Palo Alto Networks PAN-OS 10.2.x / 11.1.x / 11.2.x / 12.1.x / 12.2.x Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(371596);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/23");

  script_cve_id("CVE-2026-109618", "CVE-2026-109619");

  script_name(english:"Palo Alto Networks PAN-OS 10.2.x / 11.1.x / 11.2.x / 12.1.x / 12.2.x Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote PAN-OS host is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"The version of Palo Alto Networks PAN-OS running on the remote host is a vulnerable version of 10.2.x, 11.1.x, 11.2.x,
12.1.x, or 12.2.x. It is, therefore, affected by multiple vulnerabilities.

    Palo Alto Networks is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619.

    CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via
    longjmp() leaves request memory uninitialized due to improper control flow management, allowing attackers
    to reliably achieve RCE using out-of-memory (OOM) triggers.

    CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling
    leaves global memory pointing to freed memory regions. These regions can later be read or branched on
    during subsequent requests, enabling attackers to execute arbitrary code.

    Palo Alto Networks has conducted an evaluation of our product portfolio regarding this issue; a summary of
    the status across products is provided in the table below. We will update the below table when we get more
    information.

Tenable has extracted the preceding description block directly from the PAN-OS security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?417dfc63");
  # https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a70a97d7");
  script_set_attribute(attribute:"solution", value:
"Upgrade to a fixed version");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:A");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-109618");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-109619");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(754);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/23");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:paloaltonetworks:pan-os");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Palo Alto Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("palo_alto_version.nbin");
  script_require_keys("Host/Palo_Alto/Firewall/Version", "Host/Palo_Alto/Firewall/Full_Version", "Host/Palo_Alto/Firewall/Source", "Settings/ParanoidReport");

  exit(0);
}

include('vcf.inc');
include('vcf_extras.inc');

vcf::palo_alto::initialize();

var app_name = 'Palo Alto Networks PAN-OS';

var app_info = vcf::get_app_info(app:app_name, kb_ver:'Host/Palo_Alto/Firewall/Full_Version', kb_source:'Host/Palo_Alto/Firewall/Source');

if (report_paranoia < 2) audit(AUDIT_PARANOID);

var constraints = [
  { 'min_version' : '10.2.7', 'fixed_version' : '10.2.7-h39' },
  { 'min_version' : '10.2.10', 'fixed_version' : '10.2.10-h42' },
  { 'min_version' : '10.2.13', 'fixed_version' : '10.2.13-h27' },
  { 'min_version' : '10.2.16', 'fixed_version' : '10.2.16-h12' },
  { 'min_version' : '10.2.18', 'fixed_version' : '10.2.18-h13' },
  { 'min_version' : '11.1.4', 'fixed_version' : '11.1.4-h38' },
  { 'min_version' : '11.1.6', 'fixed_version' : '11.1.6-h40' },
  { 'min_version' : '11.1.7', 'fixed_version' : '11.1.7-h12' },
  { 'min_version' : '11.1.10', 'fixed_version' : '11.1.10-h36' },
  { 'min_version' : '11.1.13', 'fixed_version' : '11.1.13-h16' },
  { 'min_version' : '11.1.16', 'fixed_version' : '11.1.16-h4' },
  { 'min_version' : '11.2.4', 'fixed_version' : '11.2.4-h23' },
  { 'min_version' : '11.2.7', 'fixed_version' : '11.2.7-h23' },
  { 'min_version' : '11.2.10', 'fixed_version' : '11.2.10-h16' },
  { 'min_version' : '11.2.13', 'fixed_version' : '11.2.13-h4' },
  { 'min_version' : '11.2.16', 'fixed_version' : '11.2.16-h1' },
  { 'min_version' : '12.1.4', 'fixed_version' : '12.1.4-h13' },
  { 'min_version' : '12.1.7', 'fixed_version' : '12.1.7-h11' },
  { 'min_version' : '12.1.10', 'fixed_version' : '12.1.10-h3' },
  { 'min_version' : '12.2.0', 'fixed_version' : '12.2.4-h1' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);