Fixes were made to address the following CVEs:

• CVE-2026-0331
• CVE-2026-0330
• CVE-2026-0329
• CVE-2026-0328
• CVE-2026-0327
• CVE-2026-0326
• CVE-2026-0325

(PA-5440 firewalls only) Fixed an issue where SaaS applications were incorrectly blocked even when a higher-order security rule should have allowed the traffic, which occurred due to an unexpected policy rematch behavior. With this fix, security policy rules are correctly applied during policy rematch, ensuring expected traffic flow.

(Virtual machine firewalls only) Fixed an issue where virtual machine (VM) firewalls entered maintenance mode after a PAN-OS® upgrade, which occurred due to an erroneous software integrity test failure. With this fix, VM firewalls no longer incorrectly entered maintenance mode after an upgrade.

Fixed an issue where a newly deployed firewall or a firewall after a factory reset had PAE disabled by default. With this fix, PAE is correctly enabled by default in these scenarios.