Fixes were made to address the following CVEs:

• CVE-2026-0322
• CVE-2026-0321
• CVE-2026-0320
• CVE-2026-0319
• CVE-2026-0318
• CVE-2026-0317
• CVE-2026-0316

(PA-5440 firewalls only) Fixed an issue where SaaS applications were incorrectly blocked even when a higher-order security rule should have allowed the traffic, which occurred due to an unexpected policy rematch behavior. With this fix, security policy rules are correctly applied during policy rematch, ensuring expected traffic flow.

Fixed an issue where a commit to add a new tunnel interface to an existing Virtual Router caused BGP routes to be temporarily withdrawn, which led to active traffic sessions being routed over incorrect paths during the commit window. With this fix, adding a tunnel interface to an existing Virtual Router no longer disrupts BGP route availability.

Fixed an issue where firewalls intermittently lost their connection to the Strata Logging Service, which caused logging to stop until the connection was re-established. With this fix, firewalls maintain a stable connection to the Strata Logging Service.

(M-700 firewalls in an HA configuration only) Fixed an issue where Panorama was unable to display logs when Elasticsearch was not running. With this fix, logs display as expected.

(Panorama-VM) Fixed an issue where adding an interface to a logical router on Panorama via the interface configuration removed other interfaces from the logical router, which occurred when the interface was added through the interface configuration rather than the logical router configuration. With this fix, interfaces are retained as expected.

Few configs which pushed from SCM to firewall were causing the firewall to loose its internet connectivity and the firewall wasn't able to connect to cloud and was getting stuck at discovery stage retrying indefinitely without returning failure. And now ACR performs the the config rollback once the 5 cloud connectivity check attempts failed.

Fixed an issue where communication with Microsoft Azure services was disrupted, which resulted in application outages. This occurred when firewalls dropped SYN-ACK packets that were part of a SYN-ACK cookie mechanism activated by Azure's DDoS mitigation. With this fix, firewalls now maintain connectivity during such traffic events.

(Panorama M-600 appliances only) Fixed an issue where device telemetry uploads would fail on the Panorama, which led to critical alerts in the system logs. With this fix, telemetry data uploads complete successfully.

Fixed an issue where connections to the Strata Logging Service (SLS) flapped frequently, which resulted in duplicate logs. With this fix, connections to the Strata Logging Service remained stable.

Fixed an issue where commit validation on Panorama unexpectedly applied template configuration changes to the firewall, which led to an outage of FQDN resolution. With this fix, commit validation no longer alters firewall behavior.

Fixed an issue where commit operations failed due to redis idmgr connection leaks. With this fix, commit operations complete as expected.

(PA-VM firewalls only) Fixed an issue where registered IP-Tag mappings did not correctly populate Dynamic Address Group (DAG) membership after an upgrade, which caused security policy rule mismatches and traffic to be incorrectly dropped. With this fix, DAG membership correctly reflected registered IP-Tag mappings, ensuring proper security policy enforcement.

(PA-5440 firewalls only) Fixed an issue where traffic designated for no decryption was unexpectedly denied due to a certificate validation error. With this fix, traffic designated for no decryption is processed as expected.

(PA-400 Series Firewalls) Fixed an issue where firewalls rebooted unexpectedly after an upgrade. With this fix, firewalls now operate stably after an upgrade.

Fixed an issue where Panorama did not automatically resume syslog forwarding over TCP after the syslog server became unavailable or was restarted.

(Firewalls in active/passive HA configurations only) Fixed an issue where Genetec camera streaming experienced lag and dropped video feeds due to the exhaustion of private RTP ports, which led to their accumulation over time. With this fix, the firewall now properly releases private RTP ports, preventing their exhaustion.

Fixed an issue where firewalls would intermittently disconnect from SLS. With this fix, connections to SLS remain stable.

Fixed an issue where the firewall experienced high management plane memory utilization, which led to inaccessibility of the management interfaces (Web GUI, CLI, and console), disconnection from the High Availability (HA) cluster, and repeated reboot cycles. This behavior occurred after attempting to upgrade the PAN-OS software and applying or restoring the firewall configuration. With this fix, the firewall maintains stability and completes software upgrades successfully.

Fixed an issue where critical alerts related to registered IP address updates appeared in system logs even when User-ID was not configured due to a conflict during simultaneous updates of IP tags and EDLs.

To enable this fix, run the CLI command debug user-id regip-max-update-retry rate <value> with a value between 30 and 300.

Fixed an issue where high memory utilization occurred in the escd process. With this fix, memory utilization for the process remained stable.

Fixed an issue where Real-time Transport Protocol (RTP) packets were dropped after an upgrade, which occurred due to a predict session conversion failure and resulted in delayed or absent video streams. With this fix, RTP packets are processed correctly, and video streams display without delay.

Fixed an issue where GlobalProtect authentication override cookie lifetimes were implicitly limited by the configured login lifetime, which prevented administrators from setting a longer override period. With this fix, the GlobalProtect authentication override cookie lifetime can be configured to extend beyond the login lifetime. To enable this fix, an operational command is available to revert to the previous behavior.

Fixed an issue where configuring security policies with IP External Dynamic Lists (EDLs) across multiple Virtual Systems (vsys) would prevent commit operations from completing, which was due to an incorrect virtual system memory calculation. With this fix, commit operations complete as expected.

(PA-3420 firewalls only) Fixed an issue where the explicit proxy service would unexpectedly terminate when processing Kerberos authentication bypass traffic over extended periods. With this fix, the explicit proxy service maintains stability under these conditions.