---
type: Addressed
product: PAN-OS
version: 8.1.17
source: common-crawl
crawl: CC-MAIN-2026-12
---

## BLANK-000000

A security issue has been fixed ([CVE-2021-3064](https://security.paloaltonetworks.com/CVE-2021-3064)).

## PAN-154181

Fixed an issue where, on Panorama, context switching to the web interface of a managed firewall running PAN-OS 8.1.16 did not work.

## PAN-153813

Fixed an issue where the proxy configuration did not get honored, which caused certificate revocation list (CRL) checks to fail from the firewall.

## PAN-152285

Fixed an issue where certain GPRS tunneling protocol (GTP-U) sessions that could not complete installation still occupied the flow table, which led to higher session table usage.

## PAN-152106

Fixed an issue where the management plane CPU usage remained high for a longer period of time than expected due to a process (genindex.sh).

## PAN-151405

Fixed an issue where administrators were unable to export Security Assertion Markup Language (SAML) metadata files from virtual system (vsys) specific authentication profiles.

## PAN-151203

Fixed an issue where the firewall dropped certain GTPv1 Update PDP Context packets.

## PAN-151057

Fixed an issue where upgrading the capacity license on a virtual machine (VM) high availability (HA) pair resulted in both firewalls going into a non-functional state instead of only the higher capacity license firewall.

## PAN-150750

```caveat
PA-5200 Series firewalls only
```

Fixed an intermittent issue where the firewall dropped packets when two or more GTP packets on the same GTP tunnel were very close to each other.

## PAN-150748

Fixed an issue where the firewall silently dropped GTPv2-C Delete Session Response packets.

## PAN-150746

Fixed an issue where the firewall dropped GTP packets with Delete Bearer messages for EBI 6 if they were received within two seconds of receiving the Delete Bearer messages for EBI 5.

## PAN-150613

Fixed an issue that caused a process (mprelay) to stop responding when committing changes in the Netflow Server Profile configuration (**Device > Server Profiles > Netflow**).

## PAN-149912

Fixed an issue where FIB entries were removed incorrectly due to miscommunication between internal processes.

## PAN-149839

```caveat
PA-7000 Series firewalls only
```

Added CLI commands to enable/disable resource-control groups and CLI commands to set an upper memory limit of 8G on a process (mgmtsrvr). To enable resource-control groups, use debug software resource-control enable and to disable them, use debug software resource-control disable. To set the memory limit, use debug management-server limit-memory enable, and to remove the limit, use debug management-server limit-memory disable. For the memory limit change to take effect, the firewall must be rebooted.

## PAN-147996

```caveat
PA-7000b Series firewalls only
```

Fixed a buffer overflow issue.

## PAN-147741

Fixed an issue where an API call for correlated events did not return any events.

## PAN-147595

Fixed an issue where, after a policy commit and session rematch, stream control transmission protocol (SCTP) logs for an existing SCTP session still showed old rule information.

## PAN-147305

Fixed an issue where a process (useridd) stopped responding to requests.

## PAN-146650

A fix was made to address an authentication bypass vulnerability in the GlobalProtect SSL VPN component of PAN-OS that allowed an attacker to bypass all client certificate checks with an invalid certificate. As a result, the attacker was able to authenticate as any user and gain access to restricted VPN network resources when the gateway or portal was configured to rely only on certificate-based authentication ([CVE-2020-2050](https://security.paloaltonetworks.com/CVE-2020-2050)).

## PAN-146506

Fixed an issue where memory usage on a process (useridd) was high, which caused the process to restart on the firewall acting as the User-ID redistribution agent. This issue occurred when multiple clients requested IP address-to-user mappings at the same time.

## PAN-146284

Fixed an issue where Application and Threat Content installation failed on the firewall with the following error message: Error: Threat database handler failed.

## PAN-145823

Fixed an issue where BGP learned routes were incorrectly populated with a VR error as a next hop.

## PAN-145133

A fix was made to address a vulnerability in the PAN-OS signature-based threat detection engine that allowed an attacker to evade threat prevention signatures using specifically crafted TCP packets ([CVE-2020-1999](https://security.paloaltonetworks.com/CVE-2020-1999)).

## PAN-144919

Fixed an issue on an M-600 appliance where the Panorama management server stopped receiving new logs from firewalls because delayed log purging caused log storage on the Log Collectors to reach maximum capacity.

## PAN-144448

Fixed an issue with the automated correlation engine that caused firewalls to stop generating correlated event logs for the beacon-heuristics object (ID 6005).

## PAN-143959

Fixed an issue on Panorama where a custom administrator with all rights enabled was not able to display the content of the external dynamic list (EDL) on the Panorama web interface.

## PAN-143809

Fixed an issue where Log Collectors had problems ingesting logs for older days received at a high rate.

## PAN-143241

Fixed an issue where the firewall unexpectedly stopped processing traffic to due a buffer allocation failure under the QOS-based buffer allocation method.

## PAN-141551

Fixed an issue where SSH service restart management did not take effect in the SSH management server profile.

## PAN-140883

Fixed an issue where, after rebooting the firewall, the SNMP object identifier (OID) for TCP connections per second (panVsysActiveTcpCps / .1.3.6.1.4.1.25461.2.1.2.3.9.1.6.1) returned 0 until another OID was pulled. Additionally, after a restart of a daemon (snmpd), if the above OID was called before other OIDs, there was an approximate 10 second delay in populating the data pulled by each OID.

## PAN-140382

Fixed an issue where the Host Evasion Threat ID signature did not trigger for the initial session even after the DNS response was received before the session expired.

## PAN-140375

Fixed an issue where a process (logrcvr) exited due to a race condition.

## PAN-140227

```caveat
PA-7000 Series firewalls only
```

Fixed a rare issue where the firewall rebooted due to path monitoring failure on the Log Processing Card (LPC).

## PAN-140157

A fix was made to address a vulnerability where the password for a configured system proxy server for a PAN-OS appliance was displayed in cleartext when using the CLI in PAN-OS ([CVE-2020-2048](https://security.paloaltonetworks.com/CVE-2020-2048)).

## PAN-139991

Fixed an issue where the web interface and the CLI were inaccessible, which caused the following error message to display on the web interface: Timed out while getting config lock.

## PAN-139680

Fixed an issue where dynamic route updates triggered an unintentional refresh of the DHCP client interface IP address, which led to the removal and re-addition of the default route associated with the DHCP client IP address and caused traffic disruption.

## PAN-139365

```caveat
PA-7000 Series firewalls only
```

Enhanced latency-sensitive protocols processing. With this fix, the following latency-sensitive control traffic will be prioritized: BGP, Bidirectional Forwarding Detection (BFD), LACP, OSPF, OSPFv3, Protocol Independent Multicast (PIM), and Internet Group Management Protocol (IGMP).

## PAN-139233

Fixed an issue where host information profile (HIP) reports failed to show up via the web interface or the CLI.

## PAN-139136

Fixed an issue where a large number of groups in group mappings caused a process (useridd) to exit.

## PAN-138938

Added an enhancement to reduce the memory usage of a process (logrcvr) to avoid out-of-memory (OOM) conditions on lower-end platforms.

## PAN-138573

Fixed an issue where the keyword **[Disabled]** was missing from the disabled policies exported in CSV/PDF format.

## PAN-137741

Fixed an issue where the data for a botnet report was deleted before the botnet report was completed.

## PAN-137656

Fixed an issue where the show config diff CLI command did not work correctly and produced unexpected output.

## PAN-135540

```caveat
PA-3220 firewalls only
```

Fixed an issue where the firewall generated some core files when generating tech support files

## PAN-135354

Fixed an issue where the paths between the control plane and the dataplanes in network processing cards (NPCs) stalled in the dataplane-to-control plane direction due to the Ring Descriptor entries becoming out of sync on each side. This produced unrecoverable data path monitoring failures, which caused the chassis to become nonfunctional.

## PAN-134226

Fixed an issue where **AdminStatus** for HA1 and High Speed Chassis Interconnect (HSCI) interfaces were incorrectly reported.

## PAN-133934

Fixed an intermittent issue where user-to-IP address mappings were not redistributed to client firewalls.

## PAN-133388

Fixed an issue where an HA configuration went out of sync when the HA sync job was queued and processed during an ongoing content installation job on the passive firewall.

## PAN-130955

Fixed an issue where templates on the secondary Panorama appliance were out of sync with the primary Panorama appliance due to an empty content-preview node.

## PAN-130357

Fixed a memory leak issue where virtual memory used by the SNMP process started to slowly increase when the request was sent with a request-id of 0.

## PAN-129376

```caveat
PA-800 Series firewalls only
```

Fixed an issue that prevented ports 9-12 from being powered down by hardware after being requested to do so.

## PAN-128172

Fixed an issue on Panorama where the show system logdb-quota CLI command took more time than expected, which caused the configuration lock to time out.

## PAN-128048

Fixed an issue where certificate-based authentication with IKEv2 IPSec tunnels failed to establish with some third-party vendors.

## PAN-127318

Fixed an issue where the firewall intermittently dropped DNS A or AAAA queries received over IPSec tunnels due to a session installation failure.

## PAN-125218

A fix was made to address an information exposure vulnerability in Panorama that disclosed the token for the Panorama web interface administrator's session to a managed device when the Panorama administrator performed a context switch ([CVE-2020-2022](https://security.paloaltonetworks.com/CVE-2020-2022)).

## PAN-124916

Added two ciphers for GlobalProtect Portal TLS connections.

## PAN-124331

Fixed an issue where the LDAP query took longer than expected to populate in the web interface.

## PAN-122672

Fixed an issue where the firewall returned incorrect information about the logging service status when the information was requested through the web interface.

## PAN-121944

Fixed an issue where the **Device Connectivity** status was grey on the firewall web interface even when the SSL session to the logging service was successful.

## PAN-121483

Fixed an issue where Data Filtering profiles did not generate a packet capture (pcap) for Server Message Block (SMB) when action was set to Alert.

## PAN-120245

Fixed an issue on Panorama where WildFire cloud content download failed for content deployment to the WF-500 appliance.

## PAN-109877

Fixed an issue where BGP flapped continuously with Jumbo Frames enabled on the firewall.

## PAN-104254

Fixed a rare issue where a dataplane process stopped responding.

## PAN-100254

Fixed an issue where an incorrect subnet mask was displayed for redistributed routes in the show routing protocol redist all CLI command.

## PAN-96528

A fix was made to address a memory corruption vulnerability in the GlobalProtect portal and GlobalProtect gateway that enabled an unauthenticated network-based attacker to disrupt system processes and potentially execute arbitrary code with root privileges ([CVE-2021-3064](https://security.paloaltonetworks.com/CVE-2021-3064)).

## PAN-96187

Fixed an issue where Panorama did not set the preference list on a firewall for a Log Collector that was configured through the CLI.
