[PA-56R-POE-5G only] Fixed an issue where Power over Ethernet (PoE) ports did not correctly reflect their operational state during thermal throttling events, which led to a discrepancy where the ports appeared disabled in some system reports while remaining active according to their configuration. With this fix, PoE ports accurately reflect their operational state during thermal throttling.

(PA-54R-POE, PA-54R-POE-D-5G, and PA-56R-POE-5G firewalls only) Fixed an issue where the user interface displayed a Power over Ethernet (PoE) budget of 150W, instead of the actual limit of 91W, which occurred because the user interface did not correctly retrieve the platform's Power over Ethernet (PoE) budget limit. With this fix, the user interface now accurately reflects the correct Power over Ethernet (PoE) budget.

Fixed an issue where syslog server connections would remain in an ESTABLISHED state after a commit operation when syslog forwarding was configured using TCP, which indicated a connection socket leak. With this fix, connections are properly closed.

(RN-HP firewalls only) Fixed an issue where packet buffer resources would leak during a temporary surge in packet buffer usage, which caused tunnels to become unavailable. With this fix, packet buffer resources are managed correctly during periods of high usage.

Fixed an issue where the firewall introduced out-of-order packet delivery for certain data streams, which resulted in clients receiving data in an incorrect sequence.

(M-700 Panorama appliances only) Fixed an issue where the system was unable to add new RAID disks to existing arrays, which resulted in disk pairs remaining in a degraded state. The system would detect the drives but would not properly initialize them for inclusion in the RAID array. With this fix, the system now correctly initializes and adds new RAID disks, allowing for proper array rebuilds.

Few configs which pushed from SCM to firewall were causing the firewall to loose its internet connectivity and the firewall wasn't able to connect to cloud and was getting stuck at discovery stage retrying indefinitely without returning failure. And now ACR performs the the config rollback once the 5 cloud connectivity check attempts failed.

[PA-54R-POE-D-5G and PA-54R-POE only] Fixed an issue where the Vehicle Interface Management System (VIMS) could be enabled when the firewall was connected to a Low Voltage Power Supply Unit (LVPSU) or High Voltage Power Supply Unit (HVPSU), which led to unsupported system behavior. With this fix, the system prevents VIMS from being enabled under these conditions.

(PA-5510 firewalls only) Fixed an issue where a firewall would enter Maintenance Mode and require a factory reset to recover when a cluster configuration was pushed from Panorama, which caused the device to not properly transition from a standalone to a clustered state during a reboot. With this fix, firewalls transition to a clustered state as expected.

Fixed an issue where device telemetry uploads would fail, which led to critical alerts in the system logs. With this fix, telemetry data uploads complete successfully.

Fixed an issue where the proxy generated HTTP 503 errors for multiple URLs, which prevented users from connecting to servers. With this fix, the proxy now functions as expected.

Fixed an issue where SNMPv3 communication would fail after an upgrade from PAN-OS 11.1 to PAN-OS 12.1.6 when using SHA-512 authentication and AES-256 privacy. With this fix, SNMPv3 communication functions as expected after the upgrade.

Fixed an issue where testing an SCP server connection from the Panorama web interface returned an error instead of prompting to allow the host key, which prevented the successful establishment of the connection. With this fix, the system now correctly prompts to allow the host key.

Fixed an issue where the characters in PDF Summary Reports did not display correctly when the Locale was set as Japanese, Korean, Simplified Chinese, or Traditional Chinese.

(PA-4xx Firewalls) Fixed an issue where firewalls rebooted unexpectedly after an upgrade. With this fix, firewalls now operate stably after an upgrade.

Fixed an issue where the Panorama web interface showed blank Host Information Profile (HIP) Match log entries when opened in Detailed Log View. With this fix, the Detailed Log View now displays the expected information for HIP Match logs.

(PA-520, PA-545-POE, PA-555-POE, PA-550 firewalls only) Fixed an issue where a commit operation would fail, which was caused by incorrectly updated capacity numbers. With this fix, commit operations complete successfully.

Fixed an issue where Panorama did not automatically resume syslog forwarding over TCP after the syslog server became unavailable or was restarted.

Fixed an issue where a firewall functioning as an Area Border Router did not correctly translate NSSA Type-7 LSAs to Type-5 LSAs when OSPF neighbors set the Nt bit in the NSSA Area, and routes were not advertised to upstream OSPF neighbors in the backbone area, which resulted in traffic being silently discarded.

Fixed an issue where traffic did not hit Security policy rules configured with a HIP profile even when the HIP match log indicated a successful match. This occurred after upgrading and importing a configuration.

Fixed an issue where basic authentication requests in Hybrid-SWG configurations were not correctly processed, which prevented successful authentication. With this fix, basic authentication now functions as expected for Hybrid-SWG configurations.

Fixed an issue where a process remained in a recursive loop when processing queued packets after hold mode was disengaged, particularly when handling ADNS traffic with failed wif-forward responses, which led to system instability. With this fix, the process properly continues packet processing.

Fixed an issue where BFD sessions did not reestablish on the newly elected leader after a leader failover event that occurred when the previous leader node was suspended.

Fixed an issue where high CPU utilization occurred on one of the CPU cores.

Fixed an issue where high memory utilization occurred in the escd process. With this fix, memory utilization for the process remained stable.

Fixed an issue where the sslmgr process stopped responding when attempting to display the OSCP host cache.

(Prisma Access GlobalProtect Gateways only) Fixed an issue where a deleted custom anti-spyware signature continued to block traffic after a successful commit operation, which caused the dataplane to incorrectly enforce the deleted signature. With this fix, the dataplane correctly removed deleted signatures and enforced the updated policy.

(Google Cloud NGFW Enterprise VM-Series firewalls only) Fixed an issue where the HTTP2 threat logs did not include VPC ID, Security_key, and Endpoint ID.

Fixed an issue on the web interface where you were unable to view new or modified App-IDs under Review Policy or Review Apps.

Fixed an issue where selective configuration pushes from Panorama failed after an upgrade, which caused shared policy rules to go out of sync. With this fix, selective configuration pushes complete successfully and policies remain in sync.

Fixed an issue where attempting to generate a ticket for the GlobalProtect portal caused Panorama to restart unexpectedly with the error message tpl is invalid.

Fixed an issue where OSPF learned routes were not advertised to other OSPF peers, even when OSPF adjacencies were in a full state. This occurred when OSPF packets fragmented internally before transmission.

Fixed an issue where the firewall sent a BFD admin down message during an NGFW cluster failover, which caused BGP sessions to terminate and routes to be lost.

Fixed an issue where the Enhanced Application Logging status in the Logging Service Status dashboard displayed as gray and indicated 0/0 connections, even though EAL logs were successfully forwarded to Cortex XDR.

Fixed an issue where processes stopped responding unexpectedly.

(HA Active-Active firewalls only) Fixed an issue where High Availability (HA) session synchronization did not occur between the active primary and secondary firewalls, which prevented sessions from properly synchronizing across the HA pair. This occurred after a firewall upgrade. With this fix, HA session synchronization between the active primary and secondary firewalls was restored.

(PA-VM firewalls only) Fixed an issue where web-browsing sessions were logged with an end-reason of 'Policy Deny' or 'Discard' even though security policies allowed the traffic, which occurred due to an error in session processing after policy rematching. With this fix, traffic logs accurately reflect the allowed status of sessions.

Fixed an issue where incorrect source region information appeared in GlobalProtect logs, which occurred because the location service lookup did not consistently return region information for public IP addresses. With this fix, accurate source region information is consistently displayed.

(Firewalls in active/passive High Availability (HA) configuration on Gen5 platforms only) Fixed an issue where the High Availability (HA) interface type option was displayed for data ports in the user interface, even though these ports did not support HA functionality, which could lead to confusion during configuration. With this fix, the HA interface type option is no longer displayed for unsupported data ports.

Fixed an issue where the firewall rebooted unexpectedly without any configuration or power changes.

Fixed an issue where a DPC in Slot 4 restarted repeatedly, which caused internal path monitoring failures and a failover event.

(PA-5450 firewalls and PA-7000 Series firewalls with 100G NPCs only) Fixed an issue where intermittent packet loss occurred when traversing the dataplane after upgrading the firewall. This occurred when a dataplane HA interface was configured in an environment where Slot 1 was unpopulated , which resulted in a wildcard entry being created within the QMAP table.

(PA-5450 firewalls only) Fixed an issue where tech support file generation remained stuck at 0% and would not complete when initiated from the web interface or command line interface. With this fix, tech support files generate successfully.

Fixed an issue where GlobalProtect pre-logon tunnel session was not cleared even after the user was logged in. With this fix, the session is cleared after the session timeout expires.

Fixed an issue where User-ID XML API requests took longer than expected to return a response, which caused the web interface and captive portal pages to respond slowly or fail to load. this occurred when sending XML API requests for IP address-to-user mapping.

Fixed an issue where GlobalProtect user authentication with certificates from a new Public Key Infrastructure (PKI) would not succeed when Certificate Revocation List (CRL) checking was enabled. This occurred because the firewall did not properly retrieve the CRL from the new PKI's Distribution Point URL. With this fix, the firewall now successfully retrieves CRLs, allowing GlobalProtect users to authenticate correctly with certificates from new PKIs.

Fixed an issue where the /opt/pancfg/mgmt/ssl/private/ directory on Palo Alto Networks devices with TPM support became 100% utilized due to an accumulation of undeleted .pub_pem files. This occurred because executing the show device-certificate status CLI command initiated a process that generated these files but failed to remove them, which prevented the fetching of new device certificates.

Fixed an issue where, during a commit, the firewall intermittently stopped sending SNMP messages, which caused interface counters to stop updating for brief periods of time.

(Firewalls in FIPS mode only) Fixed decryption issues that occurred after an upgrade to an affected release.

To enable this fix, run the CLI command debug dataplane set ssl-decrypt low-memory-throttle enable.

Fixed an issue where the recommended filter for identifying traffic from unidentified users in traffic logs reported an incorrectly low number of results.

Fixed an issue where pushing multiple policy rules failed when the policy rules contained a large number of dynamic address object groups or user groups.

Fixed an issue where, when Advanced DNS Security was enabled and experienced unusually high loads, DNS resolution failures occurred with the error resources-unavailable.

Fixed an issue on the web interface where the global filter set in ACC > Threat Activity did not apply when you navigated to the Network Activity tab.

Fixed an issue where a website would intermittently fail to load in Mozilla Firefox after authentication when AURL inline cloud was active, which was caused by an interaction with the inline cloud analysis process. With this fix, websites now load consistently.

Fixed an issue on Panorama with the Cloud Services plugin where the firewall template setting to enable secure Panorama communication under Secure Client Communication was not visible in the user interface, even though it was accessible via the CLI.

Fixed an issue that caused the firewall fan speed to increase while it was idle.