Fixes were made to address the following CVEs:

• CVE-2026-0283
• CVE-2026-0287
• CVE-2026-0279
• CVE-2026-0282
• CVE-2026-0288
• CVE-2026-0286
• CVE-2026-0285
• CVE-2026-0280
• CVE-2026-0284
• CVE-2026-0281

Fixed an issue where a firewall functioning as an Area Border Router did not correctly translate NSSA Type-7 LSAs to Type-5 LSAs when OSPF neighbors set the Nt bit in the NSSA Area, and routes were not advertised to upstream OSPF neighbors in the backbone area, which resulted in traffic being silently discarded.

Fixed an issue where device telemetry intermittently failed to send files, which resulted in critical alerts in system files.

Fixed an issue where the interface remained down after an upgrade.

Fixed an issue where internal and external DNS names did not resolve when connected to a GlobalProtect gateway.

(Panorama virtual appliances in AWS environments only) Fixed an issue where logging disks failed to mount or reported an unknown file system type.

Fixed an issue where, after upgrading to PAN-OS 12.1.5, GlobalProtect Clientless VPN failed to access JavaScripts.

(Cloud IPS only) Increased scale limit for zone mappings.

Fixed an issue where External Dynamic List (EDL) refresh and commit operations remained in a pending state, which prevented any subsequent operations from completing.

Fixed an issue where SSL traffic was silently dropped when traffic was processed by a Security policy with an Anti-Spyware profile that had Inline cloud Analysis enabled for SSL C2 Detector with an action other than allow or alert.

Fixed an issue where SCM did not update device telemetry for the firewall after upgrading to an affected release.

VM-Series firewalls in Hyper-V only) Fixed an issue where the throughput was reported to be twice as high as the actual traffic rate.

Fixed an issue on Panorama where selective push operations failed when plugin configurations included access-domain or log-collector references.

Fixed an issue where high throughput and increased packet rates caused high dataplane CPU usage.

Fixed an issue where SIP sessions stopped progressing after the firewall received fragmented packets, fragmented at header field.

(VM-Series firewalls on ESXi with Intel E810 NICs using PCI passthrough) Fixed an issue where the brdagent process became unresponsive during data port initialization, which resulted in system instability, interface outages, HA split-brain conditions, and unexpected reboots during failover.

Fixed an issue where GlobalProtect pre-logon tunnel session was not cleared even after the user was logged in. With this fix, the session is cleared after the session timeout expires.

Fixed an issue where GlobalProtect throughput was reduced after an upgrade.

Fixed an issue where, when a push operation from Panorama to the firewall failed, accounting logs stopped forwarding.

Fixed an issue where the GlobalProtect portal became inaccessible when the dataplane was configured with a DHCP assigned IP address.

Fixed an issue where traffic was disrupted during IPSec rekey operations due to a 2 second delay in sending the DELETE message for the previous Security Association (SA) to the peer gateway after a new SA was negotiated.

Fixed an issue where the firewall did not decapsulate GENEVE packets when DNS Security retransmitted a DNS query after receiving a verdict from the cloud.

(PA-1400 Series firewalls in HA configurations only) Fixed an issue where a split-brain condition occurred and HA1/HA2 links went down while upgrading when the HA configuration used dataplane interfaces for HA1 and a combination of HSCI and Ethernet interfaces for HA2.

Fixed an issue where the firewall did not forward traffic due to memory issues on a forwarding component.

(Firewalls in active/passive HA configurations only) Fixed an issue where the Clientless VPN applications failed to load due to the firewall dataplane incorrectly processing session information.

Fixed an issue where the reportd process stopped responding, which caused the firewall to reboot.

Fixed an issue where a memory leak occurred related to the ospfd process, which caused RAM usage to continuously increase until the device stopped responding.

Fixed an issue where the device-telemetry collect-now process became unresponsive when the process was initiated multiple times with other processes running concurrently, which prevented subsequent telemetry collection.

Fixed an issue where the all_task process stopped responding and caused the firewall to reboot unexpectedly.

Fixed an issue where software packet buffers were completely utilized when performing a Data Loss Prevention longevity test.

(Firewalls in active/passive configurations only) Fixed an issue where NTP status intermittently showed as rejected on the active firewall, which prevented the firewalls from synchronizing time.

(Firewalls in active/active HA configurations only) Fixed an issue where tunnels failed to come up with the error message failed to find a socket for transmission.

Added a debug CLI command to address where remote networks for Prisma Access tenants randomly dropped monitoring packets from peer devices, which caused tunnels to be marked as down. This occurred when a CPU core suddenly experienced high utilization.

To utilize this fix, run debug dataplane set ssl-decrypt use-new-peek-window yes.

Fixed an issue where an External Dynamic List (EDL) fetch with an invalid certificate was skipped on newly provisioned GlobalProtect gateway instances.

Fixed an issue where the logrcvr process on a firewall stopped responding due to a document node being unexpectedly freed.

Fixed an issue where the pan_comm process stopped after multiple content versions were installed and the memory limits were reached.

Fixed an issue where the firewall continuously rebooted when the useridd process repeatedly restarted.

Fixed an issue where policy cache corruption led to unexpected policy rule behavior or operational instability. This occurred when an internal system process restarted while a commit was in progress or when a commit operation failed.

Fixed an issue where memory leaks on the configd process occurred due to a hash insert operation failing during connection management and SSL connections.

Fixed an issue where memory leaks occurred. These leaks were caused by two distinct scenarios: the failure to deallocate memory for a nodeset when a new nodeset was assigned to the same variable, and the failure to free a UUID hash table during error conditions.

Fixed an issue where DLP logs accumulated in the logrcvr cache when using DLP in mirror mode.

Fixed an issue on Panorama where Rule Usage and Apps Seen under Security policy rules stopped incrementing.

Fixed an issue where commit operations took longer than expected to complete due to EDL timeouts occurring on passive nodes when a service route was enabled.