This commit is contained in:
aaron.axvig committed
1 parent
a404ee5df7
commit
10fb5719b5
10 files changed
+2135
No files matched your search
@@ -0,0 +1,296 @@
|
|||||||
|
<table class="table colsep rowsep table-striped">
|
||||||
|
<!--cq:include script="../../common/tablestack.jsp" /-->
|
||||||
|
|
||||||
|
<colgroup>
|
||||||
|
<col style="width: 25%" />
|
||||||
|
<col style="width: 75%" />
|
||||||
|
</colgroup>
|
||||||
|
<thead class="thead">
|
||||||
|
<tr class="row">
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Issue ID</div>
|
||||||
|
</th>
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Description</div>
|
||||||
|
</th>
|
||||||
|
</tr>
|
||||||
|
</thead>
|
||||||
|
|
||||||
|
<tbody class="tbody">
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-331387</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where IPsec tunnels frequently went down due to high
|
||||||
|
process memory utilization. With this fix, the system process now
|
||||||
|
manages memory correctly, preventing tunnel instability.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-330196</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the firewall unexpectedly terminated operations
|
||||||
|
and rebooted due to an internal software error.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-328770</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where BGP Graceful Restart (GR) capability continued to
|
||||||
|
be advertised to BGP peers after GR was disabled on a Logical Router
|
||||||
|
configured with the Advanced Routing Engine, which caused peers to
|
||||||
|
incorrectly believe the firewall supported GR. With this fix,
|
||||||
|
disabling BGP GR on a Logical Router correctly removes the capability
|
||||||
|
from BGP Open messages.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-325496</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt">KVM VM-Series firewalls only</tt>) Fixed an issue
|
||||||
|
where ARP entries were incomplete after an upgrade to an affected
|
||||||
|
release.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-324336</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where GlobalProtect iOS users were unable to connect
|
||||||
|
due to the firewall incorrectly reporting that the maximum number of
|
||||||
|
users was exceeded, even when the actual number of active users was
|
||||||
|
below the configured limit.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-323974</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where you were unable to add logging drives to the
|
||||||
|
firewall, and validation errors occurred when pushing configurations
|
||||||
|
from Panorama.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-321937</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where an expired SD-WAN license caused SD-WAN tunnels
|
||||||
|
to become unavailable, which resulted in traffic interruptions. With
|
||||||
|
this fix, the device provides logs and commit messages about expired
|
||||||
|
licenses.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-321204</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where FTP-DATA sessions did not match the installed
|
||||||
|
predict session, which led to session termination in HA
|
||||||
|
configurations.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-319343</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt">Prisma Access Gateways only</tt>) Fixed an issue
|
||||||
|
where the global management plane stopped responding, which caused SSH
|
||||||
|
and HTML disconnections, HIP database lookup failures, and
|
||||||
|
significantly slower SCM commits. This occurred when egress IP allow
|
||||||
|
listing was enabled in SCM and changes were made to EDLs.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-314873</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the firewall intermittently stopped forwarding
|
||||||
|
traffic to the internet.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-312685</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where committing a scheduled configuration push on
|
||||||
|
Panorama caused the
|
||||||
|
<a
|
||||||
|
class="term"
|
||||||
|
href="#"
|
||||||
|
title=""
|
||||||
|
data-scope=""
|
||||||
|
data-format="dita"
|
||||||
|
data-type=""
|
||||||
|
target="_self"
|
||||||
|
>configd</a
|
||||||
|
>
|
||||||
|
process to stop responding unexpectedly.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-311988</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt">Firewalls in FIPS mode only</tt>) Fixed decryption
|
||||||
|
issues that occurred after an upgrade to an affected release.
|
||||||
|
</div>
|
||||||
|
<div class="p">
|
||||||
|
To enable this fix, run the CLI command
|
||||||
|
<span class="ph systemoutput"
|
||||||
|
>debug dataplane set ssl-decrypt low-memory-throttle enable</span
|
||||||
|
>.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-310699</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the firewall stripped the Authentication Key
|
||||||
|
Identifier (AKID) from certificates using SSL decryption, which
|
||||||
|
prevented clients from authenticating server certificates and resulted
|
||||||
|
in decryption failures.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-310476</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt">Firewalls in HA configurations only</tt>) Fixed an
|
||||||
|
issue where CPLD did not power cycle the firewall after internal
|
||||||
|
packet path monitoring failures occurred, and both firewalls instead
|
||||||
|
became simultaneously non-functional after a reboot.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-310263</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt">VM-Series firewalls only</tt>) Fixed an issue where
|
||||||
|
enabling TLS1.3 in a decryption profile prevented access to websites.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-307933</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(Panorama appliances in Log Collector mode only) Fixed an issue where
|
||||||
|
the log collectors became unstable for an extended period of time when
|
||||||
|
receiving large amounts of traffic.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-306225</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue on the firewall where the
|
||||||
|
<a
|
||||||
|
class="term"
|
||||||
|
href="#"
|
||||||
|
title=""
|
||||||
|
data-scope=""
|
||||||
|
data-format="dita"
|
||||||
|
data-type=""
|
||||||
|
target="_self"
|
||||||
|
>sslmgr</a
|
||||||
|
>
|
||||||
|
process memory utilization continually increased due to memory
|
||||||
|
fragmentation.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-301756</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where ACC logs displayed a discrepancy in SSL traffic
|
||||||
|
information between Panorama and the firewall. With this fix, the SSL
|
||||||
|
traffic information in ACC logs now aligns correctly.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-299027</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt"
|
||||||
|
>Panorama virtual appliances in Management Mode only</tt
|
||||||
|
>) Fixed an issue where a maximum configuration size of 120 was
|
||||||
|
incorrectly enforced instead of 150 MB.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-297880</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where WildFire Analysis reports failed to load,
|
||||||
|
displaying a
|
||||||
|
<span class="ph uicontrol">500 Internal Server Error</span> when the
|
||||||
|
system attempted to retrieve reports for certain files. With this fix,
|
||||||
|
WildFire Analysis reports load as expected.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-282335</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where firewalls in a cluster experienced approximately
|
||||||
|
50% packet loss on IPSec NATT tunnels when tunnel acceleration was
|
||||||
|
enabled.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-248913</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the Elasticsearch client certificate was not auto
|
||||||
|
renewed, which caused it to enter a Red state, and logs were not
|
||||||
|
displayed in Panorama.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
@@ -0,0 +1,165 @@
|
|||||||
|
<table class="table colsep rowsep table-striped">
|
||||||
|
<!--cq:include script="../../common/tablestack.jsp" /-->
|
||||||
|
|
||||||
|
<colgroup>
|
||||||
|
<col style="width: 25%" />
|
||||||
|
<col style="width: 75%" />
|
||||||
|
</colgroup>
|
||||||
|
<thead class="thead">
|
||||||
|
<tr class="row">
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Issue ID</div>
|
||||||
|
</th>
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Description</div>
|
||||||
|
</th>
|
||||||
|
</tr>
|
||||||
|
</thead>
|
||||||
|
|
||||||
|
<tbody class="tbody">
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">—</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixes were made to address the following CVEs:
|
||||||
|
<ul
|
||||||
|
id="pan_os_11_1_10_h33_addressed_issues_ul-nwg_dxl_vjc"
|
||||||
|
class="ul"
|
||||||
|
>
|
||||||
|
<li class="li">
|
||||||
|
<a
|
||||||
|
class="xref"
|
||||||
|
href="https://security.paloaltonetworks.com/CVE-2026-0310"
|
||||||
|
title=""
|
||||||
|
data-scope="external"
|
||||||
|
data-format="html"
|
||||||
|
data-type=""
|
||||||
|
target="_blank"
|
||||||
|
>CVE-2026-0310</a
|
||||||
|
>
|
||||||
|
</li>
|
||||||
|
<li class="li">
|
||||||
|
<a
|
||||||
|
class="xref"
|
||||||
|
href="https://security.paloaltonetworks.com/CVE-2026-0309"
|
||||||
|
title=""
|
||||||
|
data-scope="external"
|
||||||
|
data-format="html"
|
||||||
|
data-type=""
|
||||||
|
target="_blank"
|
||||||
|
>CVE-2026-0309</a
|
||||||
|
>
|
||||||
|
</li>
|
||||||
|
</ul>
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-332247</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the proxy generated HTTP 503 errors for multiple
|
||||||
|
URLs, which prevented users from connecting to servers. With this fix,
|
||||||
|
the proxy now functions as expected.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-329612</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where multicast routing entries for certain IPTV
|
||||||
|
streams were not correctly installed or populated with necessary
|
||||||
|
interface information, which prevented the proper forwarding of
|
||||||
|
multicast traffic. With this fix, multicast traffic now forwards as
|
||||||
|
expected.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-325151</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where a system log was not generated when the proxy
|
||||||
|
reached its session limit.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-313218</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Added the following CLI commands to address QoS packet drops due to
|
||||||
|
bursty traffic:
|
||||||
|
</div>
|
||||||
|
<ul class="ul">
|
||||||
|
<li class="li">
|
||||||
|
<span class="ph systemoutput"
|
||||||
|
>debug dataplane set qos-setting qos-param qlimit 300</span
|
||||||
|
>
|
||||||
|
</li>
|
||||||
|
<li class="li">
|
||||||
|
<span class="ph systemoutput"
|
||||||
|
>debug dataplane set qos-setting qos-param red low 50 high
|
||||||
|
90</span
|
||||||
|
>
|
||||||
|
</li>
|
||||||
|
</ul>
|
||||||
|
<div class="p">
|
||||||
|
To utilize this fix, change the parameters, disable QoS, commit
|
||||||
|
changes, enable QOS, and then re-commit changes.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-307481</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed a commit failure issue that occurred after migrating from Legacy
|
||||||
|
to Advanced routing on firewalls where an OSPF authentication profile
|
||||||
|
was configured to use a 16-character MD5 key with key-ID 10.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-291706</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the software tag descriptor was always at 100,
|
||||||
|
which led to resource unavailability errors and prevented users from
|
||||||
|
obtaining DHCP IP addresses.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-283774</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the firewall placed UDP sessions into a
|
||||||
|
<a
|
||||||
|
class="term"
|
||||||
|
href="#"
|
||||||
|
title=""
|
||||||
|
data-scope=""
|
||||||
|
data-format="dita"
|
||||||
|
data-type=""
|
||||||
|
target="_self"
|
||||||
|
>Discard</a
|
||||||
|
>
|
||||||
|
state when a DNS Sinkhole/Block action occurred, which prevented
|
||||||
|
subsequent DNS requests from reusing the same session and caused
|
||||||
|
DNS-related outages.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
@@ -0,0 +1,31 @@
|
|||||||
|
<table class="table colsep rowsep table-striped">
|
||||||
|
<!--cq:include script="../../common/tablestack.jsp" /-->
|
||||||
|
|
||||||
|
<colgroup>
|
||||||
|
<col style="width: 25%" />
|
||||||
|
<col style="width: 75%" />
|
||||||
|
</colgroup>
|
||||||
|
<thead class="thead">
|
||||||
|
<tr class="row">
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Issue ID</div>
|
||||||
|
</th>
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Description</div>
|
||||||
|
</th>
|
||||||
|
</tr>
|
||||||
|
</thead>
|
||||||
|
|
||||||
|
<tbody class="tbody">
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-326424</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where high memory utilization occurred in the
|
||||||
|
<span class="ph uicontrol">escd</span> process. With this fix, memory
|
||||||
|
utilization for the process remained stable.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
@@ -0,0 +1,532 @@
|
|||||||
|
<table class="table colsep rowsep table-striped">
|
||||||
|
<!--cq:include script="../../common/tablestack.jsp" /-->
|
||||||
|
|
||||||
|
<colgroup>
|
||||||
|
<col style="width: 25%" />
|
||||||
|
<col style="width: 75%" />
|
||||||
|
</colgroup>
|
||||||
|
<thead class="thead">
|
||||||
|
<tr class="row">
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Issue ID</div>
|
||||||
|
</th>
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Description</div>
|
||||||
|
</th>
|
||||||
|
</tr>
|
||||||
|
</thead>
|
||||||
|
|
||||||
|
<tbody class="tbody">
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-332095</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where a commit to add a new tunnel interface to an
|
||||||
|
existing Virtual Router caused BGP routes to be temporarily withdrawn,
|
||||||
|
which led to active traffic sessions being routed over incorrect paths
|
||||||
|
during the commit window. With this fix, adding a tunnel interface to
|
||||||
|
an existing Virtual Router no longer disrupts BGP route availability.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-331387</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where IPsec tunnels frequently went down due to high
|
||||||
|
process memory utilization. With this fix, the system process now
|
||||||
|
manages memory correctly, preventing tunnel instability.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-330196</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the firewall unexpectedly terminated operations
|
||||||
|
and rebooted due to an internal software error.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-328770</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where BGP Graceful Restart (GR) capability continued to
|
||||||
|
be advertised to BGP peers after GR was disabled on a Logical Router
|
||||||
|
configured with the Advanced Routing Engine, which caused peers to
|
||||||
|
incorrectly believe the firewall supported GR. With this fix,
|
||||||
|
disabling BGP GR on a Logical Router correctly removes the capability
|
||||||
|
from BGP Open messages.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-326056</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where ACE applications did not match the correct
|
||||||
|
Security policy rules when the service was not set to
|
||||||
|
<span class="ph uicontrol">Application Default</span> after an
|
||||||
|
upgrade, which caused traffic to be incorrectly denied.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-325496</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt">KVM VM-Series firewalls only</tt>) Fixed an issue
|
||||||
|
where ARP entries were incomplete after an upgrade to an affected
|
||||||
|
release.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-325057</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where TCP sessions were dropped due to an
|
||||||
|
ACK-out-of-window condition during TCP reassembly when SYN cookies
|
||||||
|
were enabled in a Zone Protection Profile. With this fix, TCP session
|
||||||
|
establishment with SYN cookies enabled correctly tracks sequence
|
||||||
|
numbers and no longer drops valid ACK packets from the Server.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-324336</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where GlobalProtect iOS users were unable to connect
|
||||||
|
due to the firewall incorrectly reporting that the maximum number of
|
||||||
|
users was exceeded, even when the actual number of active users was
|
||||||
|
below the configured limit.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-323974</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where you were unable to add logging drives to the
|
||||||
|
firewall, and validation errors occurred when pushing configurations
|
||||||
|
from Panorama.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p">PAN-329034</div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an intermittent issue where firewall restarted unexpectedly
|
||||||
|
while processing zip files.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p">PAN-323501</div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where SWG Explicit Proxy Kerberos authentication bypass
|
||||||
|
did not occur for some URLs that matched a configured URL category.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p">PAN-323141</div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where SD-WAN SaaS monitoring for HTTPS URLs
|
||||||
|
continuously flapped, which caused frequent traffic shifting between
|
||||||
|
ISPs. This occurred due to the firewall unexpectedly hitting resource
|
||||||
|
limits for monitoring.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-321937</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where an expired SD-WAN license caused SD-WAN tunnels
|
||||||
|
to become unavailable, which resulted in traffic interruptions. With
|
||||||
|
this fix, the device provides logs and commit messages about expired
|
||||||
|
licenses.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-321204</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where FTP-DATA sessions did not match the installed
|
||||||
|
predict session, which led to session termination in HA
|
||||||
|
configurations.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-319343</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt">Prisma Access Gateways only</tt>) Fixed an issue
|
||||||
|
where the global management plane stopped responding, which caused SSH
|
||||||
|
and HTML disconnections, HIP database lookup failures, and
|
||||||
|
significantly slower SCM commits. This occurred when egress IP allow
|
||||||
|
listing was enabled in SCM and changes were made to EDLs.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p">PAN-317648</div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt"
|
||||||
|
>PA-5450 firewalls and PA-7000 Series firewalls with 100G NPCs
|
||||||
|
only</tt
|
||||||
|
>) Fixed an issue where intermittent packet loss occurred when
|
||||||
|
traversing the dataplane after upgrading the firewall. This occurred
|
||||||
|
when a dataplane HA interface was configured in an environment where
|
||||||
|
Slot 1 was unpopulated, which resulted in a wildcard entry being
|
||||||
|
created within the QMAP table.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p">PAN-316721</div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where multiple EDL fetches were queued and did not
|
||||||
|
complete.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-317614</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where high throughput and increased packet rates caused
|
||||||
|
high dataplane CPU usage.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-316979</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the firewall rebooted unexpectedly when
|
||||||
|
packet-diag logging was enabled. With this fix, the firewall maintains
|
||||||
|
stability when this logging is active.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-316869</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where previously committed Security policy rules were
|
||||||
|
removed when a full commit was performed by a different administrator,
|
||||||
|
which led to the inadvertent loss of configuration changes. With this
|
||||||
|
fix, Security policy rules are retained as expected after a full
|
||||||
|
commit.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-314873</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the firewall intermittently stopped forwarding
|
||||||
|
traffic to the internet.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p">PAN-314776</div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the
|
||||||
|
<a
|
||||||
|
class="term"
|
||||||
|
href="#"
|
||||||
|
title=""
|
||||||
|
data-scope=""
|
||||||
|
data-format="dita"
|
||||||
|
data-type=""
|
||||||
|
target="_self"
|
||||||
|
>configd</a
|
||||||
|
>
|
||||||
|
process stopped responding after pushing configuration changes from
|
||||||
|
Panorama to the firewall.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p">PAN-314624</div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the
|
||||||
|
<span class="ph systemoutput">useridd</span> process became
|
||||||
|
unresponsive and restarted when attempting to dump the Host
|
||||||
|
Information Profile (HIP) database via CLI while the system was
|
||||||
|
actively processing HIP reports. This was caused by a lock contention.
|
||||||
|
With this fix, the process now operates as expected under these
|
||||||
|
conditions.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-312685</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where committing a scheduled configuration push on
|
||||||
|
Panorama caused the
|
||||||
|
<a
|
||||||
|
class="term"
|
||||||
|
href="#"
|
||||||
|
title=""
|
||||||
|
data-scope=""
|
||||||
|
data-format="dita"
|
||||||
|
data-type=""
|
||||||
|
target="_self"
|
||||||
|
>configd</a
|
||||||
|
>
|
||||||
|
process to stop responding unexpectedly.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p">PAN-312618</div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the firewall was unable to activate GlobalProtect
|
||||||
|
client software and displayed
|
||||||
|
<span class="ph systemoutput">SW LIMIT</span> messages related to
|
||||||
|
max-profiles and unsupported major and minor versions in the downgrade
|
||||||
|
list, which prevented successful software installation.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-312354</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where Captive Portal authentication redirects failed
|
||||||
|
for HTTPS traffic when a user attempted to access internal HTTPS
|
||||||
|
websites via URL, which led to
|
||||||
|
<span class="ph uicontrol">ERR_CONNECTION_RESET</span> error messages
|
||||||
|
in the browser with SSL decryption and CTD handshake inspection
|
||||||
|
enabled.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-311988</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt">Firewalls in FIPS mode only</tt>) Fixed decryption
|
||||||
|
issues that occurred after an upgrade to an affected release.
|
||||||
|
</div>
|
||||||
|
<div class="p">
|
||||||
|
To enable this fix, run the CLI command
|
||||||
|
<span class="ph systemoutput"
|
||||||
|
>debug dataplane set ssl-decrypt low-memory-throttle enable</span
|
||||||
|
>.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-310699</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the firewall stripped the Authentication Key
|
||||||
|
Identifier (AKID) from certificates using SSL decryption, which
|
||||||
|
prevented clients from authenticating server certificates and resulted
|
||||||
|
in decryption failures.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-310476</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt">Firewalls in HA configurations only</tt>) Fixed an
|
||||||
|
issue where CPLD did not power cycle the firewall after internal
|
||||||
|
packet path monitoring failures occurred, and both firewalls instead
|
||||||
|
became simultaneously non-functional after a reboot.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-310263</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt">VM-Series firewalls only</tt>) Fixed an issue where
|
||||||
|
enabling TLS1.3 in a decryption profile prevented access to websites.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-307933</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(Panorama appliances in Log Collector mode only) Fixed an issue where
|
||||||
|
the log collectors became unstable for an extended period of time when
|
||||||
|
receiving large amounts of traffic.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-306225</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue on the firewall where the
|
||||||
|
<a
|
||||||
|
class="term"
|
||||||
|
href="#"
|
||||||
|
title=""
|
||||||
|
data-scope=""
|
||||||
|
data-format="dita"
|
||||||
|
data-type=""
|
||||||
|
target="_self"
|
||||||
|
>sslmgr</a
|
||||||
|
>
|
||||||
|
process memory utilization continually increased due to memory
|
||||||
|
fragmentation.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p">PAN-304840</div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where multiple firewalls experienced high management
|
||||||
|
CPU utilization after upgrading to an affected release due to repeated
|
||||||
|
index regeneration occurring every 15 minutes, which caused periodic
|
||||||
|
CPU spikes above 90%.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p">PAN-302983</div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where, after committing changes on Panorama, a shared
|
||||||
|
post-rule moved to the end of the
|
||||||
|
<span class="ph systemoutput">post shared rulebase</span> on the
|
||||||
|
managed device instead of remaining at the top.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-301756</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where ACC logs displayed a discrepancy in SSL traffic
|
||||||
|
information between Panorama and the firewall. With this fix, the SSL
|
||||||
|
traffic information in ACC logs now aligns correctly.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-299027</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt"
|
||||||
|
>Panorama virtual appliances in Management Mode only</tt
|
||||||
|
>) Fixed an issue where a maximum configuration size of 120 was
|
||||||
|
incorrectly enforced instead of 150 MB.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-297880</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where WildFire Analysis reports failed to load,
|
||||||
|
displaying a
|
||||||
|
<span class="ph uicontrol">500 Internal Server Error</span> when the
|
||||||
|
system attempted to retrieve reports for certain files. With this fix,
|
||||||
|
WildFire Analysis reports load as expected.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-294001</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
Fixed an issue where Panorama®-managed firewalls logged
|
||||||
|
<span class="ph systemoutput">Failed in get_pwchange_required</span>
|
||||||
|
error messages in the <span class="ph systemoutput">authd</span> logs
|
||||||
|
when locally defined administrators authenticated.
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-282335</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where firewalls in a cluster experienced approximately
|
||||||
|
50% packet loss on IPSec NATT tunnels when tunnel acceleration was
|
||||||
|
enabled.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
@@ -0,0 +1,224 @@
|
|||||||
|
<table class="table colsep rowsep table-striped">
|
||||||
|
<!--cq:include script="../../common/tablestack.jsp" /-->
|
||||||
|
|
||||||
|
<colgroup>
|
||||||
|
<col style="width: 25%" />
|
||||||
|
<col style="width: 75%" />
|
||||||
|
</colgroup>
|
||||||
|
<thead class="thead">
|
||||||
|
<tr class="row">
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Issue ID</div>
|
||||||
|
</th>
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Description</div>
|
||||||
|
</th>
|
||||||
|
</tr>
|
||||||
|
</thead>
|
||||||
|
|
||||||
|
<tbody class="tbody">
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">—</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixes were made to address the following CVEs:
|
||||||
|
<ul
|
||||||
|
id="pan_os_11_1_13_h12_addressed_issues_ul-nwg_dxl_vjc"
|
||||||
|
class="ul"
|
||||||
|
>
|
||||||
|
<li class="li">
|
||||||
|
<a
|
||||||
|
class="xref"
|
||||||
|
href="https://security.paloaltonetworks.com/CVE-2026-0310"
|
||||||
|
title=""
|
||||||
|
data-scope="external"
|
||||||
|
data-format="html"
|
||||||
|
data-type=""
|
||||||
|
target="_blank"
|
||||||
|
>CVE-2026-0310</a
|
||||||
|
>
|
||||||
|
</li>
|
||||||
|
<li class="li">
|
||||||
|
<a
|
||||||
|
class="xref"
|
||||||
|
href="https://security.paloaltonetworks.com/CVE-2026-0309"
|
||||||
|
title=""
|
||||||
|
data-scope="external"
|
||||||
|
data-format="html"
|
||||||
|
data-type=""
|
||||||
|
target="_blank"
|
||||||
|
>CVE-2026-0309</a
|
||||||
|
>
|
||||||
|
</li>
|
||||||
|
</ul>
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-333894</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where communication with Microsoft Azure services was
|
||||||
|
disrupted, which resulted in application outages. This occurred when
|
||||||
|
firewalls dropped SYN-ACK packets that were part of a SYN-ACK cookie
|
||||||
|
mechanism activated by Azure's DDoS mitigation. With this fix,
|
||||||
|
firewalls now maintain connectivity during such traffic events.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-332608</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where firewalls intermittently disconnected from SLS.
|
||||||
|
With this fix, firewalls maintained a stable connection to SLS.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-332247</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the proxy generated HTTP 503 errors for multiple
|
||||||
|
URLs, which prevented users from connecting to servers. With this fix,
|
||||||
|
the proxy now functions as expected.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-329612</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where multicast routing entries for certain IPTV
|
||||||
|
streams were not correctly installed or populated with necessary
|
||||||
|
interface information, which prevented the proper forwarding of
|
||||||
|
multicast traffic. With this fix, multicast traffic now forwards as
|
||||||
|
expected.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-325151</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where a system log was not generated when the proxy
|
||||||
|
reached its session limit.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-323485</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where multicast radio RTP based traffic was dropped
|
||||||
|
after an upgrade when the firewall performed Cloud Inline inspection,
|
||||||
|
which led to an exceeded session queue for Cloud Threat Detection.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-313218</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Added the following CLI commands to address QoS packet drops due to
|
||||||
|
bursty traffic:
|
||||||
|
</div>
|
||||||
|
<ul class="ul">
|
||||||
|
<li class="li">
|
||||||
|
<span class="ph systemoutput"
|
||||||
|
>debug dataplane set qos-setting qos-param qlimit 300</span
|
||||||
|
>
|
||||||
|
</li>
|
||||||
|
<li class="li">
|
||||||
|
<span class="ph systemoutput"
|
||||||
|
>debug dataplane set qos-setting qos-param red low 50 high
|
||||||
|
90</span
|
||||||
|
>
|
||||||
|
</li>
|
||||||
|
</ul>
|
||||||
|
<div class="p">
|
||||||
|
To utilize this fix, change the parameters, disable QoS, commit
|
||||||
|
changes, enable QOS, and then re-commit changes.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-312844</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where a TLSv1.3 handshake did not complete when SSL
|
||||||
|
Forward Proxy was enabled. This occurred when a large ClientHello
|
||||||
|
message was split across multiple TCP segments and the final segment
|
||||||
|
contained only one byte.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-307481</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed a commit failure issue that occurred after migrating from Legacy
|
||||||
|
to Advanced routing on firewalls where an OSPF authentication profile
|
||||||
|
was configured to use a 16-character MD5 key with key-ID 10.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-291706</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the software tag descriptor was always at 100,
|
||||||
|
which led to resource unavailability errors and prevented users from
|
||||||
|
obtaining DHCP IP addresses.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-283774</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the firewall placed UDP sessions into a
|
||||||
|
<a
|
||||||
|
class="term"
|
||||||
|
href="#"
|
||||||
|
title=""
|
||||||
|
data-scope=""
|
||||||
|
data-format="dita"
|
||||||
|
data-type=""
|
||||||
|
target="_self"
|
||||||
|
>Discard</a
|
||||||
|
>
|
||||||
|
state when a DNS Sinkhole/Block action occurred, which prevented
|
||||||
|
subsequent DNS requests from reusing the same session and caused
|
||||||
|
DNS-related outages.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-264508</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where Cloud Identity Engine did not fetch user-mapping
|
||||||
|
details for XML API users. This occurred when the firewall learned the
|
||||||
|
same IP-user mapping multiple times within a short period. With this
|
||||||
|
fix, the Cloud Identity Engine now accurately fetches these
|
||||||
|
user-mapping details.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
@@ -0,0 +1,388 @@
|
|||||||
|
<table class="table colsep rowsep table-striped">
|
||||||
|
<!--cq:include script="../../common/tablestack.jsp" /-->
|
||||||
|
|
||||||
|
<colgroup>
|
||||||
|
<col style="width: 25%" />
|
||||||
|
<col style="width: 75%" />
|
||||||
|
</colgroup>
|
||||||
|
<thead class="thead">
|
||||||
|
<tr class="row">
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Issue ID</div>
|
||||||
|
</th>
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Description</div>
|
||||||
|
</th>
|
||||||
|
</tr>
|
||||||
|
</thead>
|
||||||
|
|
||||||
|
<tbody class="tbody">
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">—</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixes were made to address the following CVEs:
|
||||||
|
<ul id="pan_os_11_1_16_h2_addressed_issues_ul-nwg_dxl_vjc" class="ul">
|
||||||
|
<li class="li">
|
||||||
|
<a
|
||||||
|
class="xref"
|
||||||
|
href="https://security.paloaltonetworks.com/CVE-2026-0310"
|
||||||
|
title=""
|
||||||
|
data-scope="external"
|
||||||
|
data-format="html"
|
||||||
|
data-type=""
|
||||||
|
target="_blank"
|
||||||
|
>CVE-2026-0310</a
|
||||||
|
>
|
||||||
|
</li>
|
||||||
|
<li class="li">
|
||||||
|
<a
|
||||||
|
class="xref"
|
||||||
|
href="https://security.paloaltonetworks.com/CVE-2026-0309"
|
||||||
|
title=""
|
||||||
|
data-scope="external"
|
||||||
|
data-format="html"
|
||||||
|
data-type=""
|
||||||
|
target="_blank"
|
||||||
|
>CVE-2026-0309</a
|
||||||
|
>
|
||||||
|
</li>
|
||||||
|
<li class="li">
|
||||||
|
<a
|
||||||
|
class="xref"
|
||||||
|
href="https://security.paloaltonetworks.com/CVE-2026-0308"
|
||||||
|
title=""
|
||||||
|
data-scope="external"
|
||||||
|
data-format="html"
|
||||||
|
data-type=""
|
||||||
|
target="_blank"
|
||||||
|
>CVE-2026-0308</a
|
||||||
|
>
|
||||||
|
</li>
|
||||||
|
</ul>
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-332608</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where firewalls intermittently disconnected from SLS.
|
||||||
|
With this fix, firewalls maintained a stable connection to SLS.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-332247</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the proxy generated HTTP 503 errors for multiple
|
||||||
|
URLs, which prevented users from connecting to servers. With this fix,
|
||||||
|
the proxy now functions as expected.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-332095</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where a commit to add a new tunnel interface to an
|
||||||
|
existing Virtual Router caused BGP routes to be temporarily withdrawn,
|
||||||
|
which led to active traffic sessions being routed over incorrect paths
|
||||||
|
during the commit window. With this fix, adding a tunnel interface to
|
||||||
|
an existing Virtual Router no longer disrupts BGP route availability.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-331387</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where IPsec tunnels frequently went down due to high
|
||||||
|
process memory utilization. With this fix, the system process now
|
||||||
|
manages memory correctly, preventing tunnel instability.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-330196</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the firewall unexpectedly terminated operations
|
||||||
|
and rebooted due to an internal software error.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-329793</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the characters in PDF Summary Reports did not
|
||||||
|
display correctly when the Locale was set as Japanese, Korean,
|
||||||
|
Simplified Chinese, or Traditional Chinese.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-329637</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the push scope window did not display the target
|
||||||
|
devices when attempting to push configurations from Panorama, which
|
||||||
|
required manual selection of templates or device groups. With this
|
||||||
|
fix, the push scope window now correctly populates with the intended
|
||||||
|
push scope.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-329612</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where multicast routing entries for certain IPTV
|
||||||
|
streams were not correctly installed or populated with necessary
|
||||||
|
interface information, which prevented the proper forwarding of
|
||||||
|
multicast traffic. With this fix, multicast traffic now forwards as
|
||||||
|
expected.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-328770</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where BGP Graceful Restart (GR) capability continued to
|
||||||
|
be advertised to BGP peers after GR was disabled on a Logical Router
|
||||||
|
configured with the Advanced Routing Engine, which caused peers to
|
||||||
|
incorrectly believe the firewall supported GR. With this fix,
|
||||||
|
disabling BGP GR on a Logical Router correctly removes the capability
|
||||||
|
from BGP Open messages.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-325151</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where a system log was not generated when the proxy
|
||||||
|
reached its session limit.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-325057</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where TCP sessions were dropped due to an
|
||||||
|
ACK-out-of-window condition during TCP reassembly when SYN cookies
|
||||||
|
were enabled in a Zone Protection Profile. With this fix, TCP session
|
||||||
|
establishment with SYN cookies enabled correctly tracks sequence
|
||||||
|
numbers and no longer drops valid ACK packets from the Server.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-324336</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where GlobalProtect iOS users were unable to connect
|
||||||
|
due to the firewall incorrectly reporting that the maximum number of
|
||||||
|
users was exceeded, even when the actual number of active users was
|
||||||
|
below the configured limit.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-321204</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where FTP-DATA sessions did not match the installed
|
||||||
|
predict session, which led to session termination in HA
|
||||||
|
configurations.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-316979</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the firewall rebooted unexpectedly when
|
||||||
|
packet-diag logging was enabled. With this fix, the firewall maintains
|
||||||
|
stability when this logging is active.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-316869</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where previously committed Security policy rules were
|
||||||
|
removed when a full commit was performed by a different administrator,
|
||||||
|
which led to the inadvertent loss of configuration changes. With this
|
||||||
|
fix, Security policy rules are retained as expected after a full
|
||||||
|
commit.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-315683</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where certain permitted IP addresses, when pushed from
|
||||||
|
a Panorama template, remained editable on the firewall web interface.
|
||||||
|
With this fix, these template-managed IP addresses are no longer
|
||||||
|
editable on the firewall.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-314873</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the firewall intermittently stopped forwarding
|
||||||
|
traffic to the internet.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-312844</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where a TLSv1.3 handshake did not complete when SSL
|
||||||
|
Forward Proxy was enabled. This occurred when a large ClientHello
|
||||||
|
message was split across multiple TCP segments and the final segment
|
||||||
|
contained only one byte.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-311988</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt">Firewalls in FIPS mode only</tt>) Fixed decryption
|
||||||
|
issues that occurred after an upgrade to an affected release.
|
||||||
|
</div>
|
||||||
|
<div class="p">
|
||||||
|
To enable this fix, run the CLI command
|
||||||
|
<span class="ph systemoutput"
|
||||||
|
>debug dataplane set ssl-decrypt low-memory-throttle enable</span
|
||||||
|
>.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-310699</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the firewall stripped the Authentication Key
|
||||||
|
Identifier (AKID) from certificates using SSL decryption, which
|
||||||
|
prevented clients from authenticating server certificates and resulted
|
||||||
|
in decryption failures.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-307933</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(Panorama appliances in Log Collector mode only) Fixed an issue where
|
||||||
|
the log collectors became unstable for an extended period of time when
|
||||||
|
receiving large amounts of traffic.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-301756</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where ACC logs displayed a discrepancy in SSL traffic
|
||||||
|
information between Panorama and the firewall. With this fix, the SSL
|
||||||
|
traffic information in ACC logs now aligns correctly.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-297880</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where WildFire Analysis reports failed to load,
|
||||||
|
displaying a
|
||||||
|
<span class="ph uicontrol">500 Internal Server Error</span> when the
|
||||||
|
system attempted to retrieve reports for certain files. With this fix,
|
||||||
|
WildFire Analysis reports load as expected.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-291706</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the software tag descriptor was always at 100,
|
||||||
|
which led to resource unavailability errors and prevented users from
|
||||||
|
obtaining DHCP IP addresses.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-283774</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the firewall placed UDP sessions into a
|
||||||
|
<a
|
||||||
|
class="term"
|
||||||
|
href="#"
|
||||||
|
title=""
|
||||||
|
data-scope=""
|
||||||
|
data-format="dita"
|
||||||
|
data-type=""
|
||||||
|
target="_self"
|
||||||
|
>Discard</a
|
||||||
|
>
|
||||||
|
state when a DNS Sinkhole/Block action occurred, which prevented
|
||||||
|
subsequent DNS requests from reusing the same session and caused
|
||||||
|
DNS-related outages.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-264508</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where Cloud Identity Engine did not fetch user-mapping
|
||||||
|
details for XML API users. This occurred when the firewall learned the
|
||||||
|
same IP-user mapping multiple times within a short period. With this
|
||||||
|
fix, the Cloud Identity Engine now accurately fetches these
|
||||||
|
user-mapping details.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
@@ -0,0 +1,258 @@
|
|||||||
|
<table class="table colsep rowsep table-striped">
|
||||||
|
<!--cq:include script="../../common/tablestack.jsp" /-->
|
||||||
|
|
||||||
|
<colgroup>
|
||||||
|
<col style="width: 25%" />
|
||||||
|
<col style="width: 75%" />
|
||||||
|
</colgroup>
|
||||||
|
<thead class="thead">
|
||||||
|
<tr class="row">
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Issue ID</div>
|
||||||
|
</th>
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Description</div>
|
||||||
|
</th>
|
||||||
|
</tr>
|
||||||
|
</thead>
|
||||||
|
|
||||||
|
<tbody class="tbody">
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p">—</div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
A fix was made to address
|
||||||
|
<a
|
||||||
|
class="xref"
|
||||||
|
href="https://security.paloaltonetworks.com/CVE-2026-0301"
|
||||||
|
title=""
|
||||||
|
data-scope="external"
|
||||||
|
data-format="html"
|
||||||
|
data-type=""
|
||||||
|
target="_blank"
|
||||||
|
>CVE-2026-0301</a
|
||||||
|
>.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-329834</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where a memory leak associated with some display CLI
|
||||||
|
commands caused instability.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-329698</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt">OCTEON, MIPS, platforms only</tt>) Fixed an issue
|
||||||
|
where the dataplane became unresponsive. With this fix, the data
|
||||||
|
planeoperates stably.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-329034</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an intermittent issue where firewall restarted unexpectedly
|
||||||
|
while processing zip files.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-328822</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt"
|
||||||
|
>VM-Series firewalls in Azure with Accelerated Networking and Data
|
||||||
|
Plane Development Kit (DPDK) enabled</tt
|
||||||
|
>) Fixed an issue where firewalls experienced increasing interface
|
||||||
|
receive errors, which led to intermittent traffic impact and
|
||||||
|
application downtime.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-327460</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where a
|
||||||
|
<span class="ph uicontrol">Commit and Push</span> operation on
|
||||||
|
Panorama did not successfully push configuration changes to Prisma
|
||||||
|
Access endpoints. This occurred when the system reported that not all
|
||||||
|
commit jobs were triggered. With this fix,
|
||||||
|
<span class="ph uicontrol">Commit and Push</span> operations now
|
||||||
|
correctly apply configurations to Prisma Access.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-326056</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where ACE applications did not match the correct
|
||||||
|
Security policy rules when the service was not set to
|
||||||
|
<span class="ph uicontrol">Application Default</span> after an
|
||||||
|
upgrade, which caused traffic to be incorrectly denied.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-325903</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where, after upgrading Panorama, a custom admin role
|
||||||
|
with Object Level Changes disabled did not automatically populate
|
||||||
|
out-of-sync firewalls in the push scope.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-325724</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where importing PKCS12 certificates failed with the
|
||||||
|
error
|
||||||
|
<span class="ph systemoutput"
|
||||||
|
>Import of certificate and private-key failed. Failed to extract
|
||||||
|
certificate</span
|
||||||
|
>.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-325496</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt">KVM VM-Series firewalls only</tt>) Fixed an issue
|
||||||
|
where ARP entries were incomplete after an upgrade to an affected
|
||||||
|
release.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-323974</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where you were unable to add logging drives to the
|
||||||
|
firewall, and validation errors occurred when pushing configurations
|
||||||
|
from Panorama.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-323842</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where commits intermittently failed on some Prisma
|
||||||
|
Access nodes with the error message
|
||||||
|
<span class="ph systemoutput">client pppoed phase 1 failure</span>.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-323501</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where SWG Explicit Proxy Kerberos authentication bypass
|
||||||
|
did not occur for some URLs that matched a configured URL category.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-323141</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where SD-WAN SaaS monitoring for HTTPS URLs
|
||||||
|
continuously flapped, which caused frequent traffic shifting between
|
||||||
|
ISPs. This occurred due to the firewall unexpectedly hitting resource
|
||||||
|
limits for monitoring.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-321937</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where an expired SD-WAN license caused SD-WAN tunnels
|
||||||
|
to become unavailable, which resulted in traffic interruptions. With
|
||||||
|
this fix, the device provides logs and commit messages about expired
|
||||||
|
licenses.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-316721</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where multiple EDL fetches were queued and did not
|
||||||
|
complete.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-312685</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where committing a scheduled configuration push on
|
||||||
|
Panorama caused the
|
||||||
|
<a
|
||||||
|
class="term"
|
||||||
|
href="#"
|
||||||
|
title=""
|
||||||
|
data-scope=""
|
||||||
|
data-format="dita"
|
||||||
|
data-type=""
|
||||||
|
target="_self"
|
||||||
|
>configd</a
|
||||||
|
>
|
||||||
|
process to stop responding unexpectedly.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-310476</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt">Firewalls in HA configurations only</tt>) Fixed an
|
||||||
|
issue where CPLD did not power cycle the firewall after internal
|
||||||
|
packet path monitoring failures occurred, and both firewalls instead
|
||||||
|
became simultaneously non-functional after a reboot.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-310263</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt">VM-Series firewalls only</tt>) Fixed an issue where
|
||||||
|
enabling TLS1.3 in a decryption profile prevented access to websites.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
@@ -0,0 +1,57 @@
|
|||||||
|
<table class="table colsep rowsep table-striped">
|
||||||
|
<!--cq:include script="../../common/tablestack.jsp" /-->
|
||||||
|
|
||||||
|
<colgroup>
|
||||||
|
<col style="width: 25%" />
|
||||||
|
<col style="width: 75%" />
|
||||||
|
</colgroup>
|
||||||
|
<thead class="thead">
|
||||||
|
<tr class="row">
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Issue ID</div>
|
||||||
|
</th>
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Description</div>
|
||||||
|
</th>
|
||||||
|
</tr>
|
||||||
|
</thead>
|
||||||
|
|
||||||
|
<tbody class="tbody">
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">—</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixes were made to address the following CVEs:
|
||||||
|
<ul id="pan_os_11_1_4_h36_addressed_issues_ul-nwg_dxl_vjc" class="ul">
|
||||||
|
<li class="li">
|
||||||
|
<a
|
||||||
|
class="xref"
|
||||||
|
href="https://security.paloaltonetworks.com/CVE-2026-0310"
|
||||||
|
title=""
|
||||||
|
data-scope="external"
|
||||||
|
data-format="html"
|
||||||
|
data-type=""
|
||||||
|
target="_blank"
|
||||||
|
>CVE-2026-0310</a
|
||||||
|
>
|
||||||
|
</li>
|
||||||
|
<li class="li">
|
||||||
|
<a
|
||||||
|
class="xref"
|
||||||
|
href="https://security.paloaltonetworks.com/CVE-2026-0309"
|
||||||
|
title=""
|
||||||
|
data-scope="external"
|
||||||
|
data-format="html"
|
||||||
|
data-type=""
|
||||||
|
target="_blank"
|
||||||
|
>CVE-2026-0309</a
|
||||||
|
>
|
||||||
|
</li>
|
||||||
|
</ul>
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
@@ -0,0 +1,127 @@
|
|||||||
|
<table class="table colsep rowsep table-striped">
|
||||||
|
<!--cq:include script="../../common/tablestack.jsp" /-->
|
||||||
|
|
||||||
|
<colgroup>
|
||||||
|
<col style="width: 25%" />
|
||||||
|
<col style="width: 75%" />
|
||||||
|
</colgroup>
|
||||||
|
<thead class="thead">
|
||||||
|
<tr class="row">
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Issue ID</div>
|
||||||
|
</th>
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Description</div>
|
||||||
|
</th>
|
||||||
|
</tr>
|
||||||
|
</thead>
|
||||||
|
|
||||||
|
<tbody class="tbody">
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">—</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixes were made to address the following CVEs:
|
||||||
|
<ul id="pan_os_11_1_6_h38_addressed_issues_ul-nwg_dxl_vjc" class="ul">
|
||||||
|
<li class="li">
|
||||||
|
<a
|
||||||
|
class="xref"
|
||||||
|
href="https://security.paloaltonetworks.com/CVE-2026-0310"
|
||||||
|
title=""
|
||||||
|
data-scope="external"
|
||||||
|
data-format="html"
|
||||||
|
data-type=""
|
||||||
|
target="_blank"
|
||||||
|
>CVE-2026-0310</a
|
||||||
|
>
|
||||||
|
</li>
|
||||||
|
<li class="li">
|
||||||
|
<a
|
||||||
|
class="xref"
|
||||||
|
href="https://security.paloaltonetworks.com/CVE-2026-0309"
|
||||||
|
title=""
|
||||||
|
data-scope="external"
|
||||||
|
data-format="html"
|
||||||
|
data-type=""
|
||||||
|
target="_blank"
|
||||||
|
>CVE-2026-0309</a
|
||||||
|
>
|
||||||
|
</li>
|
||||||
|
</ul>
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-332247</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the proxy generated HTTP 503 errors for multiple
|
||||||
|
URLs, which prevented users from connecting to servers. With this fix,
|
||||||
|
the proxy now functions as expected.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-325151</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where a system log was not generated when the proxy
|
||||||
|
reached its session limit.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-314624</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the
|
||||||
|
<span class="ph systemoutput">useridd</span> process became
|
||||||
|
unresponsive and restarted when attempting to dump the Host
|
||||||
|
Information Profile (HIP) database via CLI while the system was
|
||||||
|
actively processing HIP reports. This was caused by a lock contention.
|
||||||
|
With this fix, the process now operates as expected under these
|
||||||
|
conditions.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-310476</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt">Firewalls in HA configurations only</tt>) Fixed an
|
||||||
|
issue where CPLD did not power cycle the firewall after internal
|
||||||
|
packet path monitoring failures occurred, and both firewalls instead
|
||||||
|
became simultaneously non-functional after a reboot.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">PAN-283774</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the firewall placed UDP sessions into a
|
||||||
|
<a
|
||||||
|
class="term"
|
||||||
|
href="#"
|
||||||
|
title=""
|
||||||
|
data-scope=""
|
||||||
|
data-format="dita"
|
||||||
|
data-type=""
|
||||||
|
target="_self"
|
||||||
|
>Discard</a
|
||||||
|
>
|
||||||
|
state when a DNS Sinkhole/Block action occurred, which prevented
|
||||||
|
subsequent DNS requests from reusing the same session and caused
|
||||||
|
DNS-related outages.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
@@ -0,0 +1,57 @@
|
|||||||
|
<table class="table colsep rowsep table-striped">
|
||||||
|
<!--cq:include script="../../common/tablestack.jsp" /-->
|
||||||
|
|
||||||
|
<colgroup>
|
||||||
|
<col style="width: 25%" />
|
||||||
|
<col style="width: 75%" />
|
||||||
|
</colgroup>
|
||||||
|
<thead class="thead">
|
||||||
|
<tr class="row">
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Issue ID</div>
|
||||||
|
</th>
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Description</div>
|
||||||
|
</th>
|
||||||
|
</tr>
|
||||||
|
</thead>
|
||||||
|
|
||||||
|
<tbody class="tbody">
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">—</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixes were made to address the following CVEs:
|
||||||
|
<ul id="pan_os_11_1_7_h10_addressed_issues_ul-nwg_dxl_vjc" class="ul">
|
||||||
|
<li class="li">
|
||||||
|
<a
|
||||||
|
class="xref"
|
||||||
|
href="https://security.paloaltonetworks.com/CVE-2026-0310"
|
||||||
|
title=""
|
||||||
|
data-scope="external"
|
||||||
|
data-format="html"
|
||||||
|
data-type=""
|
||||||
|
target="_blank"
|
||||||
|
>CVE-2026-0310</a
|
||||||
|
>
|
||||||
|
</li>
|
||||||
|
<li class="li">
|
||||||
|
<a
|
||||||
|
class="xref"
|
||||||
|
href="https://security.paloaltonetworks.com/CVE-2026-0309"
|
||||||
|
title=""
|
||||||
|
data-scope="external"
|
||||||
|
data-format="html"
|
||||||
|
data-type=""
|
||||||
|
target="_blank"
|
||||||
|
>CVE-2026-0309</a
|
||||||
|
>
|
||||||
|
</li>
|
||||||
|
</ul>
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
Reference in new issue
Block a user