Fixes were made to address the following CVEs:

• CVE-2026-0331
• CVE-2026-0330 (Panorama)
• CVE-2026-0329
• CVE-2026-0328

Fixed an issue where Anti-virus content packages do not appear under Device > Dynamic Updates when you select Check Now on firewalls licensed exclusively with an Advanced Threat Prevention Plus add-on. The web interface does not check for or display available Anti-virus updates because it does not recognize the Advanced Threat Prevention Plus license as a valid entitlement for Anti-virus content.

Fixed an issue where the Inline Cloud Analysis tab does not appear in the Vulnerability Protection profile in the web interface on firewalls licensed exclusively with the Advanced Threat Prevention Plus add-on. The Advanced Threat Prevention Plus license is a unified license that enables Threat Prevention and Advanced Threat Prevention features, as well as Frontier Virtual Patching, but the web interface does not recognize it as a valid entitlement for the Inline Cloud Analysis configuration. The underlying Inline Cloud Analysis functionality is not affected, however, the web interface tab is unavailable for configuration.

Fixed an issue where the licensing message on the Security Profiles page does not list Advanced Threat Prevention Plus as a valid license option firewalls without a Threat Prevention or Advanced Threat Prevention license. The message references only Threat Prevention and Advanced Threat Prevention, which may cause confusion for customers who have an Advanced Threat Prevention Plus add-on.

Fixed an issue where sessions were prematurely terminated due to resource unavailability, which occurred even when the platform had not reached its capacity limits. This issue was observed when decryption was enabled for traffic from multiple remote network sites. With this fix, sessions now utilize available resources correctly and are not prematurely terminated.

(PA-5440 firewalls only) Fixed an issue where SaaS applications were incorrectly blocked even when a higher-order security rule should have allowed the traffic, which occurred due to an unexpected policy rematch behavior. With this fix, security policy rules are correctly applied during policy rematch, ensuring expected traffic flow.

Fixed an issue where the system encountered a parsing error for the Authority Key Identifier (AKID) extension in certificates, which prevented the AKID from being correctly processed when it began with a specific value. With this fix, the AKID extension is now correctly parsed and processed.

Fixed an issue where firewalls intermittently lost their connection to the Strata Logging Service, which caused logging to stop until the connection was re-established. With this fix, firewalls maintain a stable connection to the Strata Logging Service.

(Panorama appliances only) Fixed an issue where tracebacks appeared in the raid.log file, accompanied by messages indicating that a redundant array of independent disks (RAID) pair had disappeared. This occurred due to an internal processing error when handling RAID device paths during system boot, which could lead to incorrect reporting of RAID status. With this fix, the system correctly processes RAID device paths, preventing these log errors and ensuring accurate RAID status.

(Panorama appliances only) Fixed an issue where the system was unable to add new RAID disks to existing arrays, which resulted in disk pairs remaining in a degraded state. The system would detect the drives but would not properly initialize them for inclusion in the RAID array. With this fix, the system now correctly initializes and adds new RAID disks, allowing for proper array rebuilds.

Few configs which pushed from SCM to firewall were causing the firewall to loose its internet connectivity and the firewall wasn't able to connect to cloud and was getting stuck at discovery stage retrying indefinitely without returning failure. And now ACR performs the the config rollback once the 5 cloud connectivity check attempts failed.

(PA-400 Series Firewalls) Fixed an issue where firewalls rebooted unexpectedly after an upgrade. With this fix, firewalls now operate stably after an upgrade.

Fixed an issue where the dataplane silently dropped HTTP POST payloads, which disrupted application integrations. This occurred due to an internal error when processing XFF headers within the CTD engine.

(Firewalls in active/passive HA configurations only) Fixed an issue where Genetec camera streaming experienced lag and dropped video feeds due to the exhaustion of private RTP ports, which led to their accumulation over time. With this fix, the firewall now properly releases private RTP ports, preventing their exhaustion.

Fixed an issue where firewalls would intermittently disconnect from SLS. With this fix, connections to SLS remain stable.

Fixed an issue where high memory utilization occurred in the escd process. With this fix, memory utilization for the process remained stable.

Fixed an issue where Real-time Transport Protocol (RTP) packets were dropped after an upgrade, which occurred due to a predict session conversion failure and resulted in delayed or absent video streams. With this fix, RTP packets are processed correctly, and video streams display without delay.

Fixed an issue where processes restarted and the firewall unexpectedly rebooted when you configured a Security policy rule with Source Device > quarantine.

(Firewalls in HA configurations only) Fixed an issue where autocommit operations took longer than expected to complete when the firewalls were configured with multiple vsys and EDLs. This occurred because the firewalls were unable to reach the DNS server during the autocommit process.

Fixed an issue BGP sessions experienced short disruptions across all peers, interfaces, and slots when a multicast event persisted longer than the NGP negotiated hold timers.

Fixed an issue where a race condition between the session ager and packet processing resulted in memory corruption and caused the pan_task process to stop responding, which resulted in the firewall becoming unresponsive

Fixed an issue where the logrcvr process stopped responding for traffic containing multiple XFF headers when URL XFF header logging was enabled along with additional XFF header logging, which caused subsequent commits to fail.

Fixed an issue where the firewall dataplane continuously accumulated packets in the ctd_pkt_queue and packet buffers, which caused resource exhaustion and prematurely terminated sessions.

Fixed an issue where the Advanced WildFire cloud status would show as disconnected after a software upgrade, which prevented the firewall from maintaining a connection to the service. With this fix, the firewall properly maintained its connection to the Advanced WildFire cloud.

Fixed an issue where the firewall stripped the Authentication Key Identifier (AKID) from certificates using SSL decryption, which prevented clients from authenticating server certificates and resulted in decryption failures.

Fixed an issue where the CLI command request system software download to-version <version> failed to download multiple software images due with a Download terminated due to timeout error message.

(PA-3420 firewalls only) Fixed an issue where the explicit proxy service would unexpectedly terminate when processing Kerberos authentication bypass traffic over extended periods. With this fix, the explicit proxy service maintains stability under these conditions.

Fixed an issue where packets that had completed processing would not be sent out, which occurred because an internal optimization mechanism did not properly flush the transmit queue under certain traffic conditions. With this fix, packets are consistently transmitted.

Fixed an issue where the DNS proxy would intermittently stop resolving DNS queries, which prevented users from accessing the internet, and which was observed during periods of high CPU utilization for the dnsproxy process. With this fix, the DNS proxy consistently resolves queries, ensuring reliable internet access.