---
type: Addressed
product: GlobalProtect
version: 6.2.8-h9
---

## GPC-25324

Fixed an issue where the GlobalProtect client briefly displayed a "Sign-out" option after the application was ended from the task manager and restarted, even when the portal configuration had "Allow users to sign-out" set to "No". This was caused by a race condition during the client's initialization, where the sign-out button was temporarily visible before the portal's configuration to disable it could be loaded.

## GPC-25300

Fixed an issue where GlobalProtect clients experienced frequent disconnections from GlobalProtect gateways. After being disconnected, users were often unable to reconnect for extended periods, and connection attempts to designated gateways, including those manually selected or identified as 'Best Available', would incorrectly redirect to other gateways.

## GPC-25222

Fixed an issue where GlobalProtect clients failed to detect captive portals on public Wi-Fi networks, even when the captive portal responded with an HTTP 302 Redirect. This occurred because the GlobalProtect agent expected the HTTP response to be terminated by `\r\n\r\n` as per RFC, but some captive portals did not adhere to this, causing the agent to incorrectly report that no data was received from the captive portal server and thus fail to detect the portal.

## GPC-25215

Fixed an issue on macOS devices running the GlobalProtect agent and has multiple physical interfaces, when Disable Local Subnet Access (DLSA) feature was active, manually disabling the GlobalProtect agent caused the client to lose routing information. This prevented the client from reaching the GlobalProtect portal or gateway, even though FQDN resolution was successful, resulting in "Network is unreachable" errors and requiring a device reboot to restore connectivity.

## GPC-25172

Fixed an issue where, on macOS GlobalProtect clients, exclude routes were not properly removed from the system routing table after a PanGPS (GlobalProtect client) crash. This occurred because the routes remained in the macOS kernel, and upon reconnection, the client's `checkExistingExRts()` function only validated the destination and netmask, not the gateway. As a result, these stale routes, pointing to an old or unreachable gateway, were marked as existing and skipped during the reconnection process, leading to a corrupted routing state and preventing correct route injection, especially after a network change.

## GPC-25148

Fixed an issue where GlobalProtect intermittently displayed a large blank rectangle (bottom right side of the screen) on connection failure on macOS 26 (Tahoe).

## GPC-25121

Fixed an issue where the GlobalProtect DNS proxy Network Extension on macOS endpoints failed to start due to retaining an incorrect Process ID (PID) for the GlobalProtect app (PanGPA) after PanGPA restarted. This prevented split-tunnel exclude applications from functioning correctly.

## GPC-24845

Fixed an issue where GlobalProtect users on Prisma Access intermittently experienced "No user mapping" issues across multiple gateways.

## GPC-24659

Fixed an issue where macOS GlobalProtect clients failed to complete transparent upgrades from a GlobalProtect portal because the download of the upgrade package timed out.

## GPC-24600

Fixed an issue where macOS GlobalProtect clients (versions 6.2.8 and 6.3.3) were stuck in a connecting state after the macOS device woke up from sleep mode (Modern Standby), particularly when using Certificate or SAML authentication, requiring a manual connection refresh.

## GPC-24538

Fixed an issue where the GlobalProtect client, specifically versions 6.2.8 and 6.2.6-857, would crash immediately after installation on Microsoft Windows 11 Pro (64-bit) endpoints. The `PanGPA` process would exit due to a null pointer dereference, preventing the client from launching.

## GPC-24300

Fixed an issue where GlobalProtect clients running version 6.2.8-h2, when initially loading a pre-logon configuration, failed to correctly apply traffic exclusion rules for specified FQDNs (such as Avaya VoIP traffic), causing the excluded traffic to be sent through the GlobalProtect tunnel instead of the physical interface. This occurred because an internal driver event reset a flag, preventing additional IP rules from being set, and was resolved after the GlobalProtect connection was refreshed and the default configuration was loaded.

## GPC-24006

Fixed an issue where MacOS GlobalProtect clients, when configured for Okta authentication with Prisma Access, intermittently failed to log in after a previous log-off. This failure manifested as an "Okta device not on-line" error, caused by the GlobalProtect client's log-off process not completing gracefully, which resulted in the client service not starting correctly on subsequent login attempts.

## GPC-25637

Fixed an issue where on macOS devices, after upgrading macOS to version 26.3 (from 26.2), the GlobalProtect client was unable to connect and displayed the error "Could not connect to the GlobalProtect service.

## GPC-25196

Fixed an issue where the GlobalProtect client UI on macOS devices would remain open in the dock and sometimes on top of other applications after the device resumed from hibernation or sleep mode. This behavior, observed in GlobalProtect client versions 6.2.8 and 6.3.2, was caused by the `globalClickMonitor` not being reset after the device woke up, preventing the UI from properly minimizing or closing.
