Fixes were made to address the following CVEs:

• CVE-2026-0322
• CVE-2026-0321
• CVE-2026-0320
• CVE-2026-0319
• CVE-2026-0318

(PA-5440 firewalls only) Fixed an issue where SaaS applications were incorrectly blocked even when a higher-order security rule should have allowed the traffic, which occurred due to an unexpected policy rematch behavior. With this fix, security policy rules are correctly applied during policy rematch, ensuring expected traffic flow.

Fixed an issue where firewalls intermittently lost their connection to the Strata Logging Service, which caused logging to stop until the connection was re-established. With this fix, firewalls maintain a stable connection to the Strata Logging Service.

Fixed an issue where firewalls intermittently disconnected from SLS. With this fix, firewalls maintained a stable connection to SLS.

(PA-VM firewalls only) Fixed an issue where registered IP-Tag mappings did not correctly populate Dynamic Address Group (DAG) membership after an upgrade, which caused security policy rule mismatches and traffic to be incorrectly dropped. With this fix, DAG membership correctly reflected registered IP-Tag mappings, ensuring proper security policy enforcement.

(PA-5440 firewalls only) Fixed an issue where traffic designated for no decryption was unexpectedly denied due to a certificate validation error. With this fix, traffic designated for no decryption is processed as expected.

Fixed an issue where firewalls would intermittently disconnect from SLS. With this fix, connections to SLS remain stable.

Fixed an issue where the firewall experienced high management plane memory utilization, which led to inaccessibility of the management interfaces (Web GUI, CLI, and console), disconnection from the High Availability (HA) cluster, and repeated reboot cycles. This behavior occurred after attempting to upgrade the PAN-OS software and applying or restoring the firewall configuration. With this fix, the firewall maintains stability and completes software upgrades successfully.

Fixed an issue where requesting logging service forwarding certification information via the CLI did not work.

(PA-3420 firewalls only) Fixed an issue where the explicit proxy service would unexpectedly terminate when processing Kerberos authentication bypass traffic over extended periods. With this fix, the explicit proxy service maintains stability under these conditions.