October 30, 2026

Recommendation for Palo Alto Devices

No items found.

October 30, 2026

Note: We will continue to monitor for vulnerabilities affecting Palo Alto Networks PAN-OS Firewalls and send communications regarding out-of-cycle upgrades when needed. The next regularly scheduled Upkeep tech review for Palo Alto devices will be in January 2027.

As part of UpKeep, our feature to keep our NWG Manage customers' devices on the latest stable version, we reviewed the latest Palo Alto releases and recommend the upgrades detailed below.

If you're not an NWG Manage customer and you still want to get our recommendations right as they come out, you can join the free UpKeep email list.

Why Are You Sharing This Information?

Even if we're not managing Palo Alto devices for you, we want you to have the latest information to help keep your devices secure.

  • What should I do if I have a Palo Alto device that NWG manages?
    If you have a Palo Alto device(s) that we manage for you, we already know what hardware you have and what version you need to be on. We’ll handle the upgrade during an upcoming maintenance window (unless you are already running the recommended version). Zendesk notifications will be sent out once maintenance has been scheduled, including details about when implementation will take place. If your devices/locations require different days/times for maintenance to take place, you’ll receive separate tickets.
  • What if I have Panorama devices that NWG manages?
    If you have Panorama devices, they will receive an upgrade one week prior to the additional Palo Alto device upgrades outlined below. You’ll receive Zendesk notifications for both.‍
  • What if I have a Palo Alto device that NWG does not manage?
    If you have a Palo Alto device(s) in your environment, we suggest you upgrade to the recommended version listed below.‍
  • What if I don't have any Palo Alto devices?
    If you don't have any Palo Alto devices, no action is needed.

Which Palo Alto Releases Do You Recommend?

  • PanOS 12.1.7-h11 for fifth-generation hardware.
  • PanOS 12.2.4-h1 for devices that MUST use 12.2.X.
  • PanOS 11.2.10-h17 for all devices that require 11.2.X.
  • PanOS 11.1.16-h4 for all devices that are capable of running 11.1.X.
  • PanOS 10.2.18-h13 for all devices that are capable of running 10.2.X. PanOS 10.2.X is in extended support and should only be used for devices not capable of running 11.1.X. Any devices not capable of running at least 11.1.X should be targeted for replacement. 
  • PanOS 10.1.X is end of life and should no longer be used.

These versions are the most stable and they remediate several vulnerabilities listed in the Review Details section below, including CVE-2026-109618 and CVE-2026-109619, referred to together as PHP2Shell.

We have 30 years of experience managing hundreds of different device types across every industry. Check out our Managed Services page for more info on how we can integrate with your security team, allowing you to engage at the level your organization needs.

Review Details

Note: PanOS version compatibility is dependent on hardware. Newer hardware is not capable of running older versions of PanOS. Virtual Palo Alto firewalls do not have this limitation. The compatibility matrix can be found at: https://docs.paloaltonetworks.com/compatibility-matrix/reference/supported-os-releases-by-model/palo-alto-networks-next-gen-firewalls

PanOS 12.X

PanOS 12.2 Review

PanOS version 12.X is the required version for fifth-generation hardware (currently PA-55XX and PA-5XX). These hardware platforms require 12.X and cannot run older versions. The most current release is 12.2.4-h1

PanOS 12.2 Conclusion

NWG recommends 12.1.X in favor of 12.2.X at this time. If you must use 12.2.X, we recommend 12.2.4-h1 as it remediates the following vulnerabilities:

  • CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, allowing attackers to reliably achieve RCE using out-of-memory (OOM) triggers.
  • CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be read or branched on during subsequent requests, enabling attackers to execute arbitrary code.
  • CVE-2026-111497, A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. Brotli is commonly used by many HTTP-based applications including Node.js.
PanOS 12.1 Review

The most current release is 12.1.10-h3.

PanOS 12.1 Conclusion

NWG recommends PanOS 12.1.7-h11 for fifth-generation hardware at this time. This release remediates the following vulnerabilities:

  • CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, allowing attackers to reliably achieve RCE using out-of-memory (OOM) triggers.
  • CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be read or branched on during subsequent requests, enabling attackers to execute arbitrary code.
  • CVE-2026-111497, A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. Brotli is commonly used by many HTTP-based applications including Node.js.

PanOS 11.2

PanOS 11.2 Review

The current Palo Alto recommended version is 11.2.10-h4. PanOS 11.2.16-h1 is the newest version.

PanOS 11.2 Conclusion

NWG recommends PanOS 11.2.10-h17 for all devices that require PanOS 11.2.X. PanOS 11.2.10-h17 is the most stable version and remediates the following vulnerabilities:

  • CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, allowing attackers to reliably achieve RCE using out-of-memory (OOM) triggers.
  • CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be read or branched on during subsequent requests, enabling attackers to execute arbitrary code.
  • CVE-2026-111497, A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. Brotli is commonly used by many HTTP-based applications including Node.js.

PanOS 11.2.X only has a ~14% adoption rate across Palo Alto platforms. NWG recommends earlier versions of PanOS where possible.

PanOS 11.1

PanOS 11.1 Review

The current Palo Alto recommended version is 11.1.16-h2. PanOS 11.1.16-h4 is the newest version.

PanOS 11.1 Conclusion

NWG recommends PanOS 11.1.16-h4 for all devices that are capable of running 11.1. PanOS 11.1.16-h4 is the most stable version and remediates the following vulnerabilities:

  • CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, allowing attackers to reliably achieve RCE using out-of-memory (OOM) triggers.
  • CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be read or branched on during subsequent requests, enabling attackers to execute arbitrary code.
  • CVE-2026-111497, A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. Brotli is commonly used by many HTTP-based applications including Node.js.

PanOS 11.1.16-h4 also resolved the following issues:

  • Issue ID: PAN-321573
    • Fixed an issue where High Availability (HA) session synchronization did not occur between the active primary and secondary firewalls, which prevented sessions from properly synchronizing across the HA pair. This occurred after a firewall upgrade. With this fix, HA session synchronization between the active primary and secondary firewalls was restored.
  • Issue ID: PAN-318382
    • Fixed an issue where the secondary firewall remained at an Initial state after an upgrade.
  • Issue ID: PAN-315337
    • Fixed an issue where GlobalProtect throughput was reduced after an upgrade.
PanOS 11.0 Review

PanOS 11.0 is End of Life and should no longer be used.

PanOS 11.0 Conclusion

NWG recommends replacing any devices that are not capable of running at least PanOS 11.1.X

PanOS 10.2

PanOS 10.2 Review

The current Palo Alto recommended version is 10.2.18-h10. PanOS 10.2.18-h13 is the newest version, which was released on 10/28/2026.

PanOS 10.2 Conclusion

NWG recommends PanOS 10.2.18-h13 for all devices that are capable of running 10.2. PanoOS 10.2.18-h13 is the most stable version and remediates the following vulnerabilities:

  • CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, allowing attackers to reliably achieve RCE using out-of-memory (OOM) triggers.
  • CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be read or branched on during subsequent requests, enabling attackers to execute arbitrary code.

End of standard support for PanOS 10.2.X was 8/27/25. It is now in extended support and should only be used for devices that are not capable of running 11.1.X. Any devices not capable of running at least 11.1.X should be targeted for replacement.

PanOS 10.1

PanOS 10.1 Review

PanOS 10.1 is End of Life and should no longer be used.

PanOS 10.1 Conclusion

NWG recommends replacing any devices that are not capable of running at least PanOS 11.1.X.

Review Process

  • Model Evaluation
    • Determines major code revision compatibility
  • Newest Version (Mature/GA)
    • Evaluate known issues
    • Evaluate resolved issues
    • Evaluate features as needed

Related Posts:

PHP2Shell: Patching CVE-2026-109618 and CVE-2026-109619

Where AI Actually Sits in Our Security Work

Recommendation for Fortinet Devices

Think We Can Help?

Let’s Talk
‍