---
type: Addressed
product: PAN-OS
version: 10.0.7
source: common-crawl
crawl: CC-MAIN-2026-12
---

## WF500-5568

Fixed an issue where a firewall in FIPS mode running PAN-OS 8.1.18 or a later version failed to connect with a WildFire appliance in normal mode.

## WF500-5559

Fixed an issue where an intermittent error while analyzing signed PE samples on the WildFire appliance might have caused analysis failures.

## WF500-5509

```caveat
WF-500 appliance only
```

Fixed an issue where cloud inquiries were logged under the **SD-WAN** subtype.

## PAN-173080

Fixed an issue where the User-ID connection limit was reached even when only a few User-ID agents were connected to the service.

## PAN-172518

Fixed an issue where a race condition occurred and caused a process (useridd) to restart.

## PAN-172125

Fixed an intermittent issue where processing HIP messages in the (useridd) process caused a memory leak.

## PAN-171878

Fixed an issue with SD-WAN path selection logic that caused a dataplane to stop responding.

## PAN-171442

Fixed an issue on Amazon Web Services (AWS) Gateway Load Balancer (GWLB) deployments with overlay routing and cross-zone load balancing enabled where packets were forwarded to the incorrect GWLB interface.

## PAN-171203

Fixed an issue in a high availability (HA) configuration where, when one firewall was active and its peer was in a suspended state, the suspended firewall continued to send traffic, which triggered the detection of duplicate MAC addresses.

## PAN-170989

Fixed an issue memory usage consumption issue on a process (useridd).

## PAN-170932

Fixed an issue in Telemetry settings where the **OK** button was disabled when **Telemetry Region** was set to **None**.

## PAN-170825

Fixed an issue where, when a partial **Preview Change** job failed, a process (configd) stopped responding.

## PAN-170740

Fixed an issue with the google-docs-uploading application that occurred if a Security policy rule was applied to a Security profile and traffic was decrypted.

## PAN-170681

Fixed an issue where the data redistribution agent and the data redistribution client failed to connect due to the agent not sending a SSL Server hello response.

## PAN-170610

Fixed an issue where SD-WAN SaaS monitoring traffic was incorrectly dropped by a Security policy that included a deny rule.

## PAN-170314

Fixed an issue where PAN-DB URL cloud updates failed because a process (devsrvr) did not fetch serial numbers, which prevented the PAN_DB URL cloud from connecting after first deployment.

## PAN-170083

Fixed an intermittent issue where packet pointer corruption occurred, which resulted in a dataplane restart.

## PAN-169712

Fixed an intermittent issue where traffic falsely matched a converted Suricata rule.

## PAN-169197

Fixed a rare issue where generating a tech support file caused the useridd process to stop responding.

## PAN-169161

Fixed an issue where, after a pan_comm process restart, the configuration wasn't synced between the management and the dataplane pod.

## PAN-169064

Fixed an issue where the management CPU remained at 100% due to a large number of configured User-ID agents.

## PAN-168888

Fixed an issue where, when a maximum session count was configured, the SD-WAN plugin caused commit failures on Panorama.

## PAN-168718

Fixed an issue where, when a client or server received partial application data, the record was partially processed by legacy code. This caused decryption to fail when a decryption profile protocol was set to a maximum of TLSv1.3.

## PAN-168574

Fixed an issue on Panorama where, after an upgrade to a PAN-OS 10.0 release version, a configuration pushed to firewalls running on PAN-OS 9.1 failed during an autocommit with the following error message: Need to config WMI account and password for querying Microsoft directory servers.

## PAN-168418

Fixed an issue where, when an MLAV URL with an exception list was configured and forward proxy was enabled, a process (all_pktproc) repeatedly restarted, which resulted in the firewall rebooting.

## PAN-167989

Fixed a timing issue between downloading and installing threads that occurred when Panorama pushed content updates and the firewall fetched content updates simultaneously.

## PAN-167872

Fixed an issue related to a process (all_pktproc) that occurred in long-lived sessions that spanned two content upgrades.

## PAN-167637

Fixed an issue where users connecting to the US East gateway encountered a delay in DNS responses.

## PAN-167541

Fixed an issue where large External Dynamic Lists (EDLs) caused commit issues due to a hard limit being reached.

## PAN-167443

Fixed an issue where commits failed and generated pan_comm SIGSEGV CORE files.

## PAN-167306

```caveat
VM-Series firewalls on Microsoft Azure only
```

Fixed an issue where, when a second disk was added, /opt/panlogs was mounted on an incorrect partition.

## PAN-167099

Fixed a configuration management issue that resulted in a process (ikemgr) failing to recognize changes in subsequent commits.

## PAN-167098

Fixed an issue where a configd process memory corruption occurred when Panorama was exposed to multiple XML API calls on Dynamic Address Groups updates.

## PAN-166836

Fixed an issue where session failed due to resource unavailability.

## PAN-166572

Fixed an issue where a process (configd) restarted when browsing policies on Panorama.

## PAN-166420

In 10.0.x Query Traffic log option is missing for Address groups under source and destination in the security policy tab

## PAN-166328

```caveat
PA-7000 Series firewalls with NPCs only
```

Fixed an issue where path monitoring failure occurred while hot inserting a 100G NPC (network processing card) into the firewall.

## PAN-166296

Fixed an issue where an unavailable certificate revocation list (CRL) from the server side caused an infinite loop on a process (sslmgr), which resulted in it not responding for other tasks.

## PAN-166021

Fixed an issue where log queries that included a username did not return with any output.

## PAN-165661

Fixed an issue in an HA active/active configuration where an administrative shutdown message was not sent to the BGP peer when the firewall went into a suspended state, which delayed convergence.

## PAN-165399

Fixed an issue where the multi-factor authentication (MFA) Challenge message did not display during login when the GlobalProtect portal was accessed by the web browser.

## PAN-165235

Fixed an issue where the handover handling between LTE and 3G on S5 and S8 to Gn/Gp was not working properly and led to stateful inspection failures.

## PAN-165025

Fixed an issue where, when default interzone and intrazone Security policy rules were overwritten, the rules did not display hit counts.

## PAN-164646

Fixed an issue where tunnel monitoring in the Large Scale VPN (LSVPN) displayed as down in both the CLI and the web interface due to incorrect dataplane ownership.

## PAN-164571

Fixed an issue where DHCP leases were not properly synchronized between HA peers after a device or dhcpd process restart. With this fix, the DHCP lease details display correctly on both the active and the passive device.

## PAN-164446

Fixed an issue on Panorama where a commit failed with the following error message: Local-AS number does not fit in 2-byte AS format, even though the AS format was set to 4 bytes.

## PAN-164431

```caveat
VM-Series firewalls only
```

Fixed an issue where the firewall rebooted into maintenance mode after installing a capacity license in FIPS-CC mode.

## PAN-164392

Fixed an issue where an out-of-memory (OOM) condition occurred due to a memory leak related to a process (logrcvr).

## PAN-164338

Fixed an issue where, when using the CLI or API, configurations for policy rule services or applications that either used custom settings and default settings together, or used multiple default settings together, successfully commit instead of failing or displaying a warning.

**Note** To use this fix, you must delete previous application or service settings in the configuration.

## PAN-164056

Fixed a memory issue for Large Scale VPN with multiple dataplane systems.

## PAN-163940

Fixed an issue where the firewall truncated the application name when doing a NetFlow export to the NetFlow analyzer.

## PAN-163800

Fixed an intermittent issue where the presence of an Anti-Spyware profile in a Security policy rule that matched DNS traffic caused DNS responses to be malformed in transit.

## PAN-163280

Fixed an issue where, after upgrading to a PAN-OS 10.0 release version, a commit failed due to an admin-role-related validation error that displayed the following message: device unexpected here.

## PAN-163270

Fixed an issue where the login banner was not aligned properly when it contained multiple sequential whitespaces.

## PAN-162600

Fixed an issue where, when the GlobalProtect client sent UDP/4501 traffic that was destined for the GlobalProtect gateway inside the GlobalProtect tunnel, the firewall still processed the traffic, which caused routing loops.

## PAN-161869

Fixed an issue where a core dump occurred on a process (flow_ctrl) after a commit if a policy-based forwarding (PBF) rule referenced an interface that had a DHCP IP address assignment.

## PAN-161289

Fixed an issue where predict session didn't update the associated rules when Security policies shifted after a commit.

## PAN-161218

The following CLI commands were added to enable the customer to set the dataplane utilization limit. The default setting is the recommended value of 500; a value of 0 removes dataplane CTD limits: -debug dataplane show ctd wildfire max -debug dataplane set ctd wildfire max <0-5000>

## PAN-161025

Fixed an issue in Panorama where an administrator with the role of Panorama administrator did not have the option to download or install GlobalProtect clients (**Panorama > Device Deployment > GlobalProtect**).

## PAN-160997

Fixed an issue where the metadata from the firewall's authentication profile was unable to export. This issue occurred when the authentication profile and the SAML Identity Provider sever profile were created with **VSYS** in the **Location**and were pushed from Panorama template stack values. To utilize this fix, you must upgrade both Panorama and the firewall.

## PAN-160843

Fixed an issue where the Multiprotocol Label Switching (MPLS) interface wasn't monitored when private traffic wasn't VPN encapsulated.

## PAN-160831

Fixed an intermittent issue where importing a new firewalls configuration into Panorama failed due to conflicting virtual system (vsys) names, even when the **Device Group Name Prefix** was used to make the name unique.

## PAN-160818

Fixed an issue where Panorama repeatedly displayed the following error message: HA Failover: updates not received from all sources: Pending plugins.

## PAN-160540

Fixed an issue where tunnel traffic was dropped intermittently when Quality of Service (QoS) Profile was assigned but the profile had no limits defined.

## PAN-160432

Fixed an issue where, after selecting a PAN-OS release to upgrade to in **Device Association > To SW Version**, the upgrade failed after connecting to Panorama.

## PAN-160254

Fixed a memory leak issue related to a process (reportd) where memory was not freed after an ElasticSearch request.

## PAN-160253

Fixed an issue where only one medium-severity system log was generated if either the EDL file wasn't updated at the remote end or the downloaded file wasn't a text file.

## PAN-160247

Fixed an issue where system logs incorrectly displayed as **Critical**.

## PAN-160238

Fixed an issue where intermittent virtual extensible LAN (VXLAN) packet drops occurred if the TCI was not configured for inspecting VXLAN traffic. This issue occurred when traffic was migrated from a firewall running a PAN-OS version earlier than PAN-OS 9.0 to a firewall running PAN-OS 9.0 or later.

## PAN-160150

Fixed an intermittent issue where, when a race condition occurred, a process (rasmgr) stopped responding, which caused GlobalProtect user authentication failure.

## PAN-160053

Fixed an issue in Panorama where a process (configd) stopped responding due to a race condition in the mongodb process.

## PAN-159973

Fixed an issue where a local commit in the Panorama management server caused the status to get out of sync on the managed WildFire appliance.

## PAN-159700

Fixed an issue where importing PAN-TRAPS.my to the SNMP manager caused the following error to display: Registration failed, registration failed, because there are unreferenced definition names in the MIB file.

## PAN-159592

Fixed an issue where a Japanese keyword search displayed garbled characters during SAML authentication.

## PAN-159536

Fixed an issue where, when the CLI command oscp-exclude-nonce-yes was enabled for a certificate profile, a nonce value was still included in the Online Certificate Status Protocol (OCSP) request.

## PAN-159499

Fixed an issue where you were unable to select the configured QoS profile under the template stack.

## PAN-159293

```caveat
VM-Series firewalls only
```

Fixed an issue where the Certification Revocation List (CRL) in Distinguished Encoding Rules (DER) format incorrectly returned errors despite being able to successfully pull the CRL to verify that the syslog server certificate was still valid.

## PAN-159224

Fixed an memory leak issue related to a process (mgmtsrvr), which was caused by a certificate loading operation.

## PAN-159214

Fixed an issue where a .txt file was corrupted, which caused the web interface to not display the requested information.

## PAN-159122

Fixed an issue where, when a new tag was created, a custom application with the same name was also created.

## PAN-158932

Fixed an issue where an increase was observed on spyware_state, which caused latency.

## PAN-158654

Fixed a memory leak issue in the management server process.

## PAN-158649

Fixed an issue where commits to the Prisma Access Remote networks from Panorama were failing when the management server on the cloud firewall failed to exit cleanly and reported the following error: pan_check_cert_status(pan_crl_ocsp.c:284): sysd write failed (TIMEOUT)

## PAN-158639

Fixed an issue on Panorama where logs that were forwarded to a collector group did not appear, and the log collector displayed the following error message: es.init-status not ready in logjobq.

## PAN-158450

```caveat
PA-3200 Series firewalls only
```

Fixed an issue where, for SNMPv2-MIB:sysServices, snmpwalk returned the following error message: No Such Instance currently exists at this OID.

## PAN-158372

Fixed a buffer overflow issue related to the useridd process.

## PAN-158337

Fixed an issue where warnings displayed during a commit or validate when BGP peers used in an import/export rule were disabled.

## PAN-158161

Fixed an issue where the policy-based forwarding (PBF) monitor was failing on the tunnel interface when QoS was enabled.

## PAN-158119

```caveat
PA-7000 Series firewalls only
```

Fixed an issue where TFTP traffic with a high packet rate was not offloaded even after hitting an application override policy with a custom application.

## PAN-158020

Fixed an issue where HIP reports were not visible on the web interface due to a domain override configuration.

## PAN-157938

```caveat
VM-Series firewalls with multiple DHCP interfaces only
```

Fixed an issue where leases renewed more quickly than needed, which caused unnecessary SPF recalculations.

## PAN-157908

Fixed an issue where false system alarms for the IP tag log database exceeded the alarm threshold value.

## PAN-157903

Fixed an issue where the **To** field of an email was truncated in threat logs when the field of the original email exceeded 512 bytes.

## PAN-157835

Fixed an issue where DNS Proxy rules that contained uppercase characters were not normalized to lowercase, which prevented the rules from being matched.

## PAN-157715

Fixed an intermittent issue where SMB file transfer operations failed due to packet drops that were caused by the Content and Threat Detection (CTD) queue filling up quickly. This fix introduces a new CLI command which, when enabled, prevents these failures: set system setting ctd nonblocking-pattern-match-qsizecheck [enable|disable].

## PAN-157632

Fixed an intermittent issue where the firewall dropped GTP-U traffic with the message TEID=0x00000000.

## PAN-157570

Fixed an issue where device deployment from Panorama to the firewalls failed with the error message Failed to get DLSRVR client key. This issue occurred only on firewalls where the request system-private-data-reset CLI command had been issued in the past.

## PAN-157518

Fixed an issue where using tags to target a device group in a Security policy rule did not work, and the rule was displayed in all device groups (**Preview Rules**).

## PAN-157472

```caveat
PA_5200 Series firewalls only
```

Fixed an issue where, after a factory reset, the firewall displayed the following error message: data_plane_X: Exited 1 times, must be manually recovered..

## PAN-157213

```caveat
ZTP firewalls only
```

Fixed an issue where the firewall failed to connect to Panorama when Zero Touch Provisioning (ZTP) was disabled.

## PAN-157074

Fixed an issue where a process (configd) stopped responding, which caused corruption.

## PAN-157035

```caveat
PA-5200 Series firewalls only
```

Fixed an intermittent issue where multicast packets traversing the firewall in VLAN configurations experienced higher drop rates than expected.

## PAN-157027

Fixed an issue where, when stateless GTP-U traffic hit a multi-dataplane firewall, an inter-dataplane fragmentation loop occurred, which caused high dataplane resource usage.

## PAN-157026

Fixed an issue where the firewall did not display unified logs.

## PAN-156552

Fixed a discrepancy in Panorama between application usage data and the application name in the **ACC** tab.

## PAN-156393

Fixed an issue where NetFlow updates were sent without honoring the configured active timeout value.

## PAN-156388

Fixed an issue where a process (useridd) stopped responding while attempting to remove all HIP reports on the disk.

## PAN-155903

Fixed an issue where zone protection and spoofed IP address protection didn't properly drop unroutable packets.

## PAN-155659

Fixed an issue where individual users were unable to populate the **allowed user/user group** field when configuring the GlobalProtect Clientless VPN.

## PAN-155657

Fixed an issue where the default log level for mprelay was set to INFO and caused commits to stop working on VM-Series firewalls in AWS using EBS backed volumes when route monitor was configured.

## PAN-154905

```caveat
Panorama appliances on PAN-OS 10.0 releases only
```

Fixed an issue with Security policy rule configuration where, in the **Source** and **Destination** tabs, the **Query Traffic** setting was not available for Address Groups.

## PAN-154526

Fixed an issue where a process (genindex.sh) caused high memory usage on the management plane. Due to the resulting out-of-memory (OOM) condition, multiple processes stopped responding.

## PAN-154441

Fixed an issue where the Radius EAP authentication stopped working and the authd process restarted.

## PAN-154433

Fixed an issue where the firewall was unable to detect end-user IP address spoofing on the GTP-U for a user data session when using an IPv6 address.

## PAN-154362

Fixed an issue where Panorama failed to push dynamic user groups to the managed firewalls.

## PAN-154334

Fixed an issue where the inactivity logout timeout did not reflect on the GlobalProtect mapping timeout.

## PAN-153288

Fixed an issue where the software QoS shaping queue processing was not properly applied on multicast traffic.

## PAN-151751

Fixed an issue where GlobalProtect logs did not populate on the destination syslog server in Log Event Extended Format (LEEF) and common event format (CEF).

## PAN-151273

Fixed an issue where the commit event was not recorded in the config logs during a **Commit and Push** on the Panorama management server.

## PAN-150530

Fixed an issue in the External Dynamic List (EDL) where printed log messages repeated until the end of the description field.

## PAN-150388

Fixed an issue where a process (mgmtsrvr) stopped responding when viewing logs in the web interface.

## PAN-150080

Fixed an issue where, even when tunnel interface was set to **down**, the following alert displayed: Tunnel GRE_Tunnels is going down(critical).

## PAN-147736

Fixed an issue on the firewall web interface where the Cortex Data Lake **Logging Service Status** pop-up window did not show correct information.

## PAN-146250

Fixed an issue where, in two separate but simultaneous sessions, the same software packet buffer was owned and processed.

## PAN-144305

Fixed an issue where merged configurations were unable to be exported from Panorama-managed firewalls using the PAN-OS XML API.

## PAN-144057

Fixed a rare issue where, when aggregate ethernet (AE) groups were deleted and re-added, the AE interface no longer had an SDB node to send link the location to. As a result, the dataplane was unable to identify a connected route for the interface address.

## PAN-141494

Fixed an issue with the group-mapping mode credential detection feature that failed to block users when logging in using corporate credentials.

## PAN-138727

A fix was made to address a time-of-check to time-of-use (TOCTOU) race condition in the PAN-OS web interface that enabled an authenticated administrator with permission to upload plugins to execute arbitrary code with root user privileges ([CVE-2021-3054](https://security.paloaltonetworks.com/CVE-2021-3054)).

## PAN-138134

Fixed an issue on Panorama where a template configuration push was blocked when the managed firewall did not have a plugin referenced in the template configuration.

## PAN-138066

Fixed an issue where an incorrect Certificate Authority (CA) was used for communicating to the Zero Touch Provisioning (ZTP) service.

## PAN-116515

Fixed an issue where IKE Gateway configurations with different crypto profiles on the same IP address with dynamic peers failed with the following error message: IKEv1 gateway should use the same crypto profiles configured on the same interface or local IP address.

With this fix, you are able to configure IKE Gateways with different crypto profiles on the same IP address with dynamic peers when IKEv1 auto mode is applied.

## PAN-113093

Fixed an intermittent issue where, when the DNS Security cloud was not reachable, DNS responses had bad UDP checksums.
