction
✓ Known exploited (KEV)
✓ High exploitation probability

CVSS Score

9.2 / 10.0 v4.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

100.00%
Raw Score 0.999990
Percentile 100.0%
Date 2026-10-28

Intelligence Sources

kev ref →
mitre ref →
nvd ref →

External Links