Fixed an issue where the GlobalProtect client briefly displayed a "Sign-out" option after the application was ended from the task manager and restarted, even when the portal configuration had "Allow users to sign-out" set to "No". This was caused by a race condition during the client's initialization, where the sign-out button was temporarily visible before the portal's configuration to disable it could be loaded.

Fixed an issue where GlobalProtect clients experienced frequent disconnections from GlobalProtect gateways. After being disconnected, users were often unable to reconnect for extended periods, and connection attempts to designated gateways, including those manually selected or identified as 'Best Available', would incorrectly redirect to other gateways.

Fixed an issue where GlobalProtect clients failed to detect captive portals on public Wi-Fi networks, even when the captive portal responded with an HTTP 302 Redirect. This occurred because the GlobalProtect agent expected the HTTP response to be terminated by `\r\n\r\n` as per RFC, but some captive portals did not adhere to this, causing the agent to incorrectly report that no data was received from the captive portal server and thus fail to detect the portal.

Fixed an issue on macOS devices running the GlobalProtect agent and has multiple physical interfaces, when Disable Local Subnet Access (DLSA) feature was active, manually disabling the GlobalProtect agent caused the client to lose routing information. This prevented the client from reaching the GlobalProtect portal or gateway, even though FQDN resolution was successful, resulting in "Network is unreachable" errors and requiring a device reboot to restore connectivity.

Fixed an issue where, on macOS GlobalProtect clients, exclude routes were not properly removed from the system routing table after a PanGPS (GlobalProtect client) crash. This occurred because the routes remained in the macOS kernel, and upon reconnection, the client's `checkExistingExRts()` function only validated the destination and netmask, not the gateway. As a result, these stale routes, pointing to an old or unreachable gateway, were marked as existing and skipped during the reconnection process, leading to a corrupted routing state and preventing correct route injection, especially after a network change.

Fixed an issue where GlobalProtect intermittently displayed a large blank rectangle (bottom right side of the screen) on connection failure on macOS 26 (Tahoe).

Fixed an issue where the GlobalProtect DNS proxy Network Extension on macOS endpoints failed to start due to retaining an incorrect Process ID (PID) for the GlobalProtect app (PanGPA) after PanGPA restarted. This prevented split-tunnel exclude applications from functioning correctly.

Fixed an issue where GlobalProtect users on Prisma Access intermittently experienced "No user mapping" issues across multiple gateways.

Fixed an issue where macOS GlobalProtect clients failed to complete transparent upgrades from a GlobalProtect portal because the download of the upgrade package timed out.

Fixed an issue where macOS GlobalProtect clients (versions 6.2.8 and 6.3.3) were stuck in a connecting state after the macOS device woke up from sleep mode (Modern Standby), particularly when using Certificate or SAML authentication, requiring a manual connection refresh.

Fixed an issue where the GlobalProtect client, specifically versions 6.2.8 and 6.2.6-857, would crash immediately after installation on Microsoft Windows 11 Pro (64-bit) endpoints. The `PanGPA` process would exit due to a null pointer dereference, preventing the client from launching.

Fixed an issue where GlobalProtect clients running version 6.2.8-h2, when initially loading a pre-logon configuration, failed to correctly apply traffic exclusion rules for specified FQDNs (such as Avaya VoIP traffic), causing the excluded traffic to be sent through the GlobalProtect tunnel instead of the physical interface. This occurred because an internal driver event reset a flag, preventing additional IP rules from being set, and was resolved after the GlobalProtect connection was refreshed and the default configuration was loaded.

Fixed an issue where MacOS GlobalProtect clients, when configured for Okta authentication with Prisma Access, intermittently failed to log in after a previous log-off. This failure manifested as an "Okta device not on-line" error, caused by the GlobalProtect client's log-off process not completing gracefully, which resulted in the client service not starting correctly on subsequent login attempts.