From 10fb5719b5c283b2c1545fd549fa6eea3be87527 Mon Sep 17 00:00:00 2001 From: aaronaxvig Date: Sat, 10 Oct 2026 15:09:27 -0500 Subject: [PATCH] Add PAN-OS 11.1 reference files --- reference/PAN-OS/addressed/11.1.10-h32.html | 296 +++++++++++ reference/PAN-OS/addressed/11.1.10-h33.html | 165 ++++++ reference/PAN-OS/addressed/11.1.10-h34.html | 31 ++ reference/PAN-OS/addressed/11.1.13-h11.html | 532 ++++++++++++++++++++ reference/PAN-OS/addressed/11.1.13-h12.html | 224 +++++++++ reference/PAN-OS/addressed/11.1.16-h2.html | 388 ++++++++++++++ reference/PAN-OS/addressed/11.1.16.h1.html | 258 ++++++++++ reference/PAN-OS/addressed/11.1.4-h36.html | 57 +++ reference/PAN-OS/addressed/11.1.6-h38.html | 127 +++++ reference/PAN-OS/addressed/11.1.7-h10.html | 57 +++ 10 files changed, 2135 insertions(+) create mode 100644 reference/PAN-OS/addressed/11.1.10-h32.html create mode 100644 reference/PAN-OS/addressed/11.1.10-h33.html create mode 100644 reference/PAN-OS/addressed/11.1.10-h34.html create mode 100644 reference/PAN-OS/addressed/11.1.13-h11.html create mode 100644 reference/PAN-OS/addressed/11.1.13-h12.html create mode 100644 reference/PAN-OS/addressed/11.1.16-h2.html create mode 100644 reference/PAN-OS/addressed/11.1.16.h1.html create mode 100644 reference/PAN-OS/addressed/11.1.4-h36.html create mode 100644 reference/PAN-OS/addressed/11.1.6-h38.html create mode 100644 reference/PAN-OS/addressed/11.1.7-h10.html diff --git a/reference/PAN-OS/addressed/11.1.10-h32.html b/reference/PAN-OS/addressed/11.1.10-h32.html new file mode 100644 index 0000000..cf64269 --- /dev/null +++ b/reference/PAN-OS/addressed/11.1.10-h32.html @@ -0,0 +1,296 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
PAN-331387
 +
+ Fixed an issue where IPsec tunnels frequently went down due to high + process memory utilization. With this fix, the system process now + manages memory correctly, preventing tunnel instability. +
+
PAN-330196
 +
+ Fixed an issue where the firewall unexpectedly terminated operations + and rebooted due to an internal software error. +
+
PAN-328770
 +
+ Fixed an issue where BGP Graceful Restart (GR) capability continued to + be advertised to BGP peers after GR was disabled on a Logical Router + configured with the Advanced Routing Engine, which caused peers to + incorrectly believe the firewall supported GR. With this fix, + disabling BGP GR on a Logical Router correctly removes the capability + from BGP Open messages. +
+
PAN-325496
 +
+ (KVM VM-Series firewalls only) Fixed an issue + where ARP entries were incomplete after an upgrade to an affected + release. +
+
PAN-324336
 +
+ Fixed an issue where GlobalProtect iOS users were unable to connect + due to the firewall incorrectly reporting that the maximum number of + users was exceeded, even when the actual number of active users was + below the configured limit. +
+
PAN-323974
 +
+ Fixed an issue where you were unable to add logging drives to the + firewall, and validation errors occurred when pushing configurations + from Panorama. +
+
PAN-321937
 +
+ Fixed an issue where an expired SD-WAN license caused SD-WAN tunnels + to become unavailable, which resulted in traffic interruptions. With + this fix, the device provides logs and commit messages about expired + licenses. +
+
PAN-321204
 +
+ Fixed an issue where FTP-DATA sessions did not match the installed + predict session, which led to session termination in HA + configurations. +
+
PAN-319343
 +
+ (Prisma Access Gateways only) Fixed an issue + where the global management plane stopped responding, which caused SSH + and HTML disconnections, HIP database lookup failures, and + significantly slower SCM commits. This occurred when egress IP allow + listing was enabled in SCM and changes were made to EDLs. +
+
PAN-314873
 +
+ Fixed an issue where the firewall intermittently stopped forwarding + traffic to the internet. +
+
PAN-312685
 +
+ Fixed an issue where committing a scheduled configuration push on + Panorama caused the + configd + process to stop responding unexpectedly. +
+
PAN-311988
 +
+ (Firewalls in FIPS mode only) Fixed decryption + issues that occurred after an upgrade to an affected release. +
+
+ To enable this fix, run the CLI command + debug dataplane set ssl-decrypt low-memory-throttle enable. +
+
PAN-310699
 +
+ Fixed an issue where the firewall stripped the Authentication Key + Identifier (AKID) from certificates using SSL decryption, which + prevented clients from authenticating server certificates and resulted + in decryption failures. +
+
PAN-310476
 +
+ (Firewalls in HA configurations only) Fixed an + issue where CPLD did not power cycle the firewall after internal + packet path monitoring failures occurred, and both firewalls instead + became simultaneously non-functional after a reboot. +
+
PAN-310263
 +
+ (VM-Series firewalls only) Fixed an issue where + enabling TLS1.3 in a decryption profile prevented access to websites. +
+
PAN-307933
 +
+ (Panorama appliances in Log Collector mode only) Fixed an issue where + the log collectors became unstable for an extended period of time when + receiving large amounts of traffic. +
+
PAN-306225
 +
+ Fixed an issue on the firewall where the + sslmgr + process memory utilization continually increased due to memory + fragmentation. +
+
PAN-301756
 +
+ Fixed an issue where ACC logs displayed a discrepancy in SSL traffic + information between Panorama and the firewall. With this fix, the SSL + traffic information in ACC logs now aligns correctly. +
+
PAN-299027
 +
+ (Panorama virtual appliances in Management Mode only) Fixed an issue where a maximum configuration size of 120 was + incorrectly enforced instead of 150 MB. +
+
PAN-297880
 +
+ Fixed an issue where WildFire Analysis reports failed to load, + displaying a + 500 Internal Server Error when the + system attempted to retrieve reports for certain files. With this fix, + WildFire Analysis reports load as expected. +
+
PAN-282335
 +
+ Fixed an issue where firewalls in a cluster experienced approximately + 50% packet loss on IPSec NATT tunnels when tunnel acceleration was + enabled. +
+
PAN-248913
 +
+ Fixed an issue where the Elasticsearch client certificate was not auto + renewed, which caused it to enter a Red state, and logs were not + displayed in Panorama. +
+
diff --git a/reference/PAN-OS/addressed/11.1.10-h33.html b/reference/PAN-OS/addressed/11.1.10-h33.html new file mode 100644 index 0000000..d64541e --- /dev/null +++ b/reference/PAN-OS/addressed/11.1.10-h33.html @@ -0,0 +1,165 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
—
+ 		+
+ Fixes were made to address the following CVEs: + +
+
PAN-332247
 +
+ Fixed an issue where the proxy generated HTTP 503 errors for multiple + URLs, which prevented users from connecting to servers. With this fix, + the proxy now functions as expected. +
+
PAN-329612
 +
+ Fixed an issue where multicast routing entries for certain IPTV + streams were not correctly installed or populated with necessary + interface information, which prevented the proper forwarding of + multicast traffic. With this fix, multicast traffic now forwards as + expected. +
+
PAN-325151
 +
+ Fixed an issue where a system log was not generated when the proxy + reached its session limit. +
+
PAN-313218
 +
+ Added the following CLI commands to address QoS packet drops due to + bursty traffic: +
+
    +
  • + debug dataplane set qos-setting qos-param qlimit 300 +
    • +
  • + debug dataplane set qos-setting qos-param red low 50 high + 90 +
    • +
+
+ To utilize this fix, change the parameters, disable QoS, commit + changes, enable QOS, and then re-commit changes. +
+
PAN-307481
 +
+ Fixed a commit failure issue that occurred after migrating from Legacy + to Advanced routing on firewalls where an OSPF authentication profile + was configured to use a 16-character MD5 key with key-ID 10. +
+
PAN-291706
 +
+ Fixed an issue where the software tag descriptor was always at 100, + which led to resource unavailability errors and prevented users from + obtaining DHCP IP addresses. +
+
PAN-283774
 +
+ Fixed an issue where the firewall placed UDP sessions into a + Discard + state when a DNS Sinkhole/Block action occurred, which prevented + subsequent DNS requests from reusing the same session and caused + DNS-related outages. +
+
diff --git a/reference/PAN-OS/addressed/11.1.10-h34.html b/reference/PAN-OS/addressed/11.1.10-h34.html new file mode 100644 index 0000000..6f39606 --- /dev/null +++ b/reference/PAN-OS/addressed/11.1.10-h34.html @@ -0,0 +1,31 @@ + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
PAN-326424
 +
+ Fixed an issue where high memory utilization occurred in the + escd process. With this fix, memory + utilization for the process remained stable. +
+
diff --git a/reference/PAN-OS/addressed/11.1.13-h11.html b/reference/PAN-OS/addressed/11.1.13-h11.html new file mode 100644 index 0000000..b78c424 --- /dev/null +++ b/reference/PAN-OS/addressed/11.1.13-h11.html @@ -0,0 +1,532 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
PAN-332095
 +
+ Fixed an issue where a commit to add a new tunnel interface to an + existing Virtual Router caused BGP routes to be temporarily withdrawn, + which led to active traffic sessions being routed over incorrect paths + during the commit window. With this fix, adding a tunnel interface to + an existing Virtual Router no longer disrupts BGP route availability. +
+
PAN-331387
 +
+ Fixed an issue where IPsec tunnels frequently went down due to high + process memory utilization. With this fix, the system process now + manages memory correctly, preventing tunnel instability. +
+
PAN-330196
 +
+ Fixed an issue where the firewall unexpectedly terminated operations + and rebooted due to an internal software error. +
+
PAN-328770
 +
+ Fixed an issue where BGP Graceful Restart (GR) capability continued to + be advertised to BGP peers after GR was disabled on a Logical Router + configured with the Advanced Routing Engine, which caused peers to + incorrectly believe the firewall supported GR. With this fix, + disabling BGP GR on a Logical Router correctly removes the capability + from BGP Open messages. +
+
PAN-326056
 +
+ Fixed an issue where ACE applications did not match the correct + Security policy rules when the service was not set to + Application Default after an + upgrade, which caused traffic to be incorrectly denied. +
+
PAN-325496
 +
+ (KVM VM-Series firewalls only) Fixed an issue + where ARP entries were incomplete after an upgrade to an affected + release. +
+
PAN-325057
 +
+ Fixed an issue where TCP sessions were dropped due to an + ACK-out-of-window condition during TCP reassembly when SYN cookies + were enabled in a Zone Protection Profile. With this fix, TCP session + establishment with SYN cookies enabled correctly tracks sequence + numbers and no longer drops valid ACK packets from the Server. +
+
PAN-324336
 +
+ Fixed an issue where GlobalProtect iOS users were unable to connect + due to the firewall incorrectly reporting that the maximum number of + users was exceeded, even when the actual number of active users was + below the configured limit. +
+
PAN-323974
 +
+ Fixed an issue where you were unable to add logging drives to the + firewall, and validation errors occurred when pushing configurations + from Panorama. +
+
+
PAN-329034
+ 		+
+ Fixed an intermittent issue where firewall restarted unexpectedly + while processing zip files. +
+
+
PAN-323501
+ 		+
+ Fixed an issue where SWG Explicit Proxy Kerberos authentication bypass + did not occur for some URLs that matched a configured URL category. +
+
+
PAN-323141
+ 		+
+ Fixed an issue where SD-WAN SaaS monitoring for HTTPS URLs + continuously flapped, which caused frequent traffic shifting between + ISPs. This occurred due to the firewall unexpectedly hitting resource + limits for monitoring. +
+
PAN-321937
 +
+ Fixed an issue where an expired SD-WAN license caused SD-WAN tunnels + to become unavailable, which resulted in traffic interruptions. With + this fix, the device provides logs and commit messages about expired + licenses. +
+
PAN-321204
 +
+ Fixed an issue where FTP-DATA sessions did not match the installed + predict session, which led to session termination in HA + configurations. +
+
PAN-319343
 +
+ (Prisma Access Gateways only) Fixed an issue + where the global management plane stopped responding, which caused SSH + and HTML disconnections, HIP database lookup failures, and + significantly slower SCM commits. This occurred when egress IP allow + listing was enabled in SCM and changes were made to EDLs. +
+
+
PAN-317648
+ 		+
+ (PA-5450 firewalls and PA-7000 Series firewalls with 100G NPCs + only) Fixed an issue where intermittent packet loss occurred when + traversing the dataplane after upgrading the firewall. This occurred + when a dataplane HA interface was configured in an environment where + Slot 1 was unpopulated, which resulted in a wildcard entry being + created within the QMAP table. +
+
+
PAN-316721
+ 		+
+ Fixed an issue where multiple EDL fetches were queued and did not + complete. +
+
PAN-317614
 +
+ Fixed an issue where high throughput and increased packet rates caused + high dataplane CPU usage. +
+
PAN-316979
 +
+ Fixed an issue where the firewall rebooted unexpectedly when + packet-diag logging was enabled. With this fix, the firewall maintains + stability when this logging is active. +
+
PAN-316869
 +
+ Fixed an issue where previously committed Security policy rules were + removed when a full commit was performed by a different administrator, + which led to the inadvertent loss of configuration changes. With this + fix, Security policy rules are retained as expected after a full + commit. +
+
PAN-314873
 +
+ Fixed an issue where the firewall intermittently stopped forwarding + traffic to the internet. +
+
+
PAN-314776
+ 		+
+ Fixed an issue where the + configd + process stopped responding after pushing configuration changes from + Panorama to the firewall. +
+
+
PAN-314624
+ 		+
+ Fixed an issue where the + useridd process became + unresponsive and restarted when attempting to dump the Host + Information Profile (HIP) database via CLI while the system was + actively processing HIP reports. This was caused by a lock contention. + With this fix, the process now operates as expected under these + conditions. +
+
PAN-312685
 +
+ Fixed an issue where committing a scheduled configuration push on + Panorama caused the + configd + process to stop responding unexpectedly. +
+
+
PAN-312618
+ 		+
+ Fixed an issue where the firewall was unable to activate GlobalProtect + client software and displayed + SW LIMIT messages related to + max-profiles and unsupported major and minor versions in the downgrade + list, which prevented successful software installation. +
+
PAN-312354
 +
+ Fixed an issue where Captive Portal authentication redirects failed + for HTTPS traffic when a user attempted to access internal HTTPS + websites via URL, which led to + ERR_CONNECTION_RESET error messages + in the browser with SSL decryption and CTD handshake inspection + enabled. +
+
PAN-311988
 +
+ (Firewalls in FIPS mode only) Fixed decryption + issues that occurred after an upgrade to an affected release. +
+
+ To enable this fix, run the CLI command + debug dataplane set ssl-decrypt low-memory-throttle enable. +
+
PAN-310699
 +
+ Fixed an issue where the firewall stripped the Authentication Key + Identifier (AKID) from certificates using SSL decryption, which + prevented clients from authenticating server certificates and resulted + in decryption failures. +
+
PAN-310476
 +
+ (Firewalls in HA configurations only) Fixed an + issue where CPLD did not power cycle the firewall after internal + packet path monitoring failures occurred, and both firewalls instead + became simultaneously non-functional after a reboot. +
+
PAN-310263
 +
+ (VM-Series firewalls only) Fixed an issue where + enabling TLS1.3 in a decryption profile prevented access to websites. +
+
PAN-307933
 +
+ (Panorama appliances in Log Collector mode only) Fixed an issue where + the log collectors became unstable for an extended period of time when + receiving large amounts of traffic. +
+
PAN-306225
 +
+ Fixed an issue on the firewall where the + sslmgr + process memory utilization continually increased due to memory + fragmentation. +
+
+
PAN-304840
+ 		+
+ Fixed an issue where multiple firewalls experienced high management + CPU utilization after upgrading to an affected release due to repeated + index regeneration occurring every 15 minutes, which caused periodic + CPU spikes above 90%. +
+
+
PAN-302983
+ 		+
+ Fixed an issue where, after committing changes on Panorama, a shared + post-rule moved to the end of the + post shared rulebase on the + managed device instead of remaining at the top. +
+
PAN-301756
 +
+ Fixed an issue where ACC logs displayed a discrepancy in SSL traffic + information between Panorama and the firewall. With this fix, the SSL + traffic information in ACC logs now aligns correctly. +
+
PAN-299027
 +
+ (Panorama virtual appliances in Management Mode only) Fixed an issue where a maximum configuration size of 120 was + incorrectly enforced instead of 150 MB. +
+
PAN-297880
 +
+ Fixed an issue where WildFire Analysis reports failed to load, + displaying a + 500 Internal Server Error when the + system attempted to retrieve reports for certain files. With this fix, + WildFire Analysis reports load as expected. +
+
PAN-294001
 + Fixed an issue where Panorama®-managed firewalls logged + Failed in get_pwchange_required + error messages in the authd logs + when locally defined administrators authenticated. +
PAN-282335
 +
+ Fixed an issue where firewalls in a cluster experienced approximately + 50% packet loss on IPSec NATT tunnels when tunnel acceleration was + enabled. +
+
diff --git a/reference/PAN-OS/addressed/11.1.13-h12.html b/reference/PAN-OS/addressed/11.1.13-h12.html new file mode 100644 index 0000000..51617ed --- /dev/null +++ b/reference/PAN-OS/addressed/11.1.13-h12.html @@ -0,0 +1,224 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
—
+ 		+
+ Fixes were made to address the following CVEs: + +
+
PAN-333894
 +
+ Fixed an issue where communication with Microsoft Azure services was + disrupted, which resulted in application outages. This occurred when + firewalls dropped SYN-ACK packets that were part of a SYN-ACK cookie + mechanism activated by Azure's DDoS mitigation. With this fix, + firewalls now maintain connectivity during such traffic events. +
+
PAN-332608
 +
+ Fixed an issue where firewalls intermittently disconnected from SLS. + With this fix, firewalls maintained a stable connection to SLS. +
+
PAN-332247
 +
+ Fixed an issue where the proxy generated HTTP 503 errors for multiple + URLs, which prevented users from connecting to servers. With this fix, + the proxy now functions as expected. +
+
PAN-329612
 +
+ Fixed an issue where multicast routing entries for certain IPTV + streams were not correctly installed or populated with necessary + interface information, which prevented the proper forwarding of + multicast traffic. With this fix, multicast traffic now forwards as + expected. +
+
PAN-325151
 +
+ Fixed an issue where a system log was not generated when the proxy + reached its session limit. +
+
PAN-323485
 +
+ Fixed an issue where multicast radio RTP based traffic was dropped + after an upgrade when the firewall performed Cloud Inline inspection, + which led to an exceeded session queue for Cloud Threat Detection. +
+
PAN-313218
 +
+ Added the following CLI commands to address QoS packet drops due to + bursty traffic: +
+
    +
  • + debug dataplane set qos-setting qos-param qlimit 300 +
    • +
  • + debug dataplane set qos-setting qos-param red low 50 high + 90 +
    • +
+
+ To utilize this fix, change the parameters, disable QoS, commit + changes, enable QOS, and then re-commit changes. +
+
PAN-312844
 +
+ Fixed an issue where a TLSv1.3 handshake did not complete when SSL + Forward Proxy was enabled. This occurred when a large ClientHello + message was split across multiple TCP segments and the final segment + contained only one byte. +
+
PAN-307481
 +
+ Fixed a commit failure issue that occurred after migrating from Legacy + to Advanced routing on firewalls where an OSPF authentication profile + was configured to use a 16-character MD5 key with key-ID 10. +
+
PAN-291706
 +
+ Fixed an issue where the software tag descriptor was always at 100, + which led to resource unavailability errors and prevented users from + obtaining DHCP IP addresses. +
+
PAN-283774
 +
+ Fixed an issue where the firewall placed UDP sessions into a + Discard + state when a DNS Sinkhole/Block action occurred, which prevented + subsequent DNS requests from reusing the same session and caused + DNS-related outages. +
+
PAN-264508
 +
+ Fixed an issue where Cloud Identity Engine did not fetch user-mapping + details for XML API users. This occurred when the firewall learned the + same IP-user mapping multiple times within a short period. With this + fix, the Cloud Identity Engine now accurately fetches these + user-mapping details. +
+
diff --git a/reference/PAN-OS/addressed/11.1.16-h2.html b/reference/PAN-OS/addressed/11.1.16-h2.html new file mode 100644 index 0000000..1b15b20 --- /dev/null +++ b/reference/PAN-OS/addressed/11.1.16-h2.html @@ -0,0 +1,388 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
—
+ 		+
+ Fixes were made to address the following CVEs: + +
+
PAN-332608
 +
+ Fixed an issue where firewalls intermittently disconnected from SLS. + With this fix, firewalls maintained a stable connection to SLS. +
+
PAN-332247
 +
+ Fixed an issue where the proxy generated HTTP 503 errors for multiple + URLs, which prevented users from connecting to servers. With this fix, + the proxy now functions as expected. +
+
PAN-332095
 +
+ Fixed an issue where a commit to add a new tunnel interface to an + existing Virtual Router caused BGP routes to be temporarily withdrawn, + which led to active traffic sessions being routed over incorrect paths + during the commit window. With this fix, adding a tunnel interface to + an existing Virtual Router no longer disrupts BGP route availability. +
+
PAN-331387
 +
+ Fixed an issue where IPsec tunnels frequently went down due to high + process memory utilization. With this fix, the system process now + manages memory correctly, preventing tunnel instability. +
+
PAN-330196
 +
+ Fixed an issue where the firewall unexpectedly terminated operations + and rebooted due to an internal software error. +
+
PAN-329793
 +
+ Fixed an issue where the characters in PDF Summary Reports did not + display correctly when the Locale was set as Japanese, Korean, + Simplified Chinese, or Traditional Chinese. +
+
PAN-329637
 +
+ Fixed an issue where the push scope window did not display the target + devices when attempting to push configurations from Panorama, which + required manual selection of templates or device groups. With this + fix, the push scope window now correctly populates with the intended + push scope. +
+
PAN-329612
 +
+ Fixed an issue where multicast routing entries for certain IPTV + streams were not correctly installed or populated with necessary + interface information, which prevented the proper forwarding of + multicast traffic. With this fix, multicast traffic now forwards as + expected. +
+
PAN-328770
 +
+ Fixed an issue where BGP Graceful Restart (GR) capability continued to + be advertised to BGP peers after GR was disabled on a Logical Router + configured with the Advanced Routing Engine, which caused peers to + incorrectly believe the firewall supported GR. With this fix, + disabling BGP GR on a Logical Router correctly removes the capability + from BGP Open messages. +
+
PAN-325151
 +
+ Fixed an issue where a system log was not generated when the proxy + reached its session limit. +
+
PAN-325057
 +
+ Fixed an issue where TCP sessions were dropped due to an + ACK-out-of-window condition during TCP reassembly when SYN cookies + were enabled in a Zone Protection Profile. With this fix, TCP session + establishment with SYN cookies enabled correctly tracks sequence + numbers and no longer drops valid ACK packets from the Server. +
+
PAN-324336
 +
+ Fixed an issue where GlobalProtect iOS users were unable to connect + due to the firewall incorrectly reporting that the maximum number of + users was exceeded, even when the actual number of active users was + below the configured limit. +
+
PAN-321204
 +
+ Fixed an issue where FTP-DATA sessions did not match the installed + predict session, which led to session termination in HA + configurations. +
+
PAN-316979
 +
+ Fixed an issue where the firewall rebooted unexpectedly when + packet-diag logging was enabled. With this fix, the firewall maintains + stability when this logging is active. +
+
PAN-316869
 +
+ Fixed an issue where previously committed Security policy rules were + removed when a full commit was performed by a different administrator, + which led to the inadvertent loss of configuration changes. With this + fix, Security policy rules are retained as expected after a full + commit. +
+
PAN-315683
 +
+ Fixed an issue where certain permitted IP addresses, when pushed from + a Panorama template, remained editable on the firewall web interface. + With this fix, these template-managed IP addresses are no longer + editable on the firewall. +
+
PAN-314873
 +
+ Fixed an issue where the firewall intermittently stopped forwarding + traffic to the internet. +
+
PAN-312844
 +
+ Fixed an issue where a TLSv1.3 handshake did not complete when SSL + Forward Proxy was enabled. This occurred when a large ClientHello + message was split across multiple TCP segments and the final segment + contained only one byte. +
+
PAN-311988
 +
+ (Firewalls in FIPS mode only) Fixed decryption + issues that occurred after an upgrade to an affected release. +
+
+ To enable this fix, run the CLI command + debug dataplane set ssl-decrypt low-memory-throttle enable. +
+
PAN-310699
 +
+ Fixed an issue where the firewall stripped the Authentication Key + Identifier (AKID) from certificates using SSL decryption, which + prevented clients from authenticating server certificates and resulted + in decryption failures. +
+
PAN-307933
 +
+ (Panorama appliances in Log Collector mode only) Fixed an issue where + the log collectors became unstable for an extended period of time when + receiving large amounts of traffic. +
+
PAN-301756
 +
+ Fixed an issue where ACC logs displayed a discrepancy in SSL traffic + information between Panorama and the firewall. With this fix, the SSL + traffic information in ACC logs now aligns correctly. +
+
PAN-297880
 +
+ Fixed an issue where WildFire Analysis reports failed to load, + displaying a + 500 Internal Server Error when the + system attempted to retrieve reports for certain files. With this fix, + WildFire Analysis reports load as expected. +
+
PAN-291706
 +
+ Fixed an issue where the software tag descriptor was always at 100, + which led to resource unavailability errors and prevented users from + obtaining DHCP IP addresses. +
+
PAN-283774
 +
+ Fixed an issue where the firewall placed UDP sessions into a + Discard + state when a DNS Sinkhole/Block action occurred, which prevented + subsequent DNS requests from reusing the same session and caused + DNS-related outages. +
+
PAN-264508
 +
+ Fixed an issue where Cloud Identity Engine did not fetch user-mapping + details for XML API users. This occurred when the firewall learned the + same IP-user mapping multiple times within a short period. With this + fix, the Cloud Identity Engine now accurately fetches these + user-mapping details. +
+
diff --git a/reference/PAN-OS/addressed/11.1.16.h1.html b/reference/PAN-OS/addressed/11.1.16.h1.html new file mode 100644 index 0000000..4cf6149 --- /dev/null +++ b/reference/PAN-OS/addressed/11.1.16.h1.html @@ -0,0 +1,258 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
—
+ 		+
+ A fix was made to address + CVE-2026-0301. +
+
PAN-329834
 +
+ Fixed an issue where a memory leak associated with some display CLI + commands caused instability. +
+
PAN-329698
 +
+ (OCTEON, MIPS, platforms only) Fixed an issue + where the dataplane became unresponsive. With this fix, the data + planeoperates stably. +
+
PAN-329034
 +
+ Fixed an intermittent issue where firewall restarted unexpectedly + while processing zip files. +
+
PAN-328822
 +
+ (VM-Series firewalls in Azure with Accelerated Networking and Data + Plane Development Kit (DPDK) enabled) Fixed an issue where firewalls experienced increasing interface + receive errors, which led to intermittent traffic impact and + application downtime. +
+
PAN-327460
 +
+ Fixed an issue where a + Commit and Push operation on + Panorama did not successfully push configuration changes to Prisma + Access endpoints. This occurred when the system reported that not all + commit jobs were triggered. With this fix, + Commit and Push operations now + correctly apply configurations to Prisma Access. +
+
PAN-326056
 +
+ Fixed an issue where ACE applications did not match the correct + Security policy rules when the service was not set to + Application Default after an + upgrade, which caused traffic to be incorrectly denied. +
+
PAN-325903
 +
+ Fixed an issue where, after upgrading Panorama, a custom admin role + with Object Level Changes disabled did not automatically populate + out-of-sync firewalls in the push scope. +
+
PAN-325724
 +
+ Fixed an issue where importing PKCS12 certificates failed with the + error + Import of certificate and private-key failed. Failed to extract + certificate. +
+
PAN-325496
 +
+ (KVM VM-Series firewalls only) Fixed an issue + where ARP entries were incomplete after an upgrade to an affected + release. +
+
PAN-323974
 +
+ Fixed an issue where you were unable to add logging drives to the + firewall, and validation errors occurred when pushing configurations + from Panorama. +
+
PAN-323842
 +
+ Fixed an issue where commits intermittently failed on some Prisma + Access nodes with the error message + client pppoed phase 1 failure. +
+
PAN-323501
 +
+ Fixed an issue where SWG Explicit Proxy Kerberos authentication bypass + did not occur for some URLs that matched a configured URL category. +
+
PAN-323141
 +
+ Fixed an issue where SD-WAN SaaS monitoring for HTTPS URLs + continuously flapped, which caused frequent traffic shifting between + ISPs. This occurred due to the firewall unexpectedly hitting resource + limits for monitoring. +
+
PAN-321937
 +
+ Fixed an issue where an expired SD-WAN license caused SD-WAN tunnels + to become unavailable, which resulted in traffic interruptions. With + this fix, the device provides logs and commit messages about expired + licenses. +
+
PAN-316721
 +
+ Fixed an issue where multiple EDL fetches were queued and did not + complete. +
+
PAN-312685
 +
+ Fixed an issue where committing a scheduled configuration push on + Panorama caused the + configd + process to stop responding unexpectedly. +
+
PAN-310476
 +
+ (Firewalls in HA configurations only) Fixed an + issue where CPLD did not power cycle the firewall after internal + packet path monitoring failures occurred, and both firewalls instead + became simultaneously non-functional after a reboot. +
+
PAN-310263
 +
+ (VM-Series firewalls only) Fixed an issue where + enabling TLS1.3 in a decryption profile prevented access to websites. +
+
diff --git a/reference/PAN-OS/addressed/11.1.4-h36.html b/reference/PAN-OS/addressed/11.1.4-h36.html new file mode 100644 index 0000000..7918894 --- /dev/null +++ b/reference/PAN-OS/addressed/11.1.4-h36.html @@ -0,0 +1,57 @@ + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
—
+ 		+
+ Fixes were made to address the following CVEs: + +
+
diff --git a/reference/PAN-OS/addressed/11.1.6-h38.html b/reference/PAN-OS/addressed/11.1.6-h38.html new file mode 100644 index 0000000..9175b75 --- /dev/null +++ b/reference/PAN-OS/addressed/11.1.6-h38.html @@ -0,0 +1,127 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
—
+ 		+
+ Fixes were made to address the following CVEs: + +
+
PAN-332247
 +
+ Fixed an issue where the proxy generated HTTP 503 errors for multiple + URLs, which prevented users from connecting to servers. With this fix, + the proxy now functions as expected. +
+
PAN-325151
 +
+ Fixed an issue where a system log was not generated when the proxy + reached its session limit. +
+
PAN-314624
 +
+ Fixed an issue where the + useridd process became + unresponsive and restarted when attempting to dump the Host + Information Profile (HIP) database via CLI while the system was + actively processing HIP reports. This was caused by a lock contention. + With this fix, the process now operates as expected under these + conditions. +
+
PAN-310476
 +
+ (Firewalls in HA configurations only) Fixed an + issue where CPLD did not power cycle the firewall after internal + packet path monitoring failures occurred, and both firewalls instead + became simultaneously non-functional after a reboot. +
+
PAN-283774
 +
+ Fixed an issue where the firewall placed UDP sessions into a + Discard + state when a DNS Sinkhole/Block action occurred, which prevented + subsequent DNS requests from reusing the same session and caused + DNS-related outages. +
+
diff --git a/reference/PAN-OS/addressed/11.1.7-h10.html b/reference/PAN-OS/addressed/11.1.7-h10.html new file mode 100644 index 0000000..ef43897 --- /dev/null +++ b/reference/PAN-OS/addressed/11.1.7-h10.html @@ -0,0 +1,57 @@ + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
—
+ 		+
+ Fixes were made to address the following CVEs: + +
+