CVE-2026-109618

Evidence in context

Confidence in exploitation evidence

Campaign documented

Priority basis

Recorded exploitation; CVSS 9.2; EPSS 100.0%

Attention, last 30 days

113 distinct story titles; 116 press documents; 27 publisher domains.

Technical potential

network access, no prior privileges, no user interaction, additional attack conditions.

Observed activity

Exploitation recorded in CISA KEV.

Known scale

Not quantified.

Evidence confidence basis

Trusted exploitation confirmation; Dated attack observation in the last 30 days; Trusted documented campaign

Score evaluated: 2026-11-05 13:59:52.374647+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Primary reports used by this score

• Dream Research

  Researchers recovered artifacts of a campaign against PAN-OS firewalls.

  Scope: The report describes 25 servers in its investigated campaign; not a global victim count or all PHP installations.

  Attack observation: not dated; source reviewed 2026-11-02.

• Palo Alto Networks Unit 42

  Vendor verified attacker tooling and results in the reported PAN-OS campaign.

  Scope: Internet-exposed PAN-OS management interfaces; this is not a measurement of exploitation across all PHP deployments.

  Attack observation: 2026-10-29; source reviewed 2026-11-02.

  Date basis: The dated 29 October update explicitly attests ongoing exploitation as of that update; not the first attack date.

Dated reference not reviewed through the current date.