CVE-2026-109619
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may t...
Affects 0 products across 4 vendors.
Software references memory after it has been freed, leading to corruption, crashes, or code execution.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
A high severity vulnerability (CVE-2026-109619) affects the target system. PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been fr...
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2026-109619?
What is the CVSS score for CVE-2026-109619?
Is CVE-2026-109619 actively exploited?
How do I remediate CVE-2026-109619?
What systems are affected by CVE-2026-109619?
| CVE ID | CVE-2026-109619 |
|---|---|
| CVSS Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2026-10-21 |
| Last Modified | 2026-11-02 |
| ICS Relevance | 85% |
| Weakness (CWE) | |
| Source | NVD |
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Source: NIST NVD / MITRE CVE Database
| Vendor | Product | Affected Versions |
|---|---|---|
| Fortinet | — | — |
| Johnsoncontrols | — | — |
| Palo Alto Networks | — | — |
| Siemens | — | — |
| Palo Alto Networks | Pan-Os | 10.2.7 10.2.8 10.2.9 10.2.10 10.2.11 10.2.12+44 more10.2.13 10.2.14 10.2.15 10.2.16 10.2.17 10.2.18 11.1.4 11.1.5 11.1.6 11.1.7 11.1.8 11.1.9 11.1.10 11.1.11 11.1.12 11.1.13 11.1.14 11.1.15 11.1.16 11.2.4 11.2.5 11.2.6 11.2.7 11.2.8 11.2.9 11.2.10 11.2.11 11.2.12 11.2.13 11.2.15 11.2.16 12.1.4 12.1.5 12.1.6 12.1.7 12.1.8 12.1.9 12.1.10 12.2.4 ≥ 10.2.0, < 10.2.7 ≥ 11.1.0, < 11.1.4 ≥ 11.2.0, < 11.2.4 ≥ 12.1.0, < 12.1.4 ≥ 12.2.0, < 12.2.4 |
| Php | Php | ≥ 5.4.0, < 8.2.35 ≥ 8.3.0, < 8.3.36 ≥ 8.4.0, < 8.4.27 ≥ 8.5.0, < 8.5.12 |
| Siemens | Energy Engage | 2.0 3.1 |
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | ● Active Exploitation Confirmed (added 2026-10-26) |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
This Vulnerability Is Being Actively Exploited
CVE-2026-109619 is on the CISA known-exploited list - confirmed active exploitation in the wild. BreachSpider flags known-exploited CVEs on the ICS assets they affect, with known-exploited status synced daily from CISA.
Create a free account →