Fixes were made to address the following CVEs:

• CVE-2026-0322
• CVE-2026-0321
• CVE-2026-0320
• CVE-2026-0319
• CVE-2026-0318

(RN-HP firewalls only) Fixed an issue where packet buffer resources would leak during a temporary surge in packet buffer usage, which caused tunnels to become unavailable. With this fix, packet buffer resources are managed correctly during periods of high usage.

Fixed an issue where GlobalProtect clients would fail to obtain a private IP address during configuration loading, which prevented successful connections when Customer Identity and Access Management (CIAM) was enabled. With this fix, GlobalProtect clients can successfully obtain private IP addresses.

Fixed an issue where enabling packet capture with non-matching filters caused Geneve tunnels to go down. Tunnels now remain operational as expected when packet capture is active.

(Prisma Access GlobalProtect gateway nodes) Fixed an issue where commit operations experienced significant delays, which occurred because a configuration parsing process stalled during commit. With this fix, commit operations complete within expected timeframes.

Fixed an issue where traffic for certain websites was incorrectly matched to a security policy, preventing access for users when using specific web browsers, which occurred because the firewall used a generic session category for policy matching. With this fix, traffic correctly matches the intended security policy.

(Prisma Access GlobalProtect Gateways only) Fixed an issue where a deleted custom anti-spyware signature continued to block traffic after a successful commit operation, which caused the dataplane to incorrectly enforce the deleted signature. With this fix, the dataplane correctly removed deleted signatures and enforced the updated policy.

Fixed an issue where a firewall became non-functional when dataplane and control plane monitoring processes exited due to missed heartbeats, which occurred after a dataplane crash. With this fix, the firewall maintained operational stability.

(PA-440 and PA-220 firewalls only) Fixed an issue where SNMP-reported ingress traffic statistics for tunnel interfaces were approximately doubled after a PAN-OS upgrade, which led to inaccurate monitoring data. With this fix, SNMP traffic statistics for tunnel interfaces now report accurate ingress traffic.

Fixed an issue where traffic to multiple websites intermittently encountered a block page, which occurred because traffic was incorrectly matched to a default security policy instead of the intended allow policy. With this fix, traffic is processed according to the configured security policies.

Fixed an issue where the firewall intermittently stopped forwarding traffic to the internet.

Fixed an issue where a TLSv1.3 handshake did not complete when SSL Forward Proxy was enabled. This occurred when a large ClientHello message was split across multiple TCP segments and the final segment contained only one byte.

(Firewalls in FIPS mode only) Fixed decryption issues that occurred after an upgrade to an affected release.

To enable this fix, run the CLI command debug dataplane set ssl-decrypt low-memory-throttle enable.

Fixed an issue where the firewall placed UDP sessions into a Discard state when a DNS Sinkhole/Block action occurred, which prevented subsequent DNS requests from reusing the same session and caused DNS-related outages.

Fixed an issue where the firewall's certificate verification logic did not support the RSASSA-PSS signature algorithm, which prevented proper validation of certificates using this algorithm. With this fix, the firewall can verify certificates signed with RSASSA-PSS. RSASSA-PSS support is disabled by default. Use the following operational mode command to enable it on each firewall: set system setting ssl-decrypt support-rsa-pss > no disable (default) > yes enable