Add reference files
This commit is contained in:
@@ -0,0 +1,132 @@
|
|||||||
|
<table class="table colsep rowsep table-striped">
|
||||||
|
<!--cq:include script="../../common/tablestack.jsp" /-->
|
||||||
|
|
||||||
|
<colgroup>
|
||||||
|
<col style="width: 25%" />
|
||||||
|
<col style="width: 75%" />
|
||||||
|
</colgroup>
|
||||||
|
<thead class="thead">
|
||||||
|
<tr class="row">
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Issue ID</div>
|
||||||
|
</th>
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Description</div>
|
||||||
|
</th>
|
||||||
|
</tr>
|
||||||
|
</thead>
|
||||||
|
|
||||||
|
<tbody class="tbody">
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">GPC-26311</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where GlobalProtect users were unable to submit Host
|
||||||
|
Information Profile (HIP) reports, which prevented security rules
|
||||||
|
requiring a HIP match from applying. This occurred when you connected
|
||||||
|
to an NGPA gateway using a dual-stack network, such as a mobile
|
||||||
|
hotspot. With this fix, GlobalProtect successfully submits HIP reports
|
||||||
|
regardless of your network configuration.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">GPC-25946</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where your GlobalProtect client did not send Host
|
||||||
|
Information Profile (HIP) check and report messages after you
|
||||||
|
established a connection to the gateway. This occurred even when a HIP
|
||||||
|
report was generated shortly before the connection, which could have
|
||||||
|
impacted security posture assessment. With this fix, your
|
||||||
|
GlobalProtect client now correctly sends HIP check and report messages
|
||||||
|
after establishing a connection.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">GPC-25776</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where GlobalProtect clients displayed an incorrect
|
||||||
|
"Connecting" status after a GlobalProtect Portal or Gateway
|
||||||
|
authentication failure, specifically when "Portal auth failed but
|
||||||
|
SAML/CAS auth is successful". This misleading status persisted even
|
||||||
|
though the connection had actually failed, preventing users from
|
||||||
|
understanding the true connection state.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">GPC-25541</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where MacOS GlobalProtect client version 6.2.8-416 was
|
||||||
|
unable to connect to the GlobalProtect gateway, getting stuck in a
|
||||||
|
connecting state.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">GPC-25490</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(MacBook devices) Fixed an issue where your GlobalProtect enabled
|
||||||
|
device lost internet access after returning from hibernation. This
|
||||||
|
occurred when your computer completely lost network connectivity,
|
||||||
|
requiring a restart to restore internet access. With this fix, your
|
||||||
|
device maintains network connectivity after resuming from hibernation.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">GPC-25394</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where your traffic continued to pass through the
|
||||||
|
GlobalProtect tunnel interface after you disconnected GobalProtect,
|
||||||
|
preventing it from reverting to your local interface. With this fix,
|
||||||
|
your traffic properly reverts to the local interface after
|
||||||
|
GlobalProtect disconnects.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">GPC-25320</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where GlobalProtect intermittently appeared in the
|
||||||
|
foreground of your user session. This occurred even when you
|
||||||
|
configured GlobalProtect for on-demand connections and were not
|
||||||
|
actively trying to connect, causing it to overshadow other
|
||||||
|
applications. With this fix, GlobalProtect remains in the background
|
||||||
|
until you actively initiate a connection.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry"><div class="p">GPC-25280</div></td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where GlobalProtect clients on macOS devices would
|
||||||
|
intermittently get stuck in a "Connecting" state for several minutes
|
||||||
|
after waking from modern standby. This occurred due to a race
|
||||||
|
condition between DNS proxy reconfiguration and the VPN connection
|
||||||
|
process during wake from sleep, where the macOS DNS proxy would
|
||||||
|
temporarily stop and restart, causing the PanGPS service to time out
|
||||||
|
when attempting to send DNS configuration commands. This led to
|
||||||
|
repeated connection failures until the DNS proxy fully stabilized, a
|
||||||
|
condition that was exacerbated by the presence of multiple network
|
||||||
|
extensions on the macOS device.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
@@ -0,0 +1,52 @@
|
|||||||
|
<table class="table colsep rowsep table-striped">
|
||||||
|
<!--cq:include script="../../common/tablestack.jsp" /-->
|
||||||
|
|
||||||
|
<colgroup>
|
||||||
|
<col style="width: 25%" />
|
||||||
|
<col style="width: 75%" />
|
||||||
|
</colgroup>
|
||||||
|
<thead class="thead">
|
||||||
|
<tr class="row">
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Issue ID</div>
|
||||||
|
</th>
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Description</div>
|
||||||
|
</th>
|
||||||
|
</tr>
|
||||||
|
</thead>
|
||||||
|
|
||||||
|
<tbody class="tbody">
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">—</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixes were made to address
|
||||||
|
<a
|
||||||
|
class="xref"
|
||||||
|
href="https://security-stg.paloaltonetworks.com/CVE-2026-0273"
|
||||||
|
title=""
|
||||||
|
data-scope="external"
|
||||||
|
data-format="html"
|
||||||
|
data-type=""
|
||||||
|
target="_blank"
|
||||||
|
>CVE-2026-0273</a
|
||||||
|
>
|
||||||
|
and
|
||||||
|
<a
|
||||||
|
class="xref"
|
||||||
|
href="https://security-stg.paloaltonetworks.com/CVE-2026-0272"
|
||||||
|
title=""
|
||||||
|
data-scope="external"
|
||||||
|
data-format="html"
|
||||||
|
data-type=""
|
||||||
|
target="_blank"
|
||||||
|
>CVE-2026-0272</a
|
||||||
|
>.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
@@ -0,0 +1,399 @@
|
|||||||
|
<table class="table colsep rowsep table-striped">
|
||||||
|
<!--cq:include script="../../common/tablestack.jsp" /-->
|
||||||
|
|
||||||
|
<colgroup>
|
||||||
|
<col style="width: 50%" />
|
||||||
|
<col style="width: 50%" />
|
||||||
|
</colgroup>
|
||||||
|
<thead class="thead">
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<th class="entry">Issue ID</th>
|
||||||
|
<th class="entry">Description</th>
|
||||||
|
</tr>
|
||||||
|
</thead>
|
||||||
|
|
||||||
|
<tbody class="tbody">
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-321340</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt">Firewalls in FIPS mode only</tt>) Fixed an issue
|
||||||
|
where GlobalProtect unexpectedly prompted for RADIUS authentication
|
||||||
|
instead of client certificate authentication due to an OSCP validation
|
||||||
|
error and subsequent CRL verification failure, which led to
|
||||||
|
certificates being marked as invalid.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-319288</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where a DPC in Slot 4 restarted repeatedly, which
|
||||||
|
caused internal path monitoring failures and a failover event.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-318580</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where processes restarted and the firewall unexpectedly
|
||||||
|
rebooted when you configured a Security policy rule with
|
||||||
|
<span class="ph uicontrol">Source Device > quarantine</span>.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-317755</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue on Panorama where selective push operations failed when
|
||||||
|
plugin configurations included access-domain or log-collector
|
||||||
|
references.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-317466</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where SIP sessions stopped progressing after the
|
||||||
|
firewall received fragmented packets, fragmented at header field.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-316556</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where a race condition between the session ager and
|
||||||
|
packet processing resulted in memory corruption and caused the
|
||||||
|
pan_task process to stop responding, which resulted in the firewall
|
||||||
|
becoming unresponsive
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-315337</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where GlobalProtect throughput was reduced after an
|
||||||
|
upgrade.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-315314</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where, when a push operation from Panorama to the
|
||||||
|
firewall failed, accounting logs stopped forwarding.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-315160</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt">PA-7500 firewalls only</tt>) Fixed an issue where
|
||||||
|
internal path monitoring logs incorrectly reported internal path
|
||||||
|
monitoring failures when they did not occur.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-314623</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt"
|
||||||
|
>Firewalls in active/passive HA configurations only</tt
|
||||||
|
>) Fixed an issue where, after a failover, routing information within
|
||||||
|
OSPF protocol was not correctly translated or propagated, which
|
||||||
|
affected network path convergence and FRR capabilities.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-313827</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where a memory leak occurred related to the
|
||||||
|
<span class="ph systemoutput">reportd</span> process when custom
|
||||||
|
reports were run via API.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-313606</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where Panorama pushed commits took longer than expected
|
||||||
|
to complete without displaying an error message when committing due to
|
||||||
|
slow cloud-app compilation.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-311658</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the
|
||||||
|
<a
|
||||||
|
class="term"
|
||||||
|
href="#"
|
||||||
|
title=""
|
||||||
|
data-scope=""
|
||||||
|
data-format="dita"
|
||||||
|
data-type=""
|
||||||
|
target="_self"
|
||||||
|
>reportd</a
|
||||||
|
>
|
||||||
|
process stopped responding, which caused the firewall to reboot.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-311248</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the ABR failed to translate and advertise the
|
||||||
|
default route (0.0.0.0/0) from an OSPF NSSA area into the OSPF
|
||||||
|
backbone area as a Type-5 LSA.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-310240</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where software packet buffers were completely utilized
|
||||||
|
when performing a Data Loss Prevention longevity test.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-309853</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt">Firewalls with FIPS-CC enabled only</tt>) Fixed an
|
||||||
|
issue where, when attempting to make changes to the GlobalProtect
|
||||||
|
portal, an error message was displayed and configuration updates
|
||||||
|
failed.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-308775</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt">Firewalls in active/passive configurations only</tt
|
||||||
|
>) Fixed an issue where NTP status intermittently showed as rejected
|
||||||
|
on the active firewall, which prevented the firewalls from
|
||||||
|
synchronizing time.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-308668</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue on Prisma Access Remote Network firewalls where high
|
||||||
|
CPU utilization caused slowness and command timeouts.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-297819</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the firewall was unable to send device telemetry
|
||||||
|
files to Cortex Data Lake due to the firewall receiving an invalid
|
||||||
|
upload token.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-293142</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where firewall components became unresponsive during
|
||||||
|
sustained operation.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-291660</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the firewall incorrectly reported the speed of
|
||||||
|
25G interfaces as 1G when queried using SNMP for the ifHighSpeed OID.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-289460</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the timestamp value in SNMPv3 trap headers was
|
||||||
|
incorrect.
|
||||||
|
</div>
|
||||||
|
<div class="p">
|
||||||
|
To use this fix, run the CLI command
|
||||||
|
<span class="ph systemoutput"
|
||||||
|
>debug log-receiver enginetime-from-snmptime yes</span
|
||||||
|
>.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-282335</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where firewalls in a cluster experienced approximately
|
||||||
|
50% packet loss on IPSec NATT tunnels when tunnel acceleration was
|
||||||
|
enabled.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-280536</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where firewalls that were connected to the same Cloud
|
||||||
|
Identity Engine displayed inconsistent group membership information,
|
||||||
|
with some firewalls showing only a subset of users belonging to a
|
||||||
|
group. This occurred due to a full or incremental group sync failure.
|
||||||
|
</div>
|
||||||
|
<div class="p">
|
||||||
|
This fix introduces a retry mechanism for failed group queries to the
|
||||||
|
Cloud Identity Engine. To use this feature, run the following CLI
|
||||||
|
commands.
|
||||||
|
</div>
|
||||||
|
<div class="p">
|
||||||
|
To enable the retry mechanism:
|
||||||
|
<span class="ph systemoutput">debug user-id dscd retry-enable on</span
|
||||||
|
>.
|
||||||
|
</div>
|
||||||
|
<div class="p">
|
||||||
|
To set the retry time:
|
||||||
|
<span class="ph systemoutput"
|
||||||
|
>debug user-id dscd retry-time set-time <1-10></span
|
||||||
|
>. The default value is 5 seconds.
|
||||||
|
</div>
|
||||||
|
<div class="p">
|
||||||
|
To set the number of retry attempts:
|
||||||
|
<span class="ph systemoutput"
|
||||||
|
>debug user-id dscd retry attempts set-attempts <3-10></span
|
||||||
|
>. The default value is 5 attempts.
|
||||||
|
</div>
|
||||||
|
<div class="p">
|
||||||
|
To disable the retry mechanism:
|
||||||
|
<span class="ph systemoutput"
|
||||||
|
>debug user-id dscd retry-enable off</span
|
||||||
|
>.
|
||||||
|
</div>
|
||||||
|
<div class="p">
|
||||||
|
Additionally, a system log is now generated when a group sync fails,
|
||||||
|
and you are able to monitor the group sync status with the following
|
||||||
|
CLI commands:
|
||||||
|
</div>
|
||||||
|
<ul id="pan_os_11_1_10_h28_addressed_issues_ul-kk4_jh5_pjc" class="ul">
|
||||||
|
<li class="li">
|
||||||
|
<span class="ph systemoutput"
|
||||||
|
>show user group count list cloud-identity-engine</span
|
||||||
|
>
|
||||||
|
</li>
|
||||||
|
<li class="li">
|
||||||
|
<span class="ph systemoutput"
|
||||||
|
>show user group count name <group_name></span
|
||||||
|
>
|
||||||
|
</li>
|
||||||
|
</ul>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-213491</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the management CPU was high, which caused the web
|
||||||
|
interface to be slower than expected.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
@@ -0,0 +1,52 @@
|
|||||||
|
<table class="table colsep rowsep table-striped">
|
||||||
|
<!--cq:include script="../../common/tablestack.jsp" /-->
|
||||||
|
|
||||||
|
<colgroup>
|
||||||
|
<col style="width: 25%" />
|
||||||
|
<col style="width: 75%" />
|
||||||
|
</colgroup>
|
||||||
|
<thead class="thead">
|
||||||
|
<tr class="row">
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Issue ID</div>
|
||||||
|
</th>
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Description</div>
|
||||||
|
</th>
|
||||||
|
</tr>
|
||||||
|
</thead>
|
||||||
|
|
||||||
|
<tbody class="tbody">
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">—</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixes were made to address
|
||||||
|
<a
|
||||||
|
class="xref"
|
||||||
|
href="https://security-stg.paloaltonetworks.com/CVE-2026-0273"
|
||||||
|
title=""
|
||||||
|
data-scope="external"
|
||||||
|
data-format="html"
|
||||||
|
data-type=""
|
||||||
|
target="_blank"
|
||||||
|
>CVE-2026-0273</a
|
||||||
|
>
|
||||||
|
and
|
||||||
|
<a
|
||||||
|
class="xref"
|
||||||
|
href="https://security-stg.paloaltonetworks.com/CVE-2026-0272"
|
||||||
|
title=""
|
||||||
|
data-scope="external"
|
||||||
|
data-format="html"
|
||||||
|
data-type=""
|
||||||
|
target="_blank"
|
||||||
|
>CVE-2026-0272</a
|
||||||
|
>.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
@@ -0,0 +1,442 @@
|
|||||||
|
<table class="table colsep rowsep table-striped">
|
||||||
|
<!--cq:include script="../../common/tablestack.jsp" /-->
|
||||||
|
|
||||||
|
<colgroup>
|
||||||
|
<col style="width: 50%" />
|
||||||
|
<col style="width: 50%" />
|
||||||
|
</colgroup>
|
||||||
|
<thead class="thead" data-sticky-top="61.2" style="top: 61.2px">
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<th class="entry">Issue ID</th>
|
||||||
|
<th class="entry">Description</th>
|
||||||
|
</tr>
|
||||||
|
</thead>
|
||||||
|
|
||||||
|
<tbody class="tbody">
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-321340</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt">Firewalls in FIPS mode only</tt>) Fixed an issue
|
||||||
|
where GlobalProtect unexpectedly prompted for RADIUS authentication
|
||||||
|
instead of client certificate authentication due to an OSCP validation
|
||||||
|
error and subsequent CRL verification failure, which led to
|
||||||
|
certificates being marked as invalid.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-320598</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where internal and external DNS names did not resolve
|
||||||
|
when connected to a GlobalProtect gateway.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-319288</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where a DPC in Slot 4 restarted repeatedly, which
|
||||||
|
caused internal path monitoring failures and a failover event.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-318580</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where processes restarted and the firewall unexpectedly
|
||||||
|
rebooted when you configured a Security policy rule with
|
||||||
|
<span class="ph uicontrol">Source Device > quarantine</span>.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-317755</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue on Panorama where selective push operations failed when
|
||||||
|
plugin configurations included access-domain or log-collector
|
||||||
|
references.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-316556</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where a race condition between the session ager and
|
||||||
|
packet processing resulted in memory corruption and caused the
|
||||||
|
pan_task process to stop responding, which resulted in the firewall
|
||||||
|
becoming unresponsive
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-316120</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where, after Advanced Routing was enabled, the firewall
|
||||||
|
advertised routes to internal BGP neighbors with the original external
|
||||||
|
BGP next-hop address.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-315337</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where GlobalProtect throughput was reduced after an
|
||||||
|
upgrade.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-315314</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where, when a push operation from Panorama to the
|
||||||
|
firewall failed, accounting logs stopped forwarding.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-315160</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt">PA-7500 firewalls only</tt>) Fixed an issue where
|
||||||
|
internal path monitoring logs incorrectly reported internal path
|
||||||
|
monitoring failures when they did not occur.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-314752</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue on Panorama where, after removing a scheduled
|
||||||
|
configuration push, Panorama still initiated the push at its
|
||||||
|
previously scheduled time.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-314623</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt"
|
||||||
|
>Firewalls in active/passive HA configurations only</tt
|
||||||
|
>) Fixed an issue where, after a failover, routing information within
|
||||||
|
OSPF protocol was not correctly translated or propagated, which
|
||||||
|
affected network path convergence and FRR capabilities.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-314385</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt">Firewalls in active/passive HA clusters only</tt>)
|
||||||
|
Fixed an issue where high dataplane CPU usage occurred and traffic
|
||||||
|
offloading decreased when a failover occurred from the active firewall
|
||||||
|
to the passive firewall, and then back to the active firewall.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-313827</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where a memory leak occurred related to the
|
||||||
|
<span class="ph systemoutput">reportd</span> process when custom
|
||||||
|
reports were run via API.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-313700</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where an unexpected reboot occurred when Inline Cloud
|
||||||
|
Analysis was enabled in an Anti-Spyware and Vulnerability profile.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-313606</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where Panorama pushed commits took longer than expected
|
||||||
|
to complete without displaying an error message when committing due to
|
||||||
|
slow cloud-app compilation.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-313443</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where firewalls acting as an accumulation proxy sent a
|
||||||
|
server hello with an earlier TCP timestamp value than a preceding ACK
|
||||||
|
packet, which prevented successful session establishment. This
|
||||||
|
occurred when the client hello messages were split across multiple
|
||||||
|
network segments.
|
||||||
|
</div>
|
||||||
|
<div class="p">
|
||||||
|
To use this fix, run the CLI command
|
||||||
|
<span class="ph systemoutput"
|
||||||
|
>debug dataplane set ssl-decrypt accumulate-client-hello ts-relay
|
||||||
|
yes</span
|
||||||
|
>.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-313036</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the firewall dataplane continuously accumulated
|
||||||
|
packets in the <span class="ph systemoutput">ctd_pkt_queue</span> and
|
||||||
|
packet buffers, which caused resource exhaustion and prematurely
|
||||||
|
terminated sessions.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-311658</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the
|
||||||
|
<a
|
||||||
|
class="term"
|
||||||
|
href="#"
|
||||||
|
title=""
|
||||||
|
data-scope=""
|
||||||
|
data-format="dita"
|
||||||
|
data-type=""
|
||||||
|
target="_self"
|
||||||
|
>reportd</a
|
||||||
|
>
|
||||||
|
process stopped responding, which caused the firewall to reboot.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-311098</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where firewalls entered a nonfunctional state due to L7
|
||||||
|
running out of resources due to a high volume of traffic.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-309853</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt">Firewalls with FIPS-CC enabled only</tt>) Fixed an
|
||||||
|
issue where, when attempting to make changes to the GlobalProtect
|
||||||
|
portal, an error message was displayed and configuration updates
|
||||||
|
failed.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-308775</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt">Firewalls in active/passive configurations only</tt
|
||||||
|
>) Fixed an issue where NTP status intermittently showed as rejected
|
||||||
|
on the active firewall, which prevented the firewalls from
|
||||||
|
synchronizing time.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-308668</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue on Prisma Access Remote Network firewalls where high
|
||||||
|
CPU utilization caused slowness and command timeouts.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-308444</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where pushing multiple policy rules failed when the
|
||||||
|
policy rules contained a large number of dynamic address object groups
|
||||||
|
or user groups.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-297819</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the firewall was unable to send device telemetry
|
||||||
|
files to Cortex Data Lake due to the firewall receiving an invalid
|
||||||
|
upload token.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-295082</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue on the Panorama web interface where you were unable to
|
||||||
|
delete or change a logical router for tunnel, SD-WAN, VLAN, or
|
||||||
|
loopback interfaces under a template.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-293142</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where firewall components became unresponsive during
|
||||||
|
sustained operation.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-289460</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the timestamp value in SNMPv3 trap headers was
|
||||||
|
incorrect.
|
||||||
|
</div>
|
||||||
|
<div class="p">
|
||||||
|
To use this fix, run the CLI command
|
||||||
|
<span class="ph systemoutput"
|
||||||
|
>debug log-receiver enginetime-from-snmptime yes</span
|
||||||
|
>.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-282335</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where firewalls in a cluster experienced approximately
|
||||||
|
50% packet loss on IPSec NATT tunnels when tunnel acceleration was
|
||||||
|
enabled.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-240066</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed a duplicate MAC address issue where an ethernet interface sent
|
||||||
|
out Gratuitous ARP (GARP) messages for an IP address that was not
|
||||||
|
configured on it.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-213491</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the management CPU was high, which caused the web
|
||||||
|
interface to be slower than expected.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
@@ -0,0 +1,52 @@
|
|||||||
|
<table class="table colsep rowsep table-striped">
|
||||||
|
<!--cq:include script="../../common/tablestack.jsp" /-->
|
||||||
|
|
||||||
|
<colgroup>
|
||||||
|
<col style="width: 25%" />
|
||||||
|
<col style="width: 75%" />
|
||||||
|
</colgroup>
|
||||||
|
<thead class="thead">
|
||||||
|
<tr class="row">
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Issue ID</div>
|
||||||
|
</th>
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Description</div>
|
||||||
|
</th>
|
||||||
|
</tr>
|
||||||
|
</thead>
|
||||||
|
|
||||||
|
<tbody class="tbody">
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">—</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixes were made to address
|
||||||
|
<a
|
||||||
|
class="xref"
|
||||||
|
href="https://security-stg.paloaltonetworks.com/CVE-2026-0273"
|
||||||
|
title=""
|
||||||
|
data-scope="external"
|
||||||
|
data-format="html"
|
||||||
|
data-type=""
|
||||||
|
target="_blank"
|
||||||
|
>CVE-2026-0273</a
|
||||||
|
>
|
||||||
|
and
|
||||||
|
<a
|
||||||
|
class="xref"
|
||||||
|
href="https://security-stg.paloaltonetworks.com/CVE-2026-0272"
|
||||||
|
title=""
|
||||||
|
data-scope="external"
|
||||||
|
data-format="html"
|
||||||
|
data-type=""
|
||||||
|
target="_blank"
|
||||||
|
>CVE-2026-0272</a
|
||||||
|
>.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
@@ -0,0 +1,132 @@
|
|||||||
|
<table class="table colsep rowsep table-striped">
|
||||||
|
<!--cq:include script="../../common/tablestack.jsp" /-->
|
||||||
|
|
||||||
|
<colgroup>
|
||||||
|
<col style="width: 50%" />
|
||||||
|
<col style="width: 50%" />
|
||||||
|
</colgroup>
|
||||||
|
<thead class="thead">
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<th class="entry">Issue ID</th>
|
||||||
|
<th class="entry">Description</th>
|
||||||
|
</tr>
|
||||||
|
</thead>
|
||||||
|
|
||||||
|
<tbody class="tbody">
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-321340</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt">Firewalls in FIPS mode only</tt>) Fixed an issue
|
||||||
|
where GlobalProtect unexpectedly prompted for RADIUS authentication
|
||||||
|
instead of client certificate authentication due to an OSCP validation
|
||||||
|
error and subsequent CRL verification failure, which led to
|
||||||
|
certificates being marked as invalid.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-319288</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where a DPC in Slot 4 restarted repeatedly, which
|
||||||
|
caused internal path monitoring failures and a failover event.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-318580</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where processes restarted and the firewall unexpectedly
|
||||||
|
rebooted when you configured a Security policy rule with
|
||||||
|
<span class="ph uicontrol">Source Device > quarantine</span>.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-316556</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where a race condition between the session ager and
|
||||||
|
packet processing resulted in memory corruption and caused the
|
||||||
|
pan_task process to stop responding, which resulted in the firewall
|
||||||
|
becoming unresponsive
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-315314</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where, when a push operation from Panorama to the
|
||||||
|
firewall failed, accounting logs stopped forwarding.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-308775</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt">Firewalls in active/passive configurations only</tt
|
||||||
|
>) Fixed an issue where NTP status intermittently showed as rejected
|
||||||
|
on the active firewall, which prevented the firewalls from
|
||||||
|
synchronizing time.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-308668</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue on Prisma Access Remote Network firewalls where high
|
||||||
|
CPU utilization caused slowness and command timeouts.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-291660</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the firewall incorrectly reported the speed of
|
||||||
|
25G interfaces as 1G when queried using SNMP for the ifHighSpeed OID.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-213491</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the management CPU was high, which caused the web
|
||||||
|
interface to be slower than expected.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
@@ -0,0 +1,226 @@
|
|||||||
|
<table class="table colsep rowsep table-striped">
|
||||||
|
<!--cq:include script="../../common/tablestack.jsp" /-->
|
||||||
|
|
||||||
|
<colgroup>
|
||||||
|
<col style="width: 25%" />
|
||||||
|
<col style="width: 75%" />
|
||||||
|
</colgroup>
|
||||||
|
<thead class="thead">
|
||||||
|
<tr class="row">
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Issue ID</div>
|
||||||
|
</th>
|
||||||
|
<th class="entry">
|
||||||
|
<div class="p">Description</div>
|
||||||
|
</th>
|
||||||
|
</tr>
|
||||||
|
</thead>
|
||||||
|
|
||||||
|
<tbody class="tbody">
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-321150</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the interface remained down after an upgrade.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-320598</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where internal and external DNS names did not resolve
|
||||||
|
when connected to a GlobalProtect gateway.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-319266</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt">Cloud IPS only</tt>) Increased scale limit for zone
|
||||||
|
mappings.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-317755</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue on Panorama where selective push operations failed when
|
||||||
|
plugin configurations included access-domain or log-collector
|
||||||
|
references.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-315337</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where GlobalProtect throughput was reduced after an
|
||||||
|
upgrade.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-315314</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where, when a push operation from Panorama to the
|
||||||
|
firewall failed, accounting logs stopped forwarding.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-314319</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Added a CLI command to enable and disable AHO software offload
|
||||||
|
optimization.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-313828</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the firewall did not forward traffic due to
|
||||||
|
memory issues on a forwarding component.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-313606</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where Panorama pushed commits took longer than expected
|
||||||
|
to complete without displaying an error message when committing due to
|
||||||
|
slow cloud-app compilation.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-310263</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt">VM-Series firewalls only</tt>) Fixed an issue where
|
||||||
|
enabling TLS1.3 in a decryption profile prevented access to websites.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-310240</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where software packet buffers were completely utilized
|
||||||
|
when performing a Data Loss Prevention longevity test.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-307976</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
(<tt class="ph tt"
|
||||||
|
>Firewalls in active/active HA configurations only</tt
|
||||||
|
>) Fixed an issue where tunnels failed to come up with the error
|
||||||
|
message
|
||||||
|
<span class="ph systemoutput"
|
||||||
|
>failed to find a socket for transmission</span
|
||||||
|
>.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-307618</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Added a debug CLI command to address where remote networks for Prisma
|
||||||
|
Access tenants randomly dropped monitoring packets from peer devices,
|
||||||
|
which caused tunnels to be marked as down. This occurred when a CPU
|
||||||
|
core suddenly experienced high utilization.
|
||||||
|
</div>
|
||||||
|
<div class="p">
|
||||||
|
To utilize this fix, run
|
||||||
|
<span class="ph systemoutput"
|
||||||
|
>debug dataplane set ssl-decrypt use-new-peek-window yes</span
|
||||||
|
>.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-292306</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where the
|
||||||
|
<a
|
||||||
|
class="term"
|
||||||
|
href="#"
|
||||||
|
title=""
|
||||||
|
data-scope=""
|
||||||
|
data-format="dita"
|
||||||
|
data-type=""
|
||||||
|
target="_self"
|
||||||
|
>authd</a
|
||||||
|
>
|
||||||
|
process stopped handling RADIUS authentication requests and required a
|
||||||
|
restart.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
<tr class="row rowsep">
|
||||||
|
<td class="entry">
|
||||||
|
<div class="p"><b class="ph b">PAN-234302</b></div>
|
||||||
|
</td>
|
||||||
|
<td class="entry relcol">
|
||||||
|
<div class="p">
|
||||||
|
Fixed an issue where commit operations took longer than expected to
|
||||||
|
complete due to EDL timeouts occurring on passive nodes when a service
|
||||||
|
route was enabled.
|
||||||
|
</div>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
Reference in New Issue
Block a user