Fixes were made to address the following CVEs:

• CVE-2026-0322
• CVE-2026-0321
• CVE-2026-0320
• CVE-2026-0319
• CVE-2026-0318

(PA-5420 firewalls only) Fixed an issue where OSPFv3 routes were not established on a peer device because the firewall incorrectly handled route tags during advertisement. With this fix, route tags are handled correctly.

(PA-5420 firewalls in active/passive High Availability (HA) configuration only) Fixed an issue where the Forwarding Information Base (FIB) would become stale after HA failover events, routine configuration commits, or Equal-Cost Multi-Path (ECMP) toggles, which led to traffic blackholing. This occurred due to connection refusals between the routing control plane and the forwarding plane. With this fix, routing entries are reliably synchronized to the forwarding plane.

(M-700 firewalls in an HA configuration only) Fixed an issue where Panorama was unable to display logs when Elasticsearch was not running. With this fix, logs display as expected.

Fixed an issue where device telemetry uploads would fail, which led to critical alerts in the system logs. With this fix, telemetry data uploads complete successfully.

(PA-VM firewalls only) Fixed an issue where the firewall unexpectedly rebooted, which occurred during Geneve protocol traffic processing. With this fix, the firewall operates stably.

Fixed an issue where the proxy generated HTTP 503 errors for multiple URLs, which prevented users from connecting to servers. With this fix, the proxy now functions as expected.

(Prisma Access GlobalProtect gateway nodes) Fixed an issue where commit operations experienced significant delays, which occurred because a configuration parsing process stalled during commit. With this fix, commit operations complete within expected timeframes.

Fixed an issue where traffic for certain websites was incorrectly matched to a security policy, preventing access for users when using specific web browsers, which occurred because the firewall used a generic session category for policy matching. With this fix, traffic correctly matches the intended security policy.

Fixed an issue where commit validation on Panorama unexpectedly applied template configuration changes to the firewall, which led to an outage of FQDN resolution. With this fix, commit validation no longer alters firewall behavior.

(PA-3410 firewalls only) Fixed an issue where the firewall incorrectly directed return Session Initiation Protocol (SIP) traffic to an unintended destination, which prevented new SIP sessions from establishing. With this fix, the firewall correctly forwards return SIP traffic. To enable this fix, disable software cut-through.

Fixed an issue where a process remained in a recursive loop when processing queued packets after hold mode was disengaged, particularly when handling ADNS traffic with failed wif-forward responses, which led to system instability. With this fix, the process properly continues packet processing.

Fixed an issue where importing PKCS12 certificates failed with the error Import of certificate and private-key failed. Failed to extract certificate.

(Prisma Access GlobalProtect Gateways only) Fixed an issue where a deleted custom anti-spyware signature continued to block traffic after a successful commit operation, which caused the dataplane to incorrectly enforce the deleted signature. With this fix, the dataplane correctly removed deleted signatures and enforced the updated policy.

Fixed an issue where a system log was not generated when the proxy reached its session limit.

Fixed an issue where GlobalProtect iOS users were unable to connect due to the firewall incorrectly reporting that the maximum number of users was exceeded, even when the actual number of active users was below the configured limit.

Fixed an issue where a firewall became non-functional when dataplane and control plane monitoring processes exited due to missed heartbeats, which occurred after a dataplane crash. With this fix, the firewall maintained operational stability.

(PA-440 and PA-220 firewalls only) Fixed an issue where SNMP-reported ingress traffic statistics for tunnel interfaces were approximately doubled after a PAN-OS upgrade, which led to inaccurate monitoring data. With this fix, SNMP traffic statistics for tunnel interfaces now report accurate ingress traffic.

Fixed an issue where traffic to multiple websites intermittently encountered a block page, which occurred because traffic was incorrectly matched to a default security policy instead of the intended allow policy. With this fix, traffic is processed according to the configured security policies.

Fixed an issue where firewalls dropped new connections due to session allocation failures, which resulted in service disruption. With this fix, firewalls no longer dropped new connections due to session allocation failures.

Fixed an issue where the firewall intermittently stopped forwarding traffic to the internet.

Fixed an issue where a TLSv1.3 handshake did not complete when SSL Forward Proxy was enabled. This occurred when a large ClientHello message was split across multiple TCP segments and the final segment contained only one byte.

(Firewalls in FIPS mode only) Fixed decryption issues that occurred after an upgrade to an affected release.

To enable this fix, run the CLI command debug dataplane set ssl-decrypt low-memory-throttle enable.

Fixed an issue in SD-WAN deployments where DIA traffic was disrupted when DIA AnyPath was enabled during path transitions from the SD-WAN VIF to the physical interface. With this fix, the drop the packet even on zone change configuration is not needed to prevent interrupted DIA traffic during path switching.

Fixed an issue where the firewall did not redistribute its application routes to BGP peers. This occurred in multi-mesh deployments with the multi-cloud networking feature enabled.

Fixed an issue where the firewall placed UDP sessions into a Discard state when a DNS Sinkhole/Block action occurred, which prevented subsequent DNS requests from reusing the same session and caused DNS-related outages.

Fixed an issue where the Data Plane (DP) continued to write packet-diag logs even when packet-diag logging was disabled.

Fixed an issue where the firewall's certificate verification logic did not support the RSASSA-PSS signature algorithm, which prevented proper validation of certificates using this algorithm. With this fix, the firewall can verify certificates signed with RSASSA-PSS. RSASSA-PSS support is disabled by default. Use the following operational mode command to enable it on each firewall: set system setting ssl-decrypt support-rsa-pss > no disable (default) > yes enable