Fixes were made to address the following CVEs:

• CVE-2026-0322
• CVE-2026-0321
• CVE-2026-0320
• CVE-2026-0319
• CVE-2026-0318

Fixed an issue where device telemetry uploads would fail, which led to critical alerts in the system logs. With this fix, telemetry data uploads complete successfully.

Fixed an issue where the proxy generated HTTP 503 errors for multiple URLs, which prevented users from connecting to servers. With this fix, the proxy now functions as expected.

(Prisma Access GlobalProtect gateway nodes) Fixed an issue where commit operations experienced significant delays, which occurred because a configuration parsing process stalled during commit. With this fix, commit operations complete within expected timeframes.

Fixed an issue where traffic for certain websites was incorrectly matched to a security policy, preventing access for users when using specific web browsers, which occurred because the firewall used a generic session category for policy matching. With this fix, traffic correctly matches the intended security policy.

(PA-3410 firewalls only) Fixed an issue where the firewall incorrectly directed return Session Initiation Protocol (SIP) traffic to an unintended destination, which prevented new SIP sessions from establishing. With this fix, the firewall correctly forwards return SIP traffic. To enable this fix, disable software cut-through.

(PA-4xx Firewalls) Fixed an issue where firewalls rebooted unexpectedly after an upgrade. With this fix, firewalls now operate stably after an upgrade.

Fixed an issue where a process remained in a recursive loop when processing queued packets after hold mode was disengaged, particularly when handling ADNS traffic with failed wif-forward responses, which led to system instability. With this fix, the process properly continues packet processing.

(Prisma Access GlobalProtect Gateways only) Fixed an issue where a deleted custom anti-spyware signature continued to block traffic after a successful commit operation, which caused the dataplane to incorrectly enforce the deleted signature. With this fix, the dataplane correctly removed deleted signatures and enforced the updated policy.

Fixed an issue where a system log was not generated when the proxy reached its session limit.

Fixed an issue where selective configuration pushes from Panorama failed after an upgrade, which caused shared policy rules to go out of sync. With this fix, selective configuration pushes complete successfully and policies remain in sync.

Fixed an issue where GlobalProtect iOS users were unable to connect due to the firewall incorrectly reporting that the maximum number of users was exceeded, even when the actual number of active users was below the configured limit.

Fixed an issue where a firewall became non-functional when dataplane and control plane monitoring processes exited due to missed heartbeats, which occurred after a dataplane crash. With this fix, the firewall maintained operational stability.

(PA-440 and PA-220 firewalls only) Fixed an issue where SNMP-reported ingress traffic statistics for tunnel interfaces were approximately doubled after a PAN-OS upgrade, which led to inaccurate monitoring data. With this fix, SNMP traffic statistics for tunnel interfaces now report accurate ingress traffic.

Fixed an issue where traffic to multiple websites intermittently encountered a block page, which occurred because traffic was incorrectly matched to a default security policy instead of the intended allow policy. With this fix, traffic is processed according to the configured security policies.

Fixed an issue where firewalls dropped new connections due to session allocation failures, which resulted in service disruption. With this fix, firewalls no longer dropped new connections due to session allocation failures.

Fixed an issue where the firewall intermittently stopped forwarding traffic to the internet.

Fixed an issue where a TLSv1.3 handshake did not complete when SSL Forward Proxy was enabled. This occurred when a large ClientHello message was split across multiple TCP segments and the final segment contained only one byte.

(PA-3420, PA-3430, PA-3440 firewalls only) Fixed an issue where the firewall was unable to activate GlobalProtect client software and displayed SW LIMIT messages related to max-profiles and unsupported major and minor versions in the downgrade list, which prevented successful software installation.

(Firewalls in FIPS mode only) Fixed decryption issues that occurred after an upgrade to an affected release.

To enable this fix, run the CLI command debug dataplane set ssl-decrypt low-memory-throttle enable.

Fixed an issue in SD-WAN deployments where DIA traffic was disrupted when DIA AnyPath was enabled during path transitions from the SD-WAN VIF to the physical interface. With this fix, the drop the packet even on zone change configuration is not needed to prevent interrupted DIA traffic during path switching.

Fixed an issue where the firewall placed UDP sessions into a Discard state when a DNS Sinkhole/Block action occurred, which prevented subsequent DNS requests from reusing the same session and caused DNS-related outages.

Fixed an issue where the Data Plane (DP) continued to write packet-diag logs even when packet-diag logging was disabled.

Fixed an issue where the firewall's certificate verification logic did not support the RSASSA-PSS signature algorithm, which prevented proper validation of certificates using this algorithm. With this fix, the firewall can verify certificates signed with RSASSA-PSS. RSASSA-PSS support is disabled by default. Use the following operational mode command to enable it on each firewall: set system setting ssl-decrypt support-rsa-pss > no disable (default) > yes enable