Fixes were made to address the following CVEs:

• CVE-2026-0322
• CVE-2026-0321
• CVE-2026-0320
• CVE-2026-0319
• CVE-2026-0318

(PA-5440 firewalls only) Fixed an issue where SaaS applications were incorrectly blocked even when a higher-order security rule should have allowed the traffic, which occurred due to an unexpected policy rematch behavior. With this fix, security policy rules are correctly applied during policy rematch, ensuring expected traffic flow.

Fixed an issue where a commit to add a new tunnel interface to an existing Virtual Router caused BGP routes to be temporarily withdrawn, which led to active traffic sessions being routed over incorrect paths during the commit window. With this fix, adding a tunnel interface to an existing Virtual Router no longer disrupts BGP route availability.

Fixed an issue where firewalls intermittently lost their connection to the Strata Logging Service, which caused logging to stop until the connection was re-established. With this fix, firewalls maintain a stable connection to the Strata Logging Service.

Few configs which pushed from SCM to firewall were causing the firewall to loose its internet connectivity and the firewall wasn't able to connect to cloud and was getting stuck at discovery stage retrying indefinitely without returning failure. And now ACR performs the the config rollback once the 5 cloud connectivity check attempts failed.

(Panorama M-600 appliances only) Fixed an issue where device telemetry uploads would fail on the Panorama, which led to critical alerts in the system logs. With this fix, telemetry data uploads complete successfully.

Fixed an issue where connections to the Strata Logging Service (SLS) flapped frequently, which resulted in duplicate logs. With this fix, connections to the Strata Logging Service remained stable.

Fixed an issue where commit validation on Panorama unexpectedly applied template configuration changes to the firewall, which led to an outage of FQDN resolution. With this fix, commit validation no longer alters firewall behavior.

(PA-VM firewalls only) Fixed an issue where registered IP-Tag mappings did not correctly populate Dynamic Address Group (DAG) membership after an upgrade, which caused security policy rule mismatches and traffic to be incorrectly dropped. With this fix, DAG membership correctly reflected registered IP-Tag mappings, ensuring proper security policy enforcement.

(PA-5440 firewalls only) Fixed an issue where traffic designated for no decryption was unexpectedly denied due to a certificate validation error. With this fix, traffic designated for no decryption is processed as expected.

(PA-400 Series Firewalls) Fixed an issue where firewalls rebooted unexpectedly after an upgrade. With this fix, firewalls now operate stably after an upgrade.

Fixed an issue where firewalls would intermittently disconnect from SLS. With this fix, connections to SLS remain stable.

Fixed an issue where the firewall experienced high management plane memory utilization, which led to inaccessibility of the management interfaces (Web GUI, CLI, and console), disconnection from the High Availability (HA) cluster, and repeated reboot cycles. This behavior occurred after attempting to upgrade the PAN-OS software and applying or restoring the firewall configuration. With this fix, the firewall maintains stability and completes software upgrades successfully.

Fixed an issue where critical alerts related to registered IP address updates appeared in system logs even when User-ID was not configured due to a conflict during simultaneous updates of IP tags and EDLs.

To enable this fix, run the CLI command debug user-id regip-max-update-retry rate <value> with a value between 30 and 300.

Fixed an issue where high memory utilization occurred in the escd process. With this fix, memory utilization for the process remained stable.

Fixed an issue where requesting logging service forwarding certification information via the CLI did not work.

Fixed an issue where Real-time Transport Protocol (RTP) packets were dropped after an upgrade, which occurred due to a predict session conversion failure and resulted in delayed or absent video streams. With this fix, RTP packets are processed correctly, and video streams display without delay.

Fixed an issue where SSL traffic was silently dropped when traffic was processed by a Security policy with an Anti-Spyware profile that had Inline cloud Analysis enabled for SSL C2 Detector with an action other than allow or alert.

Fixed an issue where configuring security policies with IP External Dynamic Lists (EDLs) across multiple Virtual Systems (vsys) would prevent commit operations from completing, which was due to an incorrect virtual system memory calculation. With this fix, commit operations complete as expected.

Fixed an issue where firewalls did not correctly apply SD-WAN policy rules, which caused traffic to be incorrectly routed via local breakout instead of VPN backhaul.

(PA-3420 firewalls only) Fixed an issue where the explicit proxy service would unexpectedly terminate when processing Kerberos authentication bypass traffic over extended periods. With this fix, the explicit proxy service maintains stability under these conditions.