Fixed an issue where the GlobalProtect embedded browser would stall in a connecting state when a macOS device attempted to establish a connection to the identity provider after waking from sleep. With this fix, the connection process completes successfully.

Fixed an issue where GlobalProtect would skip sending a Host Information Profile (HIP) report after a network change, such as transitioning between wired and Wi-Fi networks. This behavior prevented the firewall from receiving necessary data to maintain the user's session, which resulted in an outage. With this fix, GlobalProtect now properly sends HIP reports after network changes.

Fixed an issue where GlobalProtect Host Information Profile (HIP) recognition incorrectly reported the Real-Time Protection (RTP) status of a specific antivirus product, which caused endpoints to be marked as non-compliant and resulted in blocked network access. This occurred after an external update and rebranding of the antivirus product. With this fix, GlobalProtect accurately identifies the RTP status, ensuring correct compliance enforcement.

Fixed an issue where the Traffic Blocking Notification message was not displayed when GlobalProtect Connection for Network Access was enforced and a user connected to a network behind a Captive Portal before completing authentication. With this fix, the notification message "To access the network, you must first connect to GlobalProtect." displays as expected.

Fixed an issue where your GlobalProtect client connected to a geographically distant GlobalProtect gateway even when a closer, preferred gateway was available. This occurred when your network connection became temporarily unavailable during the GlobalProtect client's attempt to connect to the preferred gateway. With this fix, your GlobalProtect client correctly prioritizes and connects to the optimal gateway after network connectivity is restored.

Fixed an issue where GlobalProtect users would fail to authenticate when their usernames contained certain special characters, which led to a mismatch in character interpretation during the authentication process. With this fix, GlobalProtect now correctly processes usernames containing these special characters, allowing for successful authentication.

Fixed an issue where GlobalProtect target gateway selection reverted to the default after a few seconds. With this fix, the target gateway selection now persisted as configured.

Fixed an issue where GlobalProtect incorrectly detected an internal network over the tunnel, which happened when SAML authentication timed out during a GlobalProtect gateway switch. With this fix, GlobalProtect accurately determines network connectivity.

(macOS clients only) Fixed an issue where GlobalProtect connections would not establish after a reboot, which occurred because the GlobalProtect agent did not start or connect properly. With this fix, GlobalProtect connections establish as expected after a reboot.

Fixed an issue where the system did not send a Host Information Profile (HIP) report when real-time protection was detected as enabled after an initial detection of it being disabled immediately following power-on, which occurred because the system created a new HIP report but did not send it. With this fix, the system correctly sends HIP reports when the real-time protection status changes.

Fixed an issue where GlobalProtect connections would show a connected status but would not pass traffic. Attempts to refresh the connection would also fail, preventing further connection establishment for a period. With this fix, GlobalProtect connections properly pass traffic when showing a connected status.

Fixed an issue where GlobalProtect would not reconnect when Dynamic Link State Awareness (DLSA) was handling dual Network Interface Cards (NICs) if the gateway IP was not explicitly added to split routing, which occurred because the previous implementation required the gateway IP to be known and configured for split routing in such scenarios. With this fix, DLSA now handles dual NIC scenarios without requiring the gateway IP to be added to split routing.

Fixed an issue where GlobalProtect split-tunnel configurations did not correctly exclude multicast IP addresses. With this fix, multicast IP addresses are excluded as configured.

Fixed an issue where, on GlobalProtect deployments with Windows clients configured for "Pre-logon (Always On)" connection, the GlobalProtect App would incorrectly establish an external GlobalProtect gateway tunnel immediately after a user logged into their Windows account, even when the client was connected to the internal network. This behavior occurred when the GlobalProtect Portal agent configuration had the "Enable Cache Portal Configuration in Absence of Pre-logon Tunnel" setting enabled and the "Pre-Logon Tunnel Rename Timeout (sec) (Windows Only)" was set to a positive value, leading to a bypass of internal network discovery during the pre-logon tunnel rename process.

Fixed an issue where the GlobalProtect Agent (PanGPA) would unexpectedly terminate in a Prisma Access environment, which was related to cryptographic operations. With this fix, the GlobalProtect Agent maintains stable operation.

Fixed an issue where macOS GlobalProtect clients running version 6.2.8-h7 experienced a failure in IPv6 routing and traffic flow through the VPN tunnel. This occurred because the GlobalProtect client did not correctly install IPv6 routes when the gateway's Fully Qualified Domain Name (FQDN) lacked an AAAA DNS record, leading to an empty remoteHostV6 variable and the IPv6 system configuration being skipped, even when the gateway assigned an IPv6 tunnel IP and provided access routes.

Fixed an issue where the GlobalProtect Agent software (versions 6.2.8 H4, 6.2.8 H7, and 6.3.3) would crash, disconnect from the VPN, and restart when a user clicked outside the 'Add Portal Address' window while it was open.

Fixed an issue where GlobalProtect exclude routes were not installed correctly on Windows endpoints. With this fix, exclude routes install as expected.

Fixed an issue where GlobalProtect clients on macOS would display a "Portal not found" or "Could not connect to Authentication server" error on the first connection attempt to the GlobalProtect portal after an upgrade or system reboot, requiring a second attempt to successfully connect.

(GlobalProtect client on Windows 11 only) Fixed an issue where the GlobalProtect client window displayed a blank screen, which prevented the connection status from appearing. This issue occurred intermittently, particularly after the computer woke up. With this fix, the client window displays the connection status as expected.

Fixed an issue where macOS GlobalProtect clients lost internet connectivity after switching between different GlobalProtect portals. This occurred because the client retained incorrect Domain Name System (DNS) server assignments from the previously connected portal, which prevented successful name resolution. With this fix, the client properly updates DNS settings when switching portals.

Fixed an issue where importing a self-signed root certificate into the user trust store through the GlobalProtect (GP) portal's Agent -> Trusted Root CA -> install in local root certificate store option would not complete, which occurred when strict certificate checking options were enabled, even if the GlobalProtect portal's own certificate was trusted. With this fix, the import process completes as expected under these conditions.

Fixed an issue where the Real Time protection status for Carbon Black Cloud Sensor was displayed as 'n/a', which occurred even after the sensor product was correctly detected. With this fix, the Real Time protection status is now correctly recognized and populated.

Fixed an issue where on Windows endpoints, the system's proxy AutoConfigURL was not restored to its original value after GlobalProtect disconnected, specifically when GlobalProtect had pushed a different proxy AutoConfigURL during the connection.

Fixed an issue where GlobalProtect clients failed to correctly parse the internal gateway IP address provided via DHCP option 43 with sub-option 100, causing the client to attempt connection to an incorrect IP address.

Fixed an issue where GlobalProtect client version 6.2.8, when installed in FIPS-CC mode on client machines with AMD chipsets, failed with an error message indicating that the CPU does not support RDSEED/RDRAND instructions. This occurred because the openssl library was built with the RDCPU flag, leading to an incorrect assessment of CPU capabilities on AMD platforms.

Fixed an issue where GlobalProtect Portal and Gateway logs (pan_gp_event.log) did not provide detailed error messages when client certificate authentication failed during the pre-logon stage, particularly when the private key was stored on a Trusted Platform Module (TPM).

Fixed an issue where GlobalProtect displayed a connected status, but internet connectivity was interrupted, which led to dropped calls and other service disruptions. This occurred because the GlobalProtect virtual adapter unexpectedly disconnected when an IPSec tunnel failed to gracefully fall back to an SSL tunnel. With this fix, the GlobalProtect virtual adapter maintains its connection and properly transitions between tunnel types.

Fixed an issue where the GlobalProtect client (version 6.2.8-243) on macOS 15.5 (Build 24F74) caused excessive memory consumption, with the GlobalProtect process consuming up to 27 GB of memory, due to improper memory management related to autoreleasepool.

Fixed an issue where the virtual network adapter retained the static IP address assigned by GlobalProtect even after the GlobalProtect client disconnected. This caused DNS registration conflicts, making workstations unreachable by hostname even after a reboot.

Fixed an issue where the GlobalProtect client for Windows (Spanish version) displayed an incorrect translation, "Logs ficticios" (Fake logs), for the log collection option in the Settings > Troubleshooting menu.

Fixed an issue where traffic to loopback addresses within the 127.0.0.0/8 subnet, excluding 127.0.0.1, was dropped when Endpoint Traffic Policy Enforcement was enabled, which prevented applications from using these loopback addresses for internal communication. With this fix, traffic to the entire loopback subnet is handled correctly.