Public vulnerability disclosure
CVE-2026-109619
RCE via stale global state
publishedKnown exploited · CISA KEVCWE-416CWE-755CWE-824CWE-1325CWE-1419
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Technical severity9.2 criticalCVSS 4.0 · CNA: php
Published2026-10-21Source updated 2026-11-04
Collected2026-11-045 attributed sources
Fixes and workarounds
Workaround
Check the GitHub Security Advisory for mitigation strategies.
Source: CNA: phpFix
php-src (php): GitHub reports patched versions 8.2.35. Check the advisory for the affected release branch.
Source: GitHub GHSA-6wmf-4rv5-p3rpFix
php-src (php): GitHub reports patched versions 8.3.36. Check the advisory for the affected release branch.
Source: GitHub GHSA-6wmf-4rv5-p3rpFix
php-src (php): GitHub reports patched versions 8.4.27. Check the advisory for the affected release branch.
Source: GitHub GHSA-6wmf-4rv5-p3rpFix
php-src (php): GitHub reports patched versions 8.5.12. Check the advisory for the affected release branch.
Source: GitHub GHSA-6wmf-4rv5-p3rpAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| PHP PHP Group php-src
|
≥ 8.2.*; < 8.2.35 (affected, semver) ≥ 8.3.*; < 8.3.36 (affected, semver) ≥ 8.4.*; < 8.4.27 (affected, semver) ≥ 8.5.*; < 8.5.12 (affected, semver) Other versions: unaffected |
CNA: php |
| AX4 Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| CADRA Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Capital Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Designcenter Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Designcenter X Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Designcenter X Essentials Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| DFMExpress Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| HyperLynx Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Insights Hub Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Opcenter Connect Electronics Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Opcenter Connect MOM Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Opcenter Execution Core Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Opcenter Execution Discrete Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Opcenter Execution Foundation Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Opcenter Execution Pharma Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Opcenter Execution Process Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Opcenter Intelligence Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Opcenter Intra Plant Logistics Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Opcenter Quality Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Opcenter RDnL Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Opcenter X Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| PADS Pro Essentials Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| PADS Pro Student Edition Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| PADS Professional Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| PADS Professional - XCR Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| PADS Standard - XCR Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| PADS Standard & Standard Plus Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Pathway to Learning Engineering Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Polarion Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| QuadView Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| RUGGEDCOM APE1808 Siemens |
≥ 0; < * (affected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Simcenter Flomaster Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Simcenter Flux Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Simcenter Simlab Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Solid Edge Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Supply Chain Suite Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Teamcenter Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Teamcenter Product Cost Management Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Teamcenter Share Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Teamcenter Visualization Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Tecnomatix Plant Simulation Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| TestWay Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Valor NPI Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Xcargo Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Xpedition Designer Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Xpedition Enterprise Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Xpedition Enterprise XCR Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Xpedition IC Packaging Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Xpedition Layout Browser Siemens |
≥ 0; < * (unaffected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| AMIS TS Siemens |
≥ 0; < * (affected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| blueplanet 360 NX3 M6 WM OD IISX Siemens |
≥ 0; < * (affected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| blueplanet 360 NX3 M6 WM OD IISX - S Siemens |
≥ 0; < * (affected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Energy Engage V2.0SP9 Siemens |
≥ 0; < * (affected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Energy Engage V3.1SP1 Siemens |
≥ 0; < * (affected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Spectrum Power 3 Siemens |
≥ 0; < * (affected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Spectrum Power 4 Siemens |
≥ 0; < * (affected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Spectrum Power 7 Siemens |
≥ 0; < * (affected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| Spectrum Power TG Siemens |
≥ 0; < * (affected, custom)
Other versions: unknown |
ADP: siemens-SADP |
php-srcphp-src
php |
< 8.2.35 (affected, GitHub advisory range) | GitHub GHSA-6wmf-4rv5-p3rp |
php-srcphp-src
php |
< 8.3.36 (affected, GitHub advisory range) | GitHub GHSA-6wmf-4rv5-p3rp |
php-srcphp-src
php |
< 8.4.27 (affected, GitHub advisory range) | GitHub GHSA-6wmf-4rv5-p3rp |
php-srcphp-src
php |
< 8.5.12 (affected, GitHub advisory range) | GitHub GHSA-6wmf-4rv5-p3rp |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
NVD applicability configurations (15)
These expressions retain AND/OR operators, negation, and required environmental products. A listed product is not sufficient to establish exposure when additional conditions apply.
[
{
"negate": false,
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.2.35",
"versionStartIncluding": "5.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.3.36",
"versionStartIncluding": "8.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.4.27",
"versionStartIncluding": "8.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.5.12",
"versionStartIncluding": "8.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"negate": false,
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:siemens:ruggedcom_ape1808:-:*:*:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"negate": false,
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.2.7",
"versionStartIncluding": "10.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h1:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h10:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h11:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h12:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h13:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h14:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h15:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h16:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h17:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h18:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h19:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h2:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h20:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h21:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h22:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h23:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h24:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h3:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h32:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h34:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h35:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h36:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h37:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h38:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h4:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h5:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h6:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h7:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h8:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h9:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h1:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h10:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h11:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h12:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h13:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h14:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h17:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h18:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h2:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h21:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h27:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h3:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h30:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h31:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h36:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h37:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h39:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h4:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h40:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h41:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h5:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h6:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h7:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h8:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h9:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h1:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h10:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h15:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h16:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h18:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h2:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h21:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h22:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h23:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h24:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h26:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h3:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h4:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h5:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h7:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.14:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.15:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h1:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h10:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h11:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h4:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h6:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h7:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h8:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h9:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.17:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h1:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h10:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h12:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h5:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h6:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h7:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h8:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h9:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"negate": false,
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.4",
"versionStartIncluding": "11.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h1:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h10:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h11:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h12:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h13:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h15:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h16:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h17:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h18:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h2:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h25:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h27:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h3:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h32:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h33:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h34:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h35:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h36:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h37:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h4:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h5:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h6:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h7:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h8:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h9:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.5:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h1:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h10:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h14:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h17:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h18:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h19:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h2:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h20:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h21:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h22:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h23:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h25:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h29:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h3:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h32:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h33:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h34:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h35:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h36:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h38:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h39:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h4:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h5:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h6:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h7:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:h1:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:h10:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:h11:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:h2:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:h4:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:h6:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:h8:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.8:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.9:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h1:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h10:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h12:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h21:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h25:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h26:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h27:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h28:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h30:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h32:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h33:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h35:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h4:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h5:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h7:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h9:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.11:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.12:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h1:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h10:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h11:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h12:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h15:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h2:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h3:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h5:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h6:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h7:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h8:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h9:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.14:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.15:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.16:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.16:h1:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.16:h2:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.16:h3:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"negate": false,
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.2.4",
"versionStartIncluding": "11.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h1:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h10:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h11:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h12:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h14:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h15:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h17:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h18:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h2:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h20:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h3:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h4:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h5:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h6:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h7:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h8:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h9:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.5:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.6:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h1:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h10:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h11:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h12:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h13:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h14:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h15:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h16:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h17:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h18:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h19:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h2:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h3:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h4:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h7:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h8:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.8:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.9:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h1:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h10:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h12:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h13:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h2:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h3:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h4:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h5:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h6:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h7:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h8:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h9:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.11:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.12:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.13:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.13:h1:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.13:h2:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.13:h3:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.15:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.16:-:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"negate": false,
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.1.4",
"versionStartIncluding": "12.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h10:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h11:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h12:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h2:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h3:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h5:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h6:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h7:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h8:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h9:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:12.1.5:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:12.1.6:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:12.1.7:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:12.1.7:h1:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:12.1.7:h2:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:12.1.7:h3:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:12.1.7:h5:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:12.1.7:h6:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:12.1.7:h8:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:12.1.7:h9:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:12.1.8:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:12.1.9:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:12.1.10:-:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:12.1.10:h2:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"negate": false,
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.2.4",
"versionStartIncluding": "12.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:12.2.4:-:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"negate": false,
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:-:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:paloaltonetworks:panorama_m-200:-:*:*:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:paloaltonetworks:panorama_m-300:-:*:*:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:paloaltonetworks:panorama_m-500:-:*:*:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:paloaltonetworks:panorama_m-600:-:*:*:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:paloaltonetworks:panorama_m-700:-:*:*:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"negate": false,
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:paloaltonetworks:panorama_virtual_appliance:-:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"negate": false,
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:-:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:paloaltonetworks:wf-500:-:*:*:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:paloaltonetworks:wf-500-b:-:*:*:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"negate": false,
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:siemens:amis_ts:-:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"negate": false,
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:blueplanet_360_nx3_m6_wm_od_iisx-s_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:siemens:blueplanet_360_nx3_m6_wm_od_iisx-s:-:*:*:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"negate": false,
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:siemens:energy_engage:2.0:service_pack9:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:siemens:energy_engage:3.1:service_pack1:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"negate": false,
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:siemens:spectrum_power_3:-:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:siemens:spectrum_power_4:-:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:siemens:spectrum_power_7:-:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:siemens:spectrum_power_tg:-:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"negate": false,
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:blueplanet_360_nx3_m6_wm_od_iisx_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:siemens:blueplanet_360_nx3_m6_wm_od_iisx:-:*:*:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
]CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 4.0 / 9.2 critical |
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | CNA: php |
| 4.0 / 9.2 critical |
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD: [email protected] |
| 3.1 / 8.1 high |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD: [email protected] |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rpCNA: php · vendor-advisory
- https://www.wiz.io/blog/php2shell-php-rceADP: CISA-ADP · third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619ADP: CISA-ADP · government-resource
- https://php2shell.delftintellab.com/ADP: CISA-ADP · third-party-advisory
- https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/ADP: CISA-ADP · third-party-advisory
- http://www.openwall.com/lists/oss-security/2026/10/21/7ADP: CVE
- http://www.openwall.com/lists/oss-security/2026/10/21/16ADP: CVE
- http://www.openwall.com/lists/oss-security/2026/10/21/17ADP: CVE
- http://www.openwall.com/lists/oss-security/2026/10/21/23ADP: CVE
- http://www.openwall.com/lists/oss-security/2026/10/22/2ADP: CVE
- http://www.openwall.com/lists/oss-security/2026/10/22/14ADP: CVE
- http://www.openwall.com/lists/oss-security/2026/10/22/15ADP: CVE
- http://www.openwall.com/lists/oss-security/2026/10/22/16ADP: CVE
- http://www.openwall.com/lists/oss-security/2026/10/22/19ADP: CVE
- http://www.openwall.com/lists/oss-security/2026/10/22/20ADP: CVE
- http://www.openwall.com/lists/oss-security/2026/10/23/4ADP: CVE
- https://cert-portal.siemens.com/productcert/html/ssa-566512.htmlADP: siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-566435.htmlADP: siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-166980.htmlADP: siemens-SADP
- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp[email protected] · Mitigation, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/10/21/16af854a3a-2127-422b-91ae-364da2661108 · Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/21/17af854a3a-2127-422b-91ae-364da2661108 · Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/21/23af854a3a-2127-422b-91ae-364da2661108 · Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/21/7af854a3a-2127-422b-91ae-364da2661108 · Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/22/14af854a3a-2127-422b-91ae-364da2661108 · Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/22/15af854a3a-2127-422b-91ae-364da2661108 · Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/22/16af854a3a-2127-422b-91ae-364da2661108 · Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/22/19af854a3a-2127-422b-91ae-364da2661108 · Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/22/2af854a3a-2127-422b-91ae-364da2661108 · Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/22/20af854a3a-2127-422b-91ae-364da2661108 · Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/23/4af854a3a-2127-422b-91ae-364da2661108 · Mailing List, Third Party Advisory
- https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/134c704f-9b21-4f2e-91b3-4a467353bcc0 · Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-166980.html0b142b55-0307-4c5a-b3c9-f314f3fb7c5e · Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-566435.html0b142b55-0307-4c5a-b3c9-f314f3fb7c5e · Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-566512.html0b142b55-0307-4c5a-b3c9-f314f3fb7c5e · Third Party Advisory
- https://php2shell.delftintellab.com/134c704f-9b21-4f2e-91b3-4a467353bcc0 · Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource
- https://www.wiz.io/blog/php2shell-php-rce134c704f-9b21-4f2e-91b3-4a467353bcc0 · Third Party Advisory
- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rpGitHub Security Advisories · advisory
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.