Fixes were made to address the following CVEs:

• CVE-2026-0322
• CVE-2026-0321
• CVE-2026-0320
• CVE-2026-0319
• CVE-2026-0318

(PA-5440 firewalls only) Fixed an issue where SaaS applications were incorrectly blocked even when a higher-order security rule should have allowed the traffic, which occurred due to an unexpected policy rematch behavior. With this fix, security policy rules are correctly applied during policy rematch, ensuring expected traffic flow.

Fixed an issue where firewalls intermittently lost their connection to the Strata Logging Service, which caused logging to stop until the connection was re-established. With this fix, firewalls maintain a stable connection to the Strata Logging Service.

Fixed an issue where firewalls intermittently disconnected from SLS. With this fix, firewalls maintained a stable connection to SLS.

Fixed an issue where connections to the Strata Logging Service (SLS) flapped frequently, which resulted in duplicate logs. With this fix, connections to the Strata Logging Service remained stable.

Fixed an issue where commit validation on Panorama unexpectedly applied template configuration changes to the firewall, which led to an outage of FQDN resolution. With this fix, commit validation no longer alters firewall behavior.

(PA-VM firewalls only) Fixed an issue where registered IP-Tag mappings did not correctly populate Dynamic Address Group (DAG) membership after an upgrade, which caused security policy rule mismatches and traffic to be incorrectly dropped. With this fix, DAG membership correctly reflected registered IP-Tag mappings, ensuring proper security policy enforcement.

(PA-5440 firewalls only) Fixed an issue where traffic designated for no decryption was unexpectedly denied due to a certificate validation error. With this fix, traffic designated for no decryption is processed as expected.

(PA-400 Firewalls) Fixed an issue where firewalls rebooted unexpectedly after an upgrade. With this fix, firewalls now operate stably after an upgrade.

Fixed an issue where firewalls would intermittently disconnect from SLS. With this fix, connections to SLS remain stable.

Fixed an issue where critical alerts related to registered IP address updates appeared in system logs even when User-ID was not configured due to a conflict during simultaneous updates of IP tags and EDLs.

To enable this fix, run the CLI command debug user-id regip-max-update-retry rate <value> with a value between 30 and 300.

Fixed an issue where high memory utilization occurred in the escd process. With this fix, memory utilization for the process remained stable.

Fixed an issue where requesting logging service forwarding certification information via the CLI did not work.

Fixed an issue where Real-time Transport Protocol (RTP) packets were dropped after an upgrade, which occurred due to a predict session conversion failure and resulted in delayed or absent video streams. With this fix, RTP packets are processed correctly, and video streams display without delay.

Fixed an issue where configuring security policies with IP External Dynamic Lists (EDLs) across multiple Virtual Systems (vsys) would prevent commit operations from completing, which was due to an incorrect virtual system memory calculation. With this fix, commit operations complete as expected.