Exploited PHP flaws reach Palo Alto and Cisco products, with no fixes yet
- Affected
- PAN-OS
10.2through12.2before the hotfixes, all Panorama and WildFire WF-500 releases, and the Cisco products before their fixed releases. All versions and fixes
- CVE
- Vendor
- PHP
Palo Alto Networks and Cisco say the PHP flaws known as PHP2Shell affect some of their products, and neither has released fixes for them yet. On PAN-OS, only the management web interface is affected, including the XML API, and Panorama and WildFire WF-500 appliances are affected too. Cisco lists its Expressway Series and Ultra-Reliable Wireless Backhaul. Neither vendor knows of attacks on its products, though attackers are trying the flaws widely elsewhere.
Palo Alto says the risk is highest when the management interface can be reached from the internet. It scores the flaws 8.7 there, with only availability at stake, and 7.1 when access is limited to a jump box. A dataplane interface is affected only when it has a management profile attached. GlobalProtect portals and gateways and the captive portal aren’t affected.
Until the hotfixes arrive, Threat Prevention subscribers get coverage from five Threat IDs in content version 9162 and later, Palo Alto says. They protect the management interface only when its traffic is routed through a dataplane port, decrypted and inspected. Restricting management access to trusted internal addresses minimizes the risk, it says.
Palo Alto lists hotfix dates from Oct 26 to Oct 30 for PAN-OS 10.2 through 12.2, and none yet for Panorama or the WildFire appliances. Cisco hasn’t dated its Expressway fix. Its fix for Ultra-Reliable Wireless Backhaul, where the attacker must already be an administrator, is due in February 2027, and Cisco lists no workarounds.
Check Point says 10% of organizations worldwide have seen exploitation attempts since the flaws leaked, though it can’t tell whether any succeeded.
- CVE
- Vendor
- PHP
What to do
4 steps
Affected and fixed versions
| Product | Affected | Fixed |
|---|---|---|
| PAN-OS 12.2 | Releases before 12.2.4-h1 | 12.2.4-h1, due Oct 28 |
| PAN-OS 12.1 | Releases before the hotfixes | 12.1.7-h11 due Oct 28, 12.1.4-h13 due Oct 29, 12.1.10-h3 due Oct 30 |
| PAN-OS 11.2 | Releases before the hotfixes | 11.2.10-h16 due Oct 26, 11.2.13-h4 due Oct 27, 11.2.16-h1 due Oct 28, 11.2.7-h23 due Oct 29, 11.2.4-h23 due Oct 30 |
| PAN-OS 11.1 | Releases before the hotfixes | 11.1.16-h4 due Oct 26, 11.1.13-h16 due Oct 27, 11.1.10-h36 due Oct 28, 11.1.4-h38 and 11.1.6-h40 due Oct 29, 11.1.7-h12 due Oct 30 |
| PAN-OS 10.2 | Releases before the hotfixes | 10.2.18-h13 due Oct 26, 10.2.13-h27 due Oct 27, 10.2.16-h12 due Oct 28, 10.2.10-h42 due Oct 29, 10.2.7-h39 due Oct 30 |
| Panorama | All releases | No date yet |
| WildFire WF-500 and WF-500-B | All releases | No date yet |
| Cisco Expressway and Expressway Select | Listed as vulnerable | 15.5.21, no date yet |
| Cisco Ultra-Reliable Wireless Backhaul | Listed as vulnerable | 27.1.1, due February 2027 |
- Product
- PAN-OS 12.2
- Affected
- Releases before
12.2.4-h1 - Fixed
12.2.4-h1, due Oct 28
- Product
- PAN-OS 12.1
- Affected
- Releases before the hotfixes
- Fixed
12.1.7-h11due Oct 28,12.1.4-h13due Oct 29,12.1.10-h3due Oct 30
- Product
- PAN-OS 11.2
- Affected
- Releases before the hotfixes
- Fixed
11.2.10-h16due Oct 26,11.2.13-h4due Oct 27,11.2.16-h1due Oct 28,11.2.7-h23due Oct 29,11.2.4-h23due Oct 30
- Product
- PAN-OS 11.1
- Affected
- Releases before the hotfixes
- Fixed
11.1.16-h4due Oct 26,11.1.13-h16due Oct 27,11.1.10-h36due Oct 28,11.1.4-h38and11.1.6-h40due Oct 29,11.1.7-h12due Oct 30
- Product
- PAN-OS 10.2
- Affected
- Releases before the hotfixes
- Fixed
10.2.18-h13due Oct 26,10.2.13-h27due Oct 27,10.2.16-h12due Oct 28,10.2.10-h42due Oct 29,10.2.7-h39due Oct 30
- Product
- Panorama
- Affected
- All releases
- Fixed
- No date yet
- Product
- WildFire WF-500 and WF-500-B
- Affected
- All releases
- Fixed
- No date yet
- Product
- Cisco Expressway and Expressway Select
- Affected
- Listed as vulnerable
- Fixed
15.5.21, no date yet
- Product
- Cisco Ultra-Reliable Wireless Backhaul
- Affected
- Listed as vulnerable
- Fixed
27.1.1, due February 2027
Sources
- Palo Alto Networks advisoryPrimary source security.paloaltonetworks.com
- Cisco advisoryPrimary source sec.cloudapps.cisco.com
- Check Point researchPrimary source blog.checkpoint.com