Fixes were made to address the following CVEs:

• CVE-2026-0331
• CVE-2026-0330 (Panorama)
• CVE-2026-0329
• CVE-2026-0328

Fixed an issue where Anti-virus content packages do not appear under Device > Dynamic Updates when you select Check Now on firewalls licensed exclusively with an Advanced Threat Prevention Plus add-on. The web interface does not check for or display available Anti-virus updates because it does not recognize the Advanced Threat Prevention Plus license as a valid entitlement for Anti-virus content.

Fixed an issue where the Inline Cloud Analysis tab does not appear in the Vulnerability Protection profile in the web interface on firewalls licensed exclusively with the Advanced Threat Prevention Plus add-on. The Advanced Threat Prevention Plus license is a unified license that enables Threat Prevention and Advanced Threat Prevention features, as well as Frontier Virtual Patching, but the web interface does not recognize it as a valid entitlement for the Inline Cloud Analysis configuration. The underlying Inline Cloud Analysis functionality is not affected, however, the web interface tab is unavailable for configuration.

Fixed an issue where the licensing message on the Security Profiles page does not list Advanced Threat Prevention Plus as a valid license option firewalls without a Threat Prevention or Advanced Threat Prevention license. The message references only Threat Prevention and Advanced Threat Prevention, which may cause confusion for customers who have an Advanced Threat Prevention Plus add-on.

Fixed an issue where NetFlow v9 exports did not include flow termination events for sessions blocked by Layer 7 Security Profiles, which resulted in incomplete NetFlow records for these sessions. With this fix, NetFlow exports now correctly include flow termination events for all sessions.

Fixed an issue where the firewall did not enforce strict Extended Key Usage (EKU) validation during certificate-based Internet Key Exchange (IKE) negotiation, even when the setting to enable strict validation of the peer's extended key use was enabled. With this fix, the firewall now properly enforces strict EKU validation during IKE negotiation.

Fixed an issue where a Panorama commit-all operation unintentionally removed an Open Shortest Path First (OSPF) default-information-originate directive from the firewall configuration when an update to the directive was attempted, which resulted in the loss of default route connectivity for connected networks. With this fix, the firewall correctly retained or updated the OSPF default-information-originate directive during Panorama commit operations.

Fixed an issue where system disk space was rapidly consumed by a log file, and attempts to clear disk space using the cleanup command would not complete. This occurred when internal logging processes encountered data processing errors, which led to continuous log generation and prevented successful disk cleanup operations. With this fix, system logging processes handle data errors gracefully, and disk cleanup operations function as expected.

Fixed an issue where WildFire submission logs incorrectly displayed multiple files with different names as having the same file digest, which led to inaccurate malicious verdicts and prevented the display of analysis reports for those files. With this fix, WildFire accurately identifies and logs unique file digests and provides correct analysis reports.

(PA-VM firewalls in an Azure environment with 3 data plane interfaces in an HA configuration) Fixed an issue where the Accelerated Networking status was incorrectly displayed as disabled on a data plane interface of a passive virtual machine after a reboot, which occurred when the Data Plane Development Kit (DPDK) was disabled. With this fix, the Accelerated Networking status is reported accurately.

(PA-3250 firewalls only) Fixed an issue where firewalls experienced unexpected reboots and transitioned to a high availability (HA) Non-Functional state, which was caused by instability in dataplane processes. With this fix, the firewalls maintain stable operation and HA functionality.

Fixed an issue where the graphical user interface (GUI) displayed an incorrect count of blocked categories for User Credential Submission in the default URL filtering profile and in unedited URL filtering profiles copied from the default profile. With this fix, the GUI now accurately reflects the number of blocked categories.

(Firewalls in active/passive HA configuration only) Fixed an issue where DHCP clients on interfaces remained in a rebooting state long after a device reboot or failover, which was caused by a race condition. With this fix, DHCP clients properly acquired IP addresses after reboots or failovers.

Fixed an issue where User-ID distribution experienced delays, which occurred due to congestion in the Host Information Profile (HIP) report queue. With this fix, User-ID information distributes without delay.

Fixed an issue where shared objects would incorrectly remain visible in the commit scope on Panorama after a successful push operation, which led to objects appearing as pending changes even though they were already applied to the managed firewalls. With this fix, Panorama correctly reflects the state of pushed configurations.

Fixed an issue where the GlobalProtect app intermittently did not connect to the gateway under aggressive TCP port reuse conditions. With this fix, the GlobalProtect app connects to the gateway reliably under these conditions.

(PA-7500 firewalls only) Fixed an issue where session information was not being logged in the dp-monitor logs. With this fix, session information is now correctly logged.

(PA-7500 firewalls only) Fixed an issue where zone protection threshold values per dataplane were unexpectedly low.

Fixed an issue where the all_task process stopped responding and caused the firewall to reboot unexpectedly.

Fixed an issue where the firewall silently rebooted due to the DDR memory operating at 1866 MHz. With this fix, the frequency is reduced to 1600 MHz to improve device stability.

(PA-VM KVM firewalls only) Fixed an issue where the Data Handling Agent (DHA) process crashed after an IPv6 address was configured on a loopback interface, High Availability was enabled, and the firewall was rebooted.

Fixed an issue where packets that had completed processing would not be sent out, which occurred because an internal optimization mechanism did not properly flush the transmit queue under certain traffic conditions. With this fix, packets are consistently transmitted.

(PA-VM firewalls only) Fixed an issue where routing protocols stopped working, which prevented routing protocol daemons from starting and applying configurations. With this fix, routing protocols function as expected.

Fixed an issue where dataplane interfaces went down and configurations were lost after a reboot.

Fixed an issue where VXLAN traffic failed and packet loss occurred in networks sensors after upgrading to an affected release.

Fixed an issue where the traffic log user interface displayed an error when accessed. With this fix, the traffic log user interface functions as expected.