Fixes were made to address the following CVEs:

• CVE-2026-0331
• CVE-2026-0330 (Panorama)
• CVE-2026-0329
• CVE-2026-0328

Fixed an issue where Anti-virus content packages do not appear under Device > Dynamic Updates when you select Check Now on firewalls licensed exclusively with an Advanced Threat Prevention Plus add-on. The web interface does not check for or display available Anti-virus updates because it does not recognize the Advanced Threat Prevention Plus license as a valid entitlement for Anti-virus content.

Fixed an issue where the Inline Cloud Analysis tab does not appear in the Vulnerability Protection profile in the web interface on firewalls licensed exclusively with the Advanced Threat Prevention Plus add-on. The Advanced Threat Prevention Plus license is a unified license that enables Threat Prevention and Advanced Threat Prevention features, as well as Frontier Virtual Patching, but the web interface does not recognize it as a valid entitlement for the Inline Cloud Analysis configuration. The underlying Inline Cloud Analysis functionality is not affected, however, the web interface tab is unavailable for configuration.

Fixed an issue where the licensing message on the Security Profiles page does not list Advanced Threat Prevention Plus as a valid license option firewalls without a Threat Prevention or Advanced Threat Prevention license. The message references only Threat Prevention and Advanced Threat Prevention, which may cause confusion for customers who have an Advanced Threat Prevention Plus add-on.

Fixed an issue where WildFire submission logs incorrectly displayed multiple files with different names as having the same file digest, which led to inaccurate malicious verdicts and prevented the display of analysis reports for those files. With this fix, WildFire accurately identifies and logs unique file digests and provides correct analysis reports.

(PA-VM firewalls in an Azure environment with 3 data plane interfaces in an HA configuration) Fixed an issue where the Accelerated Networking status was incorrectly displayed as disabled on a data plane interface of a passive virtual machine after a reboot, which occurred when the Data Plane Development Kit (DPDK) was disabled. With this fix, the Accelerated Networking status is reported accurately.

Fixed an issue where the graphical user interface (GUI) displayed an incorrect count of blocked categories for User Credential Submission in the default URL filtering profile and in unedited URL filtering profiles copied from the default profile. With this fix, the GUI now accurately reflects the number of blocked categories.

(Firewalls in active/passive HA configuration only) Fixed an issue where DHCP clients on interfaces remained in a rebooting state long after a device reboot or failover, which was caused by a race condition. With this fix, DHCP clients properly acquired IP addresses after reboots or failovers.

(PA-VM KVM firewalls only) Fixed an issue where the Data Handling Agent (DHA) process crashed after an IPv6 address was configured on a loopback interface, High Availability was enabled, and the firewall was rebooted.

Fixed an issue where packets that had completed processing would not be sent out, which occurred because an internal optimization mechanism did not properly flush the transmit queue under certain traffic conditions. With this fix, packets are consistently transmitted.

Fixed an issue where dataplane interfaces went down and configurations were lost after a reboot.

(VM-Series firewalls with multiple NICs only) Fixed an issue were the queue count in the task dump displayed an incorrect number of queues for SR-IOV interfaces due to the queue mapping logic incorrectly using a non-multi-NIC function.

Fixed an issue on Panorama where software images were not purged from the /opt/pancfg/mgmt/sw-images folder.

(VM-Series firewalls only) Fixed an issue where the task-queue dump CLI command returned incorrect information in multi-nic mode.