aaron.axvig/firewallissues
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add PAN-OS 11.1 reference files
Test and deploy / deploy (push) Successful in 34s
Details

Browse Source
This commit is contained in:
aaron.axvig committed 2026-10-10 15:09:27 -05:00
1 parent a404ee5df7
commit 10fb5719b5
10 files changed
+2135
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

reference/PAN-OS/addressed/11.1.10-h32.html
+296
View File
@@ -0,0 +1,296 @@
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 25%" />
<col style="width: 75%" />
</colgroup>
<thead class="thead">
<tr class="row">
<th class="entry">
<div class="p">Issue ID</div>
</th>
<th class="entry">
<div class="p">Description</div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-331387</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where IPsec tunnels frequently went down due to high
process memory utilization. With this fix, the system process now
manages memory correctly, preventing tunnel instability.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-330196</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall unexpectedly terminated operations
and rebooted due to an internal software error.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-328770</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where BGP Graceful Restart (GR) capability continued to
be advertised to BGP peers after GR was disabled on a Logical Router
configured with the Advanced Routing Engine, which caused peers to
incorrectly believe the firewall supported GR. With this fix,
disabling BGP GR on a Logical Router correctly removes the capability
from BGP Open messages.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-325496</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">KVM VM-Series firewalls only</tt>) Fixed an issue
where ARP entries were incomplete after an upgrade to an affected
release.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-324336</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where GlobalProtect iOS users were unable to connect
due to the firewall incorrectly reporting that the maximum number of
users was exceeded, even when the actual number of active users was
below the configured limit.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-323974</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where you were unable to add logging drives to the
firewall, and validation errors occurred when pushing configurations
from Panorama.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-321937</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where an expired SD-WAN license caused SD-WAN tunnels
to become unavailable, which resulted in traffic interruptions. With
this fix, the device provides logs and commit messages about expired
licenses.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-321204</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where FTP-DATA sessions did not match the installed
predict session, which led to session termination in HA
configurations.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-319343</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">Prisma Access Gateways only</tt>) Fixed an issue
where the global management plane stopped responding, which caused SSH
and HTML disconnections, HIP database lookup failures, and
significantly slower SCM commits. This occurred when egress IP allow
listing was enabled in SCM and changes were made to EDLs.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314873</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall intermittently stopped forwarding
traffic to the internet.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-312685</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where committing a scheduled configuration push on
Panorama caused the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>configd</a
>
process to stop responding unexpectedly.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311988</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">Firewalls in FIPS mode only</tt>) Fixed decryption
issues that occurred after an upgrade to an affected release.
</div>
<div class="p">
To enable this fix, run the CLI command
<span class="ph systemoutput"
>debug dataplane set ssl-decrypt low-memory-throttle enable</span
>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-310699</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall stripped the Authentication Key
Identifier (AKID) from certificates using SSL decryption, which
prevented clients from authenticating server certificates and resulted
in decryption failures.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-310476</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">Firewalls in HA configurations only</tt>) Fixed an
issue where CPLD did not power cycle the firewall after internal
packet path monitoring failures occurred, and both firewalls instead
became simultaneously non-functional after a reboot.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-310263</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">VM-Series firewalls only</tt>) Fixed an issue where
enabling TLS1.3 in a decryption profile prevented access to websites.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-307933</div></td>
<td class="entry relcol">
<div class="p">
(Panorama appliances in Log Collector mode only) Fixed an issue where
the log collectors became unstable for an extended period of time when
receiving large amounts of traffic.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-306225</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on the firewall where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>sslmgr</a
>
process memory utilization continually increased due to memory
fragmentation.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-301756</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where ACC logs displayed a discrepancy in SSL traffic
information between Panorama and the firewall. With this fix, the SSL
traffic information in ACC logs now aligns correctly.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-299027</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>Panorama virtual appliances in Management Mode only</tt
>) Fixed an issue where a maximum configuration size of 120 was
incorrectly enforced instead of 150 MB.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-297880</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where WildFire Analysis reports failed to load,
displaying a
<span class="ph uicontrol">500 Internal Server Error</span> when the
system attempted to retrieve reports for certain files. With this fix,
WildFire Analysis reports load as expected.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-282335</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where firewalls in a cluster experienced approximately
50% packet loss on IPSec NATT tunnels when tunnel acceleration was
enabled.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-248913</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the Elasticsearch client certificate was not auto
renewed, which caused it to enter a Red state, and logs were not
displayed in Panorama.
</div>
</td>
</tr>
</tbody>
</table>
reference/PAN-OS/addressed/11.1.10-h33.html
+165
View File
@@ -0,0 +1,165 @@
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 25%" />
<col style="width: 75%" />
</colgroup>
<thead class="thead">
<tr class="row">
<th class="entry">
<div class="p">Issue ID</div>
</th>
<th class="entry">
<div class="p">Description</div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">—</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixes were made to address the following CVEs:
<ul
id="pan_os_11_1_10_h33_addressed_issues_ul-nwg_dxl_vjc"
class="ul"
>
<li class="li">
<a
class="xref"
href="https://security.paloaltonetworks.com/CVE-2026-0310"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>CVE-2026-0310</a
>
</li>
<li class="li">
<a
class="xref"
href="https://security.paloaltonetworks.com/CVE-2026-0309"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>CVE-2026-0309</a
>
</li>
</ul>
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-332247</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the proxy generated HTTP 503 errors for multiple
URLs, which prevented users from connecting to servers. With this fix,
the proxy now functions as expected.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329612</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where multicast routing entries for certain IPTV
streams were not correctly installed or populated with necessary
interface information, which prevented the proper forwarding of
multicast traffic. With this fix, multicast traffic now forwards as
expected.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-325151</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a system log was not generated when the proxy
reached its session limit.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313218</div></td>
<td class="entry relcol">
<div class="p">
Added the following CLI commands to address QoS packet drops due to
bursty traffic:
</div>
<ul class="ul">
<li class="li">
<span class="ph systemoutput"
>debug dataplane set qos-setting qos-param qlimit 300</span
>
</li>
<li class="li">
<span class="ph systemoutput"
>debug dataplane set qos-setting qos-param red low 50 high
90</span
>
</li>
</ul>
<div class="p">
To utilize this fix, change the parameters, disable QoS, commit
changes, enable QOS, and then re-commit changes.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-307481</div></td>
<td class="entry relcol">
<div class="p">
Fixed a commit failure issue that occurred after migrating from Legacy
to Advanced routing on firewalls where an OSPF authentication profile
was configured to use a 16-character MD5 key with key-ID 10.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-291706</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the software tag descriptor was always at 100,
which led to resource unavailability errors and prevented users from
obtaining DHCP IP addresses.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-283774</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall placed UDP sessions into a
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>Discard</a
>
state when a DNS Sinkhole/Block action occurred, which prevented
subsequent DNS requests from reusing the same session and caused
DNS-related outages.
</div>
</td>
</tr>
</tbody>
</table>
reference/PAN-OS/addressed/11.1.10-h34.html
+31
View File
@@ -0,0 +1,31 @@
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 25%" />
<col style="width: 75%" />
</colgroup>
<thead class="thead">
<tr class="row">
<th class="entry">
<div class="p">Issue ID</div>
</th>
<th class="entry">
<div class="p">Description</div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-326424</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where high memory utilization occurred in the
<span class="ph uicontrol">escd</span> process. With this fix, memory
utilization for the process remained stable.
</div>
</td>
</tr>
</tbody>
</table>
reference/PAN-OS/addressed/11.1.13-h11.html
+532
View File
@@ -0,0 +1,532 @@
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 25%" />
<col style="width: 75%" />
</colgroup>
<thead class="thead">
<tr class="row">
<th class="entry">
<div class="p">Issue ID</div>
</th>
<th class="entry">
<div class="p">Description</div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-332095</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a commit to add a new tunnel interface to an
existing Virtual Router caused BGP routes to be temporarily withdrawn,
which led to active traffic sessions being routed over incorrect paths
during the commit window. With this fix, adding a tunnel interface to
an existing Virtual Router no longer disrupts BGP route availability.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-331387</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where IPsec tunnels frequently went down due to high
process memory utilization. With this fix, the system process now
manages memory correctly, preventing tunnel instability.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-330196</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall unexpectedly terminated operations
and rebooted due to an internal software error.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-328770</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where BGP Graceful Restart (GR) capability continued to
be advertised to BGP peers after GR was disabled on a Logical Router
configured with the Advanced Routing Engine, which caused peers to
incorrectly believe the firewall supported GR. With this fix,
disabling BGP GR on a Logical Router correctly removes the capability
from BGP Open messages.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-326056</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where ACE applications did not match the correct
Security policy rules when the service was not set to
<span class="ph uicontrol">Application Default</span> after an
upgrade, which caused traffic to be incorrectly denied.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-325496</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">KVM VM-Series firewalls only</tt>) Fixed an issue
where ARP entries were incomplete after an upgrade to an affected
release.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-325057</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where TCP sessions were dropped due to an
ACK-out-of-window condition during TCP reassembly when SYN cookies
were enabled in a Zone Protection Profile. With this fix, TCP session
establishment with SYN cookies enabled correctly tracks sequence
numbers and no longer drops valid ACK packets from the Server.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-324336</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where GlobalProtect iOS users were unable to connect
due to the firewall incorrectly reporting that the maximum number of
users was exceeded, even when the actual number of active users was
below the configured limit.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-323974</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where you were unable to add logging drives to the
firewall, and validation errors occurred when pushing configurations
from Panorama.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p">PAN-329034</div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an intermittent issue where firewall restarted unexpectedly
while processing zip files.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p">PAN-323501</div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where SWG Explicit Proxy Kerberos authentication bypass
did not occur for some URLs that matched a configured URL category.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p">PAN-323141</div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where SD-WAN SaaS monitoring for HTTPS URLs
continuously flapped, which caused frequent traffic shifting between
ISPs. This occurred due to the firewall unexpectedly hitting resource
limits for monitoring.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-321937</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where an expired SD-WAN license caused SD-WAN tunnels
to become unavailable, which resulted in traffic interruptions. With
this fix, the device provides logs and commit messages about expired
licenses.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-321204</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where FTP-DATA sessions did not match the installed
predict session, which led to session termination in HA
configurations.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-319343</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">Prisma Access Gateways only</tt>) Fixed an issue
where the global management plane stopped responding, which caused SSH
and HTML disconnections, HIP database lookup failures, and
significantly slower SCM commits. This occurred when egress IP allow
listing was enabled in SCM and changes were made to EDLs.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p">PAN-317648</div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>PA-5450 firewalls and PA-7000 Series firewalls with 100G NPCs
only</tt
>) Fixed an issue where intermittent packet loss occurred when
traversing the dataplane after upgrading the firewall. This occurred
when a dataplane HA interface was configured in an environment where
Slot 1 was unpopulated, which resulted in a wildcard entry being
created within the QMAP table.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p">PAN-316721</div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where multiple EDL fetches were queued and did not
complete.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-317614</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where high throughput and increased packet rates caused
high dataplane CPU usage.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-316979</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall rebooted unexpectedly when
packet-diag logging was enabled. With this fix, the firewall maintains
stability when this logging is active.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-316869</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where previously committed Security policy rules were
removed when a full commit was performed by a different administrator,
which led to the inadvertent loss of configuration changes. With this
fix, Security policy rules are retained as expected after a full
commit.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314873</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall intermittently stopped forwarding
traffic to the internet.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p">PAN-314776</div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>configd</a
>
process stopped responding after pushing configuration changes from
Panorama to the firewall.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p">PAN-314624</div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<span class="ph systemoutput">useridd</span> process became
unresponsive and restarted when attempting to dump the Host
Information Profile (HIP) database via CLI while the system was
actively processing HIP reports. This was caused by a lock contention.
With this fix, the process now operates as expected under these
conditions.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-312685</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where committing a scheduled configuration push on
Panorama caused the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>configd</a
>
process to stop responding unexpectedly.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p">PAN-312618</div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall was unable to activate GlobalProtect
client software and displayed
<span class="ph systemoutput">SW LIMIT</span> messages related to
max-profiles and unsupported major and minor versions in the downgrade
list, which prevented successful software installation.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-312354</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where Captive Portal authentication redirects failed
for HTTPS traffic when a user attempted to access internal HTTPS
websites via URL, which led to
<span class="ph uicontrol">ERR_CONNECTION_RESET</span> error messages
in the browser with SSL decryption and CTD handshake inspection
enabled.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311988</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">Firewalls in FIPS mode only</tt>) Fixed decryption
issues that occurred after an upgrade to an affected release.
</div>
<div class="p">
To enable this fix, run the CLI command
<span class="ph systemoutput"
>debug dataplane set ssl-decrypt low-memory-throttle enable</span
>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-310699</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall stripped the Authentication Key
Identifier (AKID) from certificates using SSL decryption, which
prevented clients from authenticating server certificates and resulted
in decryption failures.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-310476</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">Firewalls in HA configurations only</tt>) Fixed an
issue where CPLD did not power cycle the firewall after internal
packet path monitoring failures occurred, and both firewalls instead
became simultaneously non-functional after a reboot.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-310263</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">VM-Series firewalls only</tt>) Fixed an issue where
enabling TLS1.3 in a decryption profile prevented access to websites.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-307933</div></td>
<td class="entry relcol">
<div class="p">
(Panorama appliances in Log Collector mode only) Fixed an issue where
the log collectors became unstable for an extended period of time when
receiving large amounts of traffic.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-306225</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on the firewall where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>sslmgr</a
>
process memory utilization continually increased due to memory
fragmentation.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p">PAN-304840</div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where multiple firewalls experienced high management
CPU utilization after upgrading to an affected release due to repeated
index regeneration occurring every 15 minutes, which caused periodic
CPU spikes above 90%.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p">PAN-302983</div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, after committing changes on Panorama, a shared
post-rule moved to the end of the
<span class="ph systemoutput">post shared rulebase</span> on the
managed device instead of remaining at the top.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-301756</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where ACC logs displayed a discrepancy in SSL traffic
information between Panorama and the firewall. With this fix, the SSL
traffic information in ACC logs now aligns correctly.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-299027</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>Panorama virtual appliances in Management Mode only</tt
>) Fixed an issue where a maximum configuration size of 120 was
incorrectly enforced instead of 150 MB.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-297880</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where WildFire Analysis reports failed to load,
displaying a
<span class="ph uicontrol">500 Internal Server Error</span> when the
system attempted to retrieve reports for certain files. With this fix,
WildFire Analysis reports load as expected.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-294001</div></td>
<td class="entry relcol">
Fixed an issue where Panorama®-managed firewalls logged
<span class="ph systemoutput">Failed in get_pwchange_required</span>
error messages in the <span class="ph systemoutput">authd</span> logs
when locally defined administrators authenticated.
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-282335</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where firewalls in a cluster experienced approximately
50% packet loss on IPSec NATT tunnels when tunnel acceleration was
enabled.
</div>
</td>
</tr>
</tbody>
</table>
reference/PAN-OS/addressed/11.1.13-h12.html
+224
View File
@@ -0,0 +1,224 @@
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 25%" />
<col style="width: 75%" />
</colgroup>
<thead class="thead">
<tr class="row">
<th class="entry">
<div class="p">Issue ID</div>
</th>
<th class="entry">
<div class="p">Description</div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">—</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixes were made to address the following CVEs:
<ul
id="pan_os_11_1_13_h12_addressed_issues_ul-nwg_dxl_vjc"
class="ul"
>
<li class="li">
<a
class="xref"
href="https://security.paloaltonetworks.com/CVE-2026-0310"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>CVE-2026-0310</a
>
</li>
<li class="li">
<a
class="xref"
href="https://security.paloaltonetworks.com/CVE-2026-0309"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>CVE-2026-0309</a
>
</li>
</ul>
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-333894</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where communication with Microsoft Azure services was
disrupted, which resulted in application outages. This occurred when
firewalls dropped SYN-ACK packets that were part of a SYN-ACK cookie
mechanism activated by Azure's DDoS mitigation. With this fix,
firewalls now maintain connectivity during such traffic events.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-332608</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where firewalls intermittently disconnected from SLS.
With this fix, firewalls maintained a stable connection to SLS.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-332247</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the proxy generated HTTP 503 errors for multiple
URLs, which prevented users from connecting to servers. With this fix,
the proxy now functions as expected.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329612</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where multicast routing entries for certain IPTV
streams were not correctly installed or populated with necessary
interface information, which prevented the proper forwarding of
multicast traffic. With this fix, multicast traffic now forwards as
expected.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-325151</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a system log was not generated when the proxy
reached its session limit.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-323485</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where multicast radio RTP based traffic was dropped
after an upgrade when the firewall performed Cloud Inline inspection,
which led to an exceeded session queue for Cloud Threat Detection.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313218</div></td>
<td class="entry relcol">
<div class="p">
Added the following CLI commands to address QoS packet drops due to
bursty traffic:
</div>
<ul class="ul">
<li class="li">
<span class="ph systemoutput"
>debug dataplane set qos-setting qos-param qlimit 300</span
>
</li>
<li class="li">
<span class="ph systemoutput"
>debug dataplane set qos-setting qos-param red low 50 high
90</span
>
</li>
</ul>
<div class="p">
To utilize this fix, change the parameters, disable QoS, commit
changes, enable QOS, and then re-commit changes.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-312844</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a TLSv1.3 handshake did not complete when SSL
Forward Proxy was enabled. This occurred when a large ClientHello
message was split across multiple TCP segments and the final segment
contained only one byte.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-307481</div></td>
<td class="entry relcol">
<div class="p">
Fixed a commit failure issue that occurred after migrating from Legacy
to Advanced routing on firewalls where an OSPF authentication profile
was configured to use a 16-character MD5 key with key-ID 10.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-291706</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the software tag descriptor was always at 100,
which led to resource unavailability errors and prevented users from
obtaining DHCP IP addresses.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-283774</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall placed UDP sessions into a
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>Discard</a
>
state when a DNS Sinkhole/Block action occurred, which prevented
subsequent DNS requests from reusing the same session and caused
DNS-related outages.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-264508</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where Cloud Identity Engine did not fetch user-mapping
details for XML API users. This occurred when the firewall learned the
same IP-user mapping multiple times within a short period. With this
fix, the Cloud Identity Engine now accurately fetches these
user-mapping details.
</div>
</td>
</tr>
</tbody>
</table>
reference/PAN-OS/addressed/11.1.16-h2.html
+388
View File
@@ -0,0 +1,388 @@
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 25%" />
<col style="width: 75%" />
</colgroup>
<thead class="thead">
<tr class="row">
<th class="entry">
<div class="p">Issue ID</div>
</th>
<th class="entry">
<div class="p">Description</div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">—</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixes were made to address the following CVEs:
<ul id="pan_os_11_1_16_h2_addressed_issues_ul-nwg_dxl_vjc" class="ul">
<li class="li">
<a
class="xref"
href="https://security.paloaltonetworks.com/CVE-2026-0310"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>CVE-2026-0310</a
>
</li>
<li class="li">
<a
class="xref"
href="https://security.paloaltonetworks.com/CVE-2026-0309"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>CVE-2026-0309</a
>
</li>
<li class="li">
<a
class="xref"
href="https://security.paloaltonetworks.com/CVE-2026-0308"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>CVE-2026-0308</a
>
</li>
</ul>
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-332608</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where firewalls intermittently disconnected from SLS.
With this fix, firewalls maintained a stable connection to SLS.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-332247</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the proxy generated HTTP 503 errors for multiple
URLs, which prevented users from connecting to servers. With this fix,
the proxy now functions as expected.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-332095</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a commit to add a new tunnel interface to an
existing Virtual Router caused BGP routes to be temporarily withdrawn,
which led to active traffic sessions being routed over incorrect paths
during the commit window. With this fix, adding a tunnel interface to
an existing Virtual Router no longer disrupts BGP route availability.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-331387</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where IPsec tunnels frequently went down due to high
process memory utilization. With this fix, the system process now
manages memory correctly, preventing tunnel instability.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-330196</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall unexpectedly terminated operations
and rebooted due to an internal software error.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329793</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the characters in PDF Summary Reports did not
display correctly when the Locale was set as Japanese, Korean,
Simplified Chinese, or Traditional Chinese.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329637</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the push scope window did not display the target
devices when attempting to push configurations from Panorama, which
required manual selection of templates or device groups. With this
fix, the push scope window now correctly populates with the intended
push scope.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329612</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where multicast routing entries for certain IPTV
streams were not correctly installed or populated with necessary
interface information, which prevented the proper forwarding of
multicast traffic. With this fix, multicast traffic now forwards as
expected.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-328770</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where BGP Graceful Restart (GR) capability continued to
be advertised to BGP peers after GR was disabled on a Logical Router
configured with the Advanced Routing Engine, which caused peers to
incorrectly believe the firewall supported GR. With this fix,
disabling BGP GR on a Logical Router correctly removes the capability
from BGP Open messages.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-325151</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a system log was not generated when the proxy
reached its session limit.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-325057</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where TCP sessions were dropped due to an
ACK-out-of-window condition during TCP reassembly when SYN cookies
were enabled in a Zone Protection Profile. With this fix, TCP session
establishment with SYN cookies enabled correctly tracks sequence
numbers and no longer drops valid ACK packets from the Server.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-324336</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where GlobalProtect iOS users were unable to connect
due to the firewall incorrectly reporting that the maximum number of
users was exceeded, even when the actual number of active users was
below the configured limit.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-321204</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where FTP-DATA sessions did not match the installed
predict session, which led to session termination in HA
configurations.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-316979</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall rebooted unexpectedly when
packet-diag logging was enabled. With this fix, the firewall maintains
stability when this logging is active.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-316869</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where previously committed Security policy rules were
removed when a full commit was performed by a different administrator,
which led to the inadvertent loss of configuration changes. With this
fix, Security policy rules are retained as expected after a full
commit.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-315683</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where certain permitted IP addresses, when pushed from
a Panorama template, remained editable on the firewall web interface.
With this fix, these template-managed IP addresses are no longer
editable on the firewall.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314873</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall intermittently stopped forwarding
traffic to the internet.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-312844</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a TLSv1.3 handshake did not complete when SSL
Forward Proxy was enabled. This occurred when a large ClientHello
message was split across multiple TCP segments and the final segment
contained only one byte.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311988</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">Firewalls in FIPS mode only</tt>) Fixed decryption
issues that occurred after an upgrade to an affected release.
</div>
<div class="p">
To enable this fix, run the CLI command
<span class="ph systemoutput"
>debug dataplane set ssl-decrypt low-memory-throttle enable</span
>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-310699</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall stripped the Authentication Key
Identifier (AKID) from certificates using SSL decryption, which
prevented clients from authenticating server certificates and resulted
in decryption failures.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-307933</div></td>
<td class="entry relcol">
<div class="p">
(Panorama appliances in Log Collector mode only) Fixed an issue where
the log collectors became unstable for an extended period of time when
receiving large amounts of traffic.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-301756</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where ACC logs displayed a discrepancy in SSL traffic
information between Panorama and the firewall. With this fix, the SSL
traffic information in ACC logs now aligns correctly.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-297880</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where WildFire Analysis reports failed to load,
displaying a
<span class="ph uicontrol">500 Internal Server Error</span> when the
system attempted to retrieve reports for certain files. With this fix,
WildFire Analysis reports load as expected.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-291706</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the software tag descriptor was always at 100,
which led to resource unavailability errors and prevented users from
obtaining DHCP IP addresses.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-283774</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall placed UDP sessions into a
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>Discard</a
>
state when a DNS Sinkhole/Block action occurred, which prevented
subsequent DNS requests from reusing the same session and caused
DNS-related outages.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-264508</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where Cloud Identity Engine did not fetch user-mapping
details for XML API users. This occurred when the firewall learned the
same IP-user mapping multiple times within a short period. With this
fix, the Cloud Identity Engine now accurately fetches these
user-mapping details.
</div>
</td>
</tr>
</tbody>
</table>
reference/PAN-OS/addressed/11.1.16.h1.html
+258
View File
@@ -0,0 +1,258 @@
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 25%" />
<col style="width: 75%" />
</colgroup>
<thead class="thead">
<tr class="row">
<th class="entry">
<div class="p">Issue ID</div>
</th>
<th class="entry">
<div class="p">Description</div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row">
<td class="entry">
<div class="p">—</div>
</td>
<td class="entry relcol">
<div class="p">
A fix was made to address
<a
class="xref"
href="https://security.paloaltonetworks.com/CVE-2026-0301"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>CVE-2026-0301</a
>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329834</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a memory leak associated with some display CLI
commands caused instability.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329698</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">OCTEON, MIPS, platforms only</tt>) Fixed an issue
where the dataplane became unresponsive. With this fix, the data
planeoperates stably.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329034</div></td>
<td class="entry relcol">
<div class="p">
Fixed an intermittent issue where firewall restarted unexpectedly
while processing zip files.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-328822</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>VM-Series firewalls in Azure with Accelerated Networking and Data
Plane Development Kit (DPDK) enabled</tt
>) Fixed an issue where firewalls experienced increasing interface
receive errors, which led to intermittent traffic impact and
application downtime.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-327460</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a
<span class="ph uicontrol">Commit and Push</span> operation on
Panorama did not successfully push configuration changes to Prisma
Access endpoints. This occurred when the system reported that not all
commit jobs were triggered. With this fix,
<span class="ph uicontrol">Commit and Push</span> operations now
correctly apply configurations to Prisma Access.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-326056</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where ACE applications did not match the correct
Security policy rules when the service was not set to
<span class="ph uicontrol">Application Default</span> after an
upgrade, which caused traffic to be incorrectly denied.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-325903</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, after upgrading Panorama, a custom admin role
with Object Level Changes disabled did not automatically populate
out-of-sync firewalls in the push scope.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-325724</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where importing PKCS12 certificates failed with the
error
<span class="ph systemoutput"
>Import of certificate and private-key failed. Failed to extract
certificate</span
>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-325496</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">KVM VM-Series firewalls only</tt>) Fixed an issue
where ARP entries were incomplete after an upgrade to an affected
release.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-323974</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where you were unable to add logging drives to the
firewall, and validation errors occurred when pushing configurations
from Panorama.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-323842</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where commits intermittently failed on some Prisma
Access nodes with the error message
<span class="ph systemoutput">client pppoed phase 1 failure</span>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-323501</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where SWG Explicit Proxy Kerberos authentication bypass
did not occur for some URLs that matched a configured URL category.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-323141</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where SD-WAN SaaS monitoring for HTTPS URLs
continuously flapped, which caused frequent traffic shifting between
ISPs. This occurred due to the firewall unexpectedly hitting resource
limits for monitoring.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-321937</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where an expired SD-WAN license caused SD-WAN tunnels
to become unavailable, which resulted in traffic interruptions. With
this fix, the device provides logs and commit messages about expired
licenses.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-316721</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where multiple EDL fetches were queued and did not
complete.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-312685</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where committing a scheduled configuration push on
Panorama caused the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>configd</a
>
process to stop responding unexpectedly.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-310476</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">Firewalls in HA configurations only</tt>) Fixed an
issue where CPLD did not power cycle the firewall after internal
packet path monitoring failures occurred, and both firewalls instead
became simultaneously non-functional after a reboot.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-310263</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">VM-Series firewalls only</tt>) Fixed an issue where
enabling TLS1.3 in a decryption profile prevented access to websites.
</div>
</td>
</tr>
</tbody>
</table>
reference/PAN-OS/addressed/11.1.4-h36.html
+57
View File
@@ -0,0 +1,57 @@
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 25%" />
<col style="width: 75%" />
</colgroup>
<thead class="thead">
<tr class="row">
<th class="entry">
<div class="p">Issue ID</div>
</th>
<th class="entry">
<div class="p">Description</div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">—</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixes were made to address the following CVEs:
<ul id="pan_os_11_1_4_h36_addressed_issues_ul-nwg_dxl_vjc" class="ul">
<li class="li">
<a
class="xref"
href="https://security.paloaltonetworks.com/CVE-2026-0310"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>CVE-2026-0310</a
>
</li>
<li class="li">
<a
class="xref"
href="https://security.paloaltonetworks.com/CVE-2026-0309"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>CVE-2026-0309</a
>
</li>
</ul>
</div>
</td>
</tr>
</tbody>
</table>
reference/PAN-OS/addressed/11.1.6-h38.html
+127
View File
@@ -0,0 +1,127 @@
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 25%" />
<col style="width: 75%" />
</colgroup>
<thead class="thead">
<tr class="row">
<th class="entry">
<div class="p">Issue ID</div>
</th>
<th class="entry">
<div class="p">Description</div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">—</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixes were made to address the following CVEs:
<ul id="pan_os_11_1_6_h38_addressed_issues_ul-nwg_dxl_vjc" class="ul">
<li class="li">
<a
class="xref"
href="https://security.paloaltonetworks.com/CVE-2026-0310"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>CVE-2026-0310</a
>
</li>
<li class="li">
<a
class="xref"
href="https://security.paloaltonetworks.com/CVE-2026-0309"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>CVE-2026-0309</a
>
</li>
</ul>
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-332247</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the proxy generated HTTP 503 errors for multiple
URLs, which prevented users from connecting to servers. With this fix,
the proxy now functions as expected.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-325151</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a system log was not generated when the proxy
reached its session limit.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314624</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<span class="ph systemoutput">useridd</span> process became
unresponsive and restarted when attempting to dump the Host
Information Profile (HIP) database via CLI while the system was
actively processing HIP reports. This was caused by a lock contention.
With this fix, the process now operates as expected under these
conditions.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-310476</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">Firewalls in HA configurations only</tt>) Fixed an
issue where CPLD did not power cycle the firewall after internal
packet path monitoring failures occurred, and both firewalls instead
became simultaneously non-functional after a reboot.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-283774</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall placed UDP sessions into a
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>Discard</a
>
state when a DNS Sinkhole/Block action occurred, which prevented
subsequent DNS requests from reusing the same session and caused
DNS-related outages.
</div>
</td>
</tr>
</tbody>
</table>
reference/PAN-OS/addressed/11.1.7-h10.html
+57
View File
@@ -0,0 +1,57 @@
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 25%" />
<col style="width: 75%" />
</colgroup>
<thead class="thead">
<tr class="row">
<th class="entry">
<div class="p">Issue ID</div>
</th>
<th class="entry">
<div class="p">Description</div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">—</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixes were made to address the following CVEs:
<ul id="pan_os_11_1_7_h10_addressed_issues_ul-nwg_dxl_vjc" class="ul">
<li class="li">
<a
class="xref"
href="https://security.paloaltonetworks.com/CVE-2026-0310"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>CVE-2026-0310</a
>
</li>
<li class="li">
<a
class="xref"
href="https://security.paloaltonetworks.com/CVE-2026-0309"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>CVE-2026-0309</a
>
</li>
</ul>
</div>
</td>
</tr>
</tbody>
</table>