Fixes were made to address the following CVEs:

• CVE-2026-0331
• CVE-2026-0330 (Panorama)
• CVE-2026-0329
• CVE-2026-0328
• CVE-2026-0327
• CVE-2026-0326
• CVE-2026-0325

Fixed an issue where Anti-virus content packages do not appear under Device > Dynamic Updates when you select Check Now on firewalls licensed exclusively with an Advanced Threat Prevention Plus add-on. The web interface does not check for or display available Anti-virus updates because it does not recognize the Advanced Threat Prevention Plus license as a valid entitlement for Anti-virus content.

Fixed an issue where the Inline Cloud Analysis tab does not appear in the Vulnerability Protection profile in the web interface on firewalls licensed exclusively with the Advanced Threat Prevention Plus add-on. The Advanced Threat Prevention Plus license is a unified license that enables Threat Prevention and Advanced Threat Prevention features, as well as Frontier Virtual Patching, but the web interface does not recognize it as a valid entitlement for the Inline Cloud Analysis configuration. The underlying Inline Cloud Analysis functionality is not affected, however, the web interface tab is unavailable for configuration.

Fixed an issue where the licensing message on the Security Profiles page does not list Advanced Threat Prevention Plus as a valid license option firewalls without a Threat Prevention or Advanced Threat Prevention license. The message references only Threat Prevention and Advanced Threat Prevention, which may cause confusion for customers who have an Advanced Threat Prevention Plus add-on.

Fixed an issue where NetFlow v9 exports did not include flow termination events for sessions blocked by Layer 7 Security Profiles, which resulted in incomplete NetFlow records for these sessions. With this fix, NetFlow exports now correctly include flow termination events for all sessions.

Fixed an issue where the firewall did not enforce strict Extended Key Usage (EKU) validation during certificate-based Internet Key Exchange (IKE) negotiation, even when the setting to enable strict validation of the peer's extended key use was enabled. With this fix, the firewall now properly enforces strict EKU validation during IKE negotiation.

Fixed an issue where a Panorama commit-all operation unintentionally removed an Open Shortest Path First (OSPF) default-information-originate directive from the firewall configuration when an update to the directive was attempted, which resulted in the loss of default route connectivity for connected networks. With this fix, the firewall correctly retained or updated the OSPF default-information-originate directive during Panorama commit operations.

Fixed an issue where system disk space was rapidly consumed by a log file, and attempts to clear disk space using the cleanup command would not complete. This occurred when internal logging processes encountered data processing errors, which led to continuous log generation and prevented successful disk cleanup operations. With this fix, system logging processes handle data errors gracefully, and disk cleanup operations function as expected.

(Panorama appliances only) Fixed an issue where tracebacks appeared in the raid.log file, accompanied by messages indicating that a redundant array of independent disks (RAID) pair had disappeared. This occurred due to an internal processing error when handling RAID device paths during system boot, which could lead to incorrect reporting of RAID status. With this fix, the system correctly processes RAID device paths, preventing these log errors and ensuring accurate RAID status.

Fixed an issue where the Panorama Push to Devices window displayed an empty or incomplete push scope, even when managed devices were out of sync, which prevented devices from appearing in the push scope after certain configuration changes. With this fix, the push scope accurately displays all relevant devices.

Fixed an issue where WildFire submission logs incorrectly displayed multiple files with different names as having the same file digest, which led to inaccurate malicious verdicts and prevented the display of analysis reports for those files. With this fix, WildFire accurately identifies and logs unique file digests and provides correct analysis reports.

(All firewalls and panorama deployments that include syslog clients in logrcvr/logd) Fixed an issue where traffic logs were not forwarded to CloudWatch. With this fix, traffic logs are forwarded as expected.

(Panorama appliances only) Fixed an issue where the system was unable to add new RAID disks to existing arrays, which resulted in disk pairs remaining in a degraded state. The system would detect the drives but would not properly initialize them for inclusion in the RAID array. With this fix, the system now correctly initializes and adds new RAID disks, allowing for proper array rebuilds.

(PA-VM firewalls in an Azure environment with 3 data plane interfaces in an HA configuration) Fixed an issue where the Accelerated Networking status was incorrectly displayed as disabled on a data plane interface of a passive virtual machine after a reboot, which occurred when the Data Plane Development Kit (DPDK) was disabled. With this fix, the Accelerated Networking status is reported accurately.

(PA-3250 firewalls only) Fixed an issue where firewalls experienced unexpected reboots and transitioned to a high availability (HA) Non-Functional state, which was caused by instability in dataplane processes. With this fix, the firewalls maintain stable operation and HA functionality.

Fixed an issue where the graphical user interface (GUI) displayed an incorrect count of blocked categories for User Credential Submission in the default URL filtering profile and in unedited URL filtering profiles copied from the default profile. With this fix, the GUI now accurately reflects the number of blocked categories.

(Firewalls in active/passive HA configuration only) Fixed an issue where DHCP clients on interfaces remained in a rebooting state long after a device reboot or failover, which was caused by a race condition. With this fix, DHCP clients properly acquired IP addresses after reboots or failovers.

Fixed an issue where using the scp-server-connection command would cause the system to become unresponsive. With this fix, the command now functions as expected.

Fixed an issue where traffic for certain websites was incorrectly matched to a security policy, preventing access for users when using specific web browsers, which occurred because the firewall used a generic session category for policy matching. With this fix, traffic correctly matches the intended security policy.

Fixed an issue where User-ID distribution experienced delays, which occurred due to congestion in the Host Information Profile (HIP) report queue. With this fix, User-ID information distributes without delay.

Fixed an issue where the firewall experienced unexpected process terminations, which resulted in an HA failover and led to the dataplane becoming unresponsive.

Fixed an issue where shared objects would incorrectly remain visible in the commit scope on Panorama after a successful push operation, which led to objects appearing as pending changes even though they were already applied to the managed firewalls. With this fix, Panorama correctly reflects the state of pushed configurations.

(Firewalls in active/passive HA configurations only) Fixed an issue where firewalls repeatedly entered an initialization and suspended state due to changes in a backend URL. With this fix, the firewalls maintained their active state.

Fixed an issue where Zone Protection dropped legitimate TCP scan traffic despite the source IP address being configured in the Source Address Exclusion list, which resulted in the blocked IP address not appearing in the dos-block table. With this fix, Zone Protection correctly applies source address exclusions and displays blocked IP addresses in the dos-block table.

Fixed an issue where a GlobalProtect gateway would not request a Host Information Profile (HIP) report from a client even when the client generated a new MD5 sum, which resulted in the firewall incorrectly determining that a new HIP report was not required and led to outdated information in the HIP match logs. With this fix, the gateway properly requests updated HIP reports when a new MD5 sum is detected.

Fixed an issue where the GlobalProtect app intermittently did not connect to the gateway under aggressive TCP port reuse conditions. With this fix, the GlobalProtect app connects to the gateway reliably under these conditions.

Fixed an issue where the set system setting target-vsys command output displayed the virtual system (vsys) ID in both columns. With this fix, the command output now correctly displayed the vsys ID and the corresponding vsys name.

(Firewalls in active/passive HA configurations only) Fixed an issue where the passive firewall's device certificate failed to automatically renew when the custom service route through data interface configured only for paloalto-networks-services but not for dns service. This occurred due to a logic error that caused the passive device to attempt a direct renewal through its own inactive data interface instead of properly tunneling the renewal through the active device via the HA1 interface. Because data ports cannot forward traffic on a passive firewall, the connection timed out, preventing automatic renewal.

Fixed an issue where the DHCP server would become unresponsive. With this fix, the DHCP server now operates as expected.

(PA-7500 firewalls only) Fixed an issue where session information was not being logged in the dp-monitor logs. With this fix, session information is now correctly logged.

(Firewalls in active/passive HA configurations only) Fixed an issue where both firewalls stopped responding and initiated multiple failovers when internal processes became unresponsive.

Fixed an issue where the firewall silently rebooted due to the DDR memory operating at 1866 MHz. With this fix, the frequency is reduced to 1600 MHz to improve device stability.

(PA-VM KVM firewalls only) Fixed an issue where the Data Handling Agent (DHA) process crashed after an IPv6 address was configured on a loopback interface, High Availability was enabled, and the firewall was rebooted.

Fixed an issue where packets that had completed processing would not be sent out, which occurred because an internal optimization mechanism did not properly flush the transmit queue under certain traffic conditions. With this fix, packets are consistently transmitted.

(PA-VM firewalls only) Fixed an issue where routing protocols stopped working, which prevented routing protocol daemons from starting and applying configurations. With this fix, routing protocols function as expected.

Fixed an issue where dataplane interfaces went down and configurations were lost after a reboot.

Fixed an issue where the traffic log user interface displayed an error when accessed. With this fix, the traffic log user interface functions as expected.