Revise PAN-OS 12.1 issues

web/data/issues/PAN-OS/addressed/12.1.2.md

@@ -6,12 +6,12 @@ version: 12.1.2
 
 ## PAN-242777
 
-Fixed an issue where users previously reported limitations due to session count caps when utilizing Web Proxy features on PA-5400 Series Firewalls. To address these performance complaints and support higher traffic volumes, we have increased the maximum session capacity on specific PA-5400F series platforms, leveraging available system memory. This update ensures greater capacity and stability for high-volume environments.
+Fixed an issue where users previously reported limitations due to session count caps when utilizing **Web Proxy** features on PA-5400 Series Firewalls. To address these performance complaints and support higher traffic volumes, we have increased the maximum session capacity on specific **PA-5400F** series platforms, leveraging available system memory. This update ensures greater capacity and stability for high-volume environments.
 
 The supported session limits are:
 
 | Platform | Max Sessions |
-| --- | --- |
+| -------- | ------------ |
 | PA-5410  | 95K          |
 | PA-5420  | 95K          |
 | PA-5430  | 95K          |

web/data/issues/PAN-OS/addressed/12.1.3-h3.md

@@ -4,9 +4,9 @@ product: PAN-OS
 version: 12.1.3-h3
 ---
 
-## PAN-000000
+## BLANK-000000
 
-A fix was made to address CVE-2026-0227.
+A fix was made to address [CVE-2026-0227](https://security.paloaltonetworks.com/CVE-2026-0227).
 
 ## PAN-306534
 

web/data/issues/PAN-OS/addressed/12.1.3.md

@@ -4,6 +4,12 @@ product: PAN-OS
 version: 12.1.3
 ---
 
+## PAN-300334
+
+Fixed an issue where the ADEM plugin was not compatible with PAN-OS 12.1.2, which prevented installation of the plugin and disabled the ability to monitor remote sites on firewalls using the ADEM functionality.
+
+To use this fix, you need the following compatible versions: ADEM 1.1.0-h3 and SD-WAN plugin 3.4.0.
+
 ## PAN-298241
 
 Fixed an issue where the NAT IP address pool was exhausted, which led to intermittent connectivity issues with call applications and outbound call failures. This occurred due to the firewall not properly releasing NAT dynamic ports back to the address pool.

web/data/issues/PAN-OS/addressed/12.1.4-h3.md

@@ -18,4 +18,4 @@ Fixed an issue on the Panorama and firewall web interface where Applications pag
 
 ## PAN-292447
 
-Fixed an issue where Panorama did not display data in the Feature Adoption tab in Strata Cloud Manager due to the system creating and deleting a CLI user for each interval instead of reusing a permanent CLI user for telemetry.
+Fixed an issue where Panorama did not display data in the **Feature Adoption** tab in Strata Cloud Manager due to the system creating and deleting a CLI user for each interval instead of reusing a permanent CLI user for telemetry.

web/data/issues/PAN-OS/addressed/12.1.4.md

@@ -4,9 +4,9 @@ product: PAN-OS
 version: 12.1.4
 ---
 
-## PAN-000000
+## BLANK-000000
 
-A fix was made to address CVE-2026-0227.
+A fix was made to address [CVE-2026-0227](https://security.paloaltonetworks.com/CVE-2026-0227).
 
 ## PAN-305480
 
@@ -78,7 +78,7 @@ Fixed an issue on the firewall where, after upgrading, autocommits repeatedly fa
 
 ## PAN-298684
 
-Fixed an issue where an Application Override policy rule was not applied using an IPv4 source IP address with IPv6 enabled and Network > Zones > Pre-NAT Identification enabled.
+Fixed an issue where an Application Override policy rule was not applied using an IPv4 source IP address with IPv6 enabled and **Network** > **Zones** > **Pre-NAT Identification** enabled.
 
 ## PAN-298654
 
@@ -150,7 +150,7 @@ Fixed an issue with firewalls enabled with Security profiles where certain traff
 VM-Series firewalls on Microsoft Azure environments in HA configurations only
 ```
 
-Fixed an issue where, when an interface was configured with IPv6, the firewall displayed the message Unknown error during validation after the client secret expired, which caused DNS resolution to fail when resolving FQDNs and HA failovers to occur.
+Fixed an issue where, when an interface was configured with IPv6, the firewall displayed the message **Unknown error** during validation after the client secret expired, which caused DNS resolution to fail when resolving FQDNs and HA failovers to occur.
 
 ## PAN-290453
 

web/data/issues/PAN-OS/addressed/12.1.5.md

@@ -14,12 +14,20 @@ Fixed an issue where establishing log forwarding connections to the Strata Loggi
 VM-Series firewalls only
 ```
 
-) Fixed an issue where the dataplane restarted due to a segmentation fault.
+Fixed an issue where the dataplane restarted due to a segmentation fault.
+
+## PAN-313258
+
+Fixed an issue where PIM multicast routing failed on appliances with advanced routing enabled.
 
 ## PAN-312706
 
 Fixed an issue where the firewalls restarted due to a function lacking a NULL-pointer sanity check.
 
+## PAN-312618
+
+Fixed an issue where the firewall was unable to activate GlobalProtect client software and displayed SW LIMIT messages related to max-profiles and unsupported major and minor versions in the downgrade list, which prevented successful software installation.
+
 ## PAN-311938
 
 Fixed an issue where autocommits failed after an upgrade due to configuration memory allocation issues and 100% policy rule cache usage when both DNS Rewrite and URL Custom Category Match were configured.
@@ -30,7 +38,7 @@ Fixed an issue where config-lock was not displayed on the web interface.
 
 ## PAN-311087
 
-Fixed an issue where, when the request shutdown system CLI command was executed, the firewall experienced a kernel panic and automatically rebooted instead of shutting down.
+Fixed an issue where, when the request shutdown system CLI command was executed, the firewall experienced a kernel panic and automatically rebooted instead of shutting down
 
 ## PAN-311073
 
@@ -42,19 +50,31 @@ Fixed an issue where firewalls incorrectly updated the modified date and MD5 has
 
 ## PAN-310499
 
-Fixed an issue on Panorama where, while configuring an an Application Filter with Generative AI tags, the web interface did not retain application exclusions that were added across multiple pages until you clicked OK.
+Fixed an issue on Panorama where, while configuring an an Application Filter with Generative AI tags, the web interface did not retain application exclusions that were added across multiple pages until you clicked **OK**.
 
 ## PAN-310402
 
 Fixed an issue where SNMP returned an incorrect down status for HSCI and logging interfaces even when the interfaces were up, and counters for the interfaces displayed only zero values.
 
+## PAN-309853
+
+```caveat
+Firewalls with FIPS-CC enabled only
+```
+
+Fixed an issue where, when attempting to make changes to the GlobalProtect portal, an error message was displayed and configuration updates failed.
+
+## PAN-309831
+
+Fixed an issue where an AI Runtime Security Firewall rebooted when processing Cursor traffic.
+
 ## PAN-309826
 
 ```caveat
 VM-Series firewalls only
 ```
 
-Fixed an issue where files from SSL decrypted sessions were incorrectly forwarded to the WildFire cloud for analysis even when Allow Forwarding of Decryption Content was disabled.
+Fixed an issue where files from SSL decrypted sessions were incorrectly forwarded to the WildFire cloud for analysis even when **Allow Forwarding of Decryption Content** was disabled.
 
 ## PAN-309459
 
@@ -62,15 +82,19 @@ Fixed an issue where on PA-5420 firewalls, configuring security rules with a num
 
 ## PAN-309392
 
-Fixed an issue where the scroll bar did not appear when editing Destination Addresses for Policy Based forwarding policy rules.
+Fixed an issue where the scroll bar did not appear when editing **Destination Addresses** for Policy Based forwarding policy rules.
 
 ## PAN-309379
 
 Fixed an issue where the logrcvr process stopped responding on DPCs, which prevented logs from being forwarded.
 
+## PAN-309300
+
+Fixed an issue where management plane system resources configuration size exceeded 28 MB for over 4 hours, and the following error message was displayed: Configuration size reaching device capacity limit.
+
 ## PAN-309258
 
-Fixed an issue where you were unable to delete a HIP object with OR in the name, even though you were able to successfully create and commit the object.
+Fixed an issue where you were unable to delete a HIP object with **OR** in the name, even though you were able to successfully create and commit the object.
 
 ## PAN-309009
 
@@ -98,7 +122,7 @@ Fixed an issue where traffic was blocked due to a mismatch between the URL categ
 
 ## PAN-308305
 
-Fixed an issue where, when you selected a signature policy rule in the Anti-Spyware profile and clicked Find Matching Signatures, the automatically created filter was incorrect and prevented matching signatures from being displayed.
+Fixed an issue where, when you selected a signature policy rule in the Anti-Spyware profile and clicked **Find Matching Signatures**, the automatically created filter was incorrect and prevented matching signatures from being displayed.
 
 ## PAN-308188
 
@@ -124,6 +148,10 @@ Fixed an issue where the BFD session went down and did not recover even though t
 
 Fixed an issue where a leak in decryption counters caused resource exhaustion, which led to a GlobalProtect service outage.
 
+## PAN-307893
+
+Fixed an issue where the Strata Cloud Manager (SCM) web interface failed to fetch External Dynamic List (EDL) details from Prisma Access and displayed the error message Could not fetch the EDL main info. This occurred because the XML query returned an external list authentication failed response when the EDL entry lacked a valid certificate.
+
 ## PAN-307806
 
 Fixed an issue where, after replacing the MPC (Management Processor Card) on a firewall, the logdb process incorrectly wrote logs to the root partition instead of the /opt/panlogs partition, which led to high root partition usage and a non-functional state.
@@ -174,19 +202,23 @@ Fixed an issue where static DNS entries that were configured on the firewall fai
 
 ## PAN-306934
 
-Fixed an issue where traffic was unexpectedly blocked due to a misconfiguration with an empty or invalid application filter. The firewall incorrectly interpreted the empty filter as match all cloud-apps, which caused the traffic to be denied.
+Fixed an issue where traffic was unexpectedly blocked due to a misconfiguration with an empty or invalid application filter. The firewall incorrectly interpreted the empty filter as **match all cloud-apps**, which caused the traffic to be denied.
 
 ## PAN-306903
 
-Fixed an issue on the firewall where, after upgrading, the system log displayed the error message Last config fetch FAILED. A commit is required for userid functionality to work.
+Fixed an issue on the firewall where, after upgrading, the system log displayed the error message **Last config fetch FAILED. A commit is required for userid functionality to work.**
 
 ## PAN-306886
 
 Fixed an issue where the root partition on the firewall or Panorama management server filled up due to a file leak in the logging process.
 
-## PAN-306555
+## PAN-306884
 
-Fixed an issue where the firewall stopped responding, which led to service outages.
+Fixed an issue where after changing Panorama to logger mode, commits failed due to the **panorama-admin** role assigned to plugin management configuration users.
+
+## PAN-306533
+
+Fixed an issue where system logging for NTP events was delayed by approximately 15 minutes.
 
 ## PAN-306451
 
@@ -220,6 +252,10 @@ Fixed an issue where the firewall dataplane frequently restarted when lockless Q
 
 Fixed an issue on Panorama where the CLI output for the running configuration intermittently inserted set template stack commands within certificate hash data.
 
+## PAN-305919
+
+Fixed an issue where exporting an ML-DSA certificate with PKCS12 resulted in an error file with the message failed to process command.
+
 ## PAN-305874
 
 Fixed an issue on the firewall where the output of the CLI commands show running persistent-dipp-client pool and show running persistent-dipp-pool ip-utilization displayed incorrect information or errors. This occurred due to the command output including data from the network control dataplane.
@@ -292,21 +328,29 @@ Panorama appliances and Panorama virtual appliances only
 
 Fixed an issue where the configd process restarted when committing and pushing configuration for a new WildFire cluster.
 
+## PAN-304718
+
+Fixed an issue where OSPF and BGP outages occurred due to an all_task process restart during clientless VPN content rewrite processing.
+
 ## PAN-304696
 
 Fixed an issue where the Cloud User-ID connection timed out because the firewall took too long to process the OCSP response.
 
+## PAN-304689
+
+Fixed an issue on Panorama where device group users were able to view and commit configuration changes that had been created by Superusers but not yet committed, even with access domains configured.
+
 ## PAN-304636
 
 Fixed an issue where BGP aggregate routes were not created and discard routes were not installed in the routing table.
 
 ## PAN-304576
 
-Fixed an issue where the firewall entered a non-functional state due to segmentation fault within the all_pktproc process that was caused by a session that involved http2 cleartext traffic
+Fixed an issue where the firewall entered a non-functional state due to segmentation fault within the all_pktproc process that was caused by a session that involved http2 cleartext traffic.
 
 ## PAN-304538
 
-Fixed an issue where traffic logs did not populate the Source EDL or Destination EDL fields when traffic matched a Security policy rule that used predefined external dynamic lists.
+Fixed an issue where traffic logs did not populate the **Source EDL** or **Destination EDL** fields when traffic matched a Security policy rule that used predefined external dynamic lists.
 
 ## PAN-304496
 
@@ -314,11 +358,11 @@ Fixed an issue where, after unregistering an IP tag and registering a different
 
 ## PAN-304397
 
-Fixed an issue on the web interface where you were unable to test the SCP server connection for Scheduled Log Exports, and the error message key is invalid was displayed.
+Fixed an issue on the web interface where you were unable to test the SCP server connection for Scheduled Log Exports, and the error message **key is invalid** was displayed.
 
 ## PAN-304229
 
-Fixed an issue on the Panorama web interface where you were unable to disable Lifesize (Templates > Network > Network Profiles > IPSec Crypto).
+Fixed an issue on the Panorama web interface where you were unable to disable **Lifesize** (**Templates > Network > Network Profiles > IPSec Crypto**).
 
 ## PAN-304205
 
@@ -330,7 +374,7 @@ Fixed an issue where the web interface became unresponsive when you attempted to
 
 ## PAN-304148
 
-Fixed an issue where a large number of GlobalProtect users experienced failed gateway pre-logins with the error Failed to create SAML SSO request during peak login times.
+Fixed an issue where a large number of GlobalProtect users experienced failed gateway pre-logins with the error **Failed to create SAML SSO request** during peak login times.
 
 ## PAN-303959
 
@@ -348,15 +392,23 @@ Fixed an issue where intermittent session-table resets on the AIRS VM triggered
 
 Fixed an issue where Panorama and managed devices incorrectly displayed warning messages that indicated that an Advanced DNS Security license and an Advanced Threat Prevention license were required, even when a traditional DNS Security license was installed.
 
+## PAN-303826
+
+Fixed an issue where scheduled software upgrades from the Software Change Management (SCM) server to the firewall failed with a timeout error during download.
+
 ## PAN-303791
 
 Fixed an issue where configuring a service route on a loopback interface caused intermittent connectivity issues and disrupted traffic due to the firewall being unable to resolve domain names.
 
+## PAN-303765
+
+Fixed an issue on Panorama where selective pushes failed when a scheduled job was deleted from the Panorama configuration.
+
 ## PAN-303745
 
 Fixed an issue where inter-dataplane forwarding did not work for sessions ingressing on Slot 2, which resulted in intermittent ping failures to interfaces on Network Card 2 when traffic was forwarded to Slot 3.
 
-Note: With this fix, after a slot restart, the global counter will still show dot1q errors for a short period.
+**Note**: With this fix, after a slot restart, the global counter will still show dot1q errors for a short period.
 
 ## PAN-303737
 
@@ -370,6 +422,10 @@ Fixed an issue on the firewall where configuring spyware and vulnerability profi
 
 Fixed an issue where GlobalProtect users were incorrectly dropped by the default Security policy rule after upgrading to PAN-OS 12.1.2 when IPv6 firewalling was disabled. This occurred due to policy rules configured with geographic regions matching traffic incorrectly.
 
+## PAN-303671
+
+Fixed an issue where third-party clients were unable to connect to the GlobalProtect gateway after a successful login when the username was entered in the domain\username format.
+
 ## PAN-303663
 
 Fixed an issue on the firewall where SolarWinds monitoring systems reported 100% usage for Slot1 Data Processor-0 Hardware Packet Buffers due to an inaccurate reported packet buffer.
@@ -382,6 +438,10 @@ Fixed an issue where PA-455 firewalls running PAN-OS 11.2.4-h7 intermittently fa
 
 Fixed an issue where, after committing a configuration change, the firewall experienced traffic issues, pan_task crashes, and LACP interface failures.
 
+## PAN-303508
+
+Fixed an issue where the firewall failed to fetch the device certificate during initial installation.
+
 ## PAN-303487
 
 Fixed an issue where Panorama appliances in FIPS-CC mode did not push the configured values for max-session-count and max-session-time to managed firewalls that were not in FIPS mode.
@@ -400,7 +460,7 @@ Fixed an issue where the session timer for a custom application did not transiti
 
 ## PAN-303064
 
-Fixed an issue where, when a new tunnel interface was added to PIM (Network > Logical Router > multicast > pim > interfaces), commits were successful, but the new tunnel interface was not successfully added under PIM.
+Fixed an issue where, when a new tunnel interface was added to PIM (**Network > Logical Router > multicast > pim > interfaces**), commits were successful, but the new tunnel interface was not successfully added under PIM.
 
 ## PAN-303051
 
@@ -440,7 +500,7 @@ Fixed an issue where API key generation failed after renewing an expired API cer
 
 ## PAN-302567
 
-Fixed an issue where firewalls incorrectly returned the message API Error: Success with the error code 403 instead of the correct message API Error: Invalid Credential, when Cisco-ISE server is being used for MSCHAP-PEAP Radius auth.
+Fixed an issue where firewalls incorrectly returned the message **API Error: Success** with the error code 403 instead of the correct message **API Error: Invalid Credential**, when Cisco-ISE server was used for MSCHAP-PEAP Radius auth.
 
 ## PAN-302564
 
@@ -452,15 +512,15 @@ Fixed an issue where the firewall displayed as disconnected in the SLS due to th
 
 ## PAN-302471
 
-Fixed an issue where the firewall rebooted unexpectedly due to a missed null pointer check when certification verification was enabled in a no-decrypt case. This occurred when either block sessions with untrusted issuers or block sessions with expired certificates was enabled in the decryption profile.
+Fixed an issue where the firewall rebooted unexpectedly due to a missed null pointer check when certification verification was enabled in a no-decrypt case. This occurred when either **block sessions with untrusted issuers** or **block sessions with expired certificates** was enabled in the decryption profile.
 
 ## PAN-302428
 
-Fixed an issue on Panorama where daily scheduled report emails for custom reports were delivered with no content and instead incorrectly displayed the message No matching data found. With this fix, the content is displayed correctly.
+Fixed an issue on Panorama where daily scheduled report emails for custom reports were delivered with no content and instead incorrectly displayed the message **No matching data found**. With this fix, the content is displayed correctly.
 
 ## PAN-302387
 
-Fixed an issue where on PA-7500 firewalls, SNMP incorrectly reported the administrative and operational status of High Speed Chassis Interconnect (HSCI) interfaces and the operational status of logging interfaces as down, even when the interfaces were physically up. Additionally, interface counters for these interfaces displayed all zeroes.
+Fixed an issue where on PA-7500 firewalls, SNMP incorrectly reported the administrative and operational status of High Speed Chassis Interconnect (HSCI) interfaces as down, even when the interfaces were physically up. Additionally, interface counters for these interfaces displayed all zeroes.
 
 ## PAN-302254
 
@@ -480,11 +540,11 @@ Fixed an issue where adding a 26th floating IP address to an aggregate ethernet
 
 ## PAN-302085
 
-Fixed an issue where network values were not displayed in Panorama with the error message There is no value for the selected item. This was due to the device group passing vsysName in Panorama.
+Fixed an issue where network values were not displayed in Panorama with the error message **There is no value for the selected item**. This was due to the device group passing vsysName in Panorama.
 
 ## PAN-302073
 
-Fixed an issue on Panorama where the override icon in Agent Config did not change to the revert icon after reverting a configuration change in a template-stack.
+Fixed an issue on Panorama where the override icon in **Agent Config** did not change to the revert icon after reverting a configuration change in a template-stack.
 
 ## PAN-301975
 
@@ -504,7 +564,7 @@ Fixed an issue where Panorama stopped responding when deploying dynamic updates
 
 ## PAN-301848
 
-Fixed an issue where websites were incorrectly categorized with high severity alerts (Monitoring > URL Filtering) even though they were assessed as low risk. This occurred due to session information being unavailable during logging.
+Fixed an issue where websites were incorrectly categorized with high severity alerts (**Monitoring > URL Filtering**) even though they were assessed as low risk. This occurred due to session information being unavailable during logging.
 
 ## PAN-301733
 
@@ -520,7 +580,7 @@ Fixed an issue where DNS traffic sessions prematurely terminated with the messag
 
 ## PAN-301600
 
-Fixed an issue on the firewall where, after upgrading Panorama, OSPF adjacencies remained in the exchange start state, which resulted in an incomplete routing table.
+Fixed an issue on the firewall where, after an upgrade, OSPF adjacencies remained in the exchange state, which resulted in an incomplete routing table.
 
 ## PAN-301496
 
@@ -560,7 +620,7 @@ Fixed an issue where DNS Security logs incorrectly displayed a sinkhole action f
 
 ## PAN-301186
 
-Fixed an issue on the Panorama web interface where Enable pushing device monitoring data to Panorama was always checked, regardless of the actual configuration.
+Fixed an issue on the Panorama web interface where **Enable pushing device monitoring data to Panorama** was always checked, regardless of the actual configuration.
 
 ## PAN-301113
 
@@ -636,7 +696,7 @@ Fixed an issue where using the IKEv2 multiplier setting for VPN re-authenticatio
 
 ## PAN-300423
 
-Fixed an issue where Data Processing Cards (DPCs) installed in slots 5 and 6 remained stuck in a starting state with the error Signal detected for port xeS5-DP0 but Link Down alerts, which resulted in device instability.
+Fixed an issue where Data Processing Cards (DPCs) installed in slots 5 and 6 remained stuck in a starting state with the error **Signal detected for port xeS5-DP0 but Link Down** alerts, which resulted in device instability.
 
 ## PAN-300280
 
@@ -838,15 +898,15 @@ Fixed an issue where the firewall was unable to send device telemetry files to C
 
 ## PAN-297796
 
-Fixed an issue on Panorama where the policy review feature in Dynamic Updates failed to display Security policy rules when the device group was set to All.
+Fixed an issue on Panorama where the policy review feature in **Dynamic Updates** failed to display Security policy rules when the device group was set to **All**.
 
 ## PAN-297782
 
-Fixed an issue on Panorama where reassociating a vsys from one device group to another in a multi-vsys environment resulted in another vsys from the same firewall being removed from the original device group. This resulted in the device being moved into the no device groups attached group, a superuser was required to manually reattach the device.
+Fixed an issue on Panorama where reassociating a vsys from one device group to another in a multi-vsys environment resulted in another vsys from the same firewall being removed from the original device group. This resulted in the device being moved into the **no device groups attached** group, a superuser was required to manually reattach the device.
 
 ## PAN-297774
 
-Fixed an issue on the web interface where the TLS Version was misspelled as TLS Version (Device > Server Profiles > Email).
+Fixed an issue on the web interface where the TLS Version was misspelled as **TLS Vesrion** (**Device > Server Profiles > Email**).
 
 ## PAN-297761
 
@@ -876,6 +936,10 @@ Panorama managed firewalls in HA configurations only
 
 Fixed an issue where the HA-Link-Monitor configuration pushed from Panorama was converted to a local configuration on the peer device after an HA sync, which caused subsequent Panorama pushes of link monitor changes to be flagged as overwritten, and a forced template push or manual clearing of the configuration on the firewall was required.
 
+## PAN-297370
+
+Fixed an issue where pushing a new object from Panorama to a Cloud NGFW Device Group unexpectedly removed existing Panorama-pushed policy rules, even though the **Push Preview** did not show any deletions, which led to traffic disruptions.
+
 ## PAN-297321
 
 ```caveat
@@ -902,7 +966,7 @@ Fixed an issue where the ikemgr process crashed intermittently, which caused IPS
 
 ## PAN-296977
 
-Fixed an issue where the web interface became unresponsive when attempting to view Ethernet interface details after applying a filter in Network > Interfaces.
+Fixed an issue where the web interface became unresponsive when attempting to view **Ethernet** interface details after applying a filter in **Network > Interfaces**.
 
 ## PAN-296752
 
@@ -922,7 +986,7 @@ Fixed an issue where the firewall rebooted due to the useridd process repeatedly
 
 ## PAN-296666
 
-Fixed an issue where Prisma Access gateways did not pass usernames to the WildFire portal, which caused the Recipient User ID to display as unknown on wildfire.paloaltonetworks.com, even when the username was present in the gateway logs.
+Fixed an issue where Prisma Access gateways did not pass usernames to the WildFire portal, which caused the **Recipient User ID** to display as **unknown** on wildfire.paloaltonetworks.com, even when the username was present in the gateway logs.
 
 ## PAN-296616
 
@@ -978,7 +1042,7 @@ Fixed an issue where the firewall incorrectly routed external Type-5 Link State
 Firewalls in active/active HA configurations only
 ```
 
-Fixed an issue where, when a commit operation was in progress, newly deployed IP address tags that used the XML API were not immediately reflected in address group resolution, which delayed IP address mapping to address groups and caused traffic to be incorrectly allowed or denied.
+Added a log enhancement to capture an issue where, when a commit operation was in progress, newly deployed IP address tags that used the XML API were not immediately reflected in address group resolution, which delayed IP address mapping to address groups and caused traffic to be incorrectly allowed or denied.
 
 ## PAN-296020
 
@@ -1082,7 +1146,7 @@ Fixed an issue where, after upgrading Panorama and Log Collectors from PAN-OS 10
 Panorama appliances only
 ```
 
-Fixed an issue where a custom administrator role with the permission Network > QoS (Read Only) was unable to create a QoS profile, even when the Policies > QoS (Enabled) and Network Profiles > QoS Profile (Enabled) permissions were also set.
+Fixed an issue where a custom administrator role with the permission **Network > QoS (Read Only)** was unable to create a QoS profile, even when the **Policies > QoS (Enabled)** and **Network Profiles > QoS Profile (Enabled)** permissions were also set.
 
 ## PAN-295095
 
@@ -1104,6 +1168,10 @@ Fixed an issue on firewalls where, after failover, certain subnets were missing
 
 Fixed an issue where firewalls and Panorama management servers were unable to view or download WildFire reports from a WF-500 appliance, resulting in a 401 error in the report tab.
 
+## PAN-294434
+
+Fixed an issue where memory leaks occurred. These leaks were caused by two distinct scenarios: the failure to deallocate memory for a nodeset when a new nodeset was assigned to the same variable, and the failure to free a UUID hash table during error conditions.
+
 ## PAN-294307
 
 Fixed an issue on Panorama where a configd SIGSEGV crash occurred when renaming objects within policy rules, objects, or zones.
@@ -1114,7 +1182,7 @@ Fixed an issue where BGP did not generate a system log when the number of prefix
 
 ## PAN-294179
 
-Fixed an issue where viewing, refreshing, and comparing config versions in Config Audit caused the configd process to stop responding. If the page loaded successfully, some commit versions displayed incorrect or missing data.
+Fixed an issue where viewing, refreshing, and comparing config versions in **Config Audit** caused the configd process to stop responding. If the page loaded successfully, some commit versions displayed incorrect or missing data.
 
 ## PAN-294161
 
@@ -1126,15 +1194,11 @@ Fixed an issue where the firewall removed all Infrastructure and Audit logs, as
 
 ## PAN-294001
 
-Fixed an issue on Panorama managed firewalls generated Failed in get_pwchange_required error messages in the authd logs for local administators.
+Fixed an issue on Panorama managed firewalls generated **Failed in get_pwchange_required** error messages in the authd logs for local administators.
-
-## PAN-293953
-
-Fixed an issue where the cellular interface LED indicator incorrectly displayed a green light when the cellular interface was down due to a failed packet data session.
 
 ## PAN-293879
 
-Fixed an issue on the firewall where the VM monitor source remained in the Getting All status, which prevented dynamic address groups from updating IP addresses for new EC2 instances. This issue occurred due to a race condition where two threads that simultaneously retrieved IP address tag information from AWS VM monitoring sources became stuck while reading the XML file.
+Fixed an issue on the firewall where the VM monitor source remained in the **Getting All** status, which prevented dynamic address groups from updating IP addresses for new EC2 instances. This issue occurred due to a race condition where two threads that simultaneously retrieved IP address tag information from AWS VM monitoring sources became stuck while reading the XML file.
 
 ## PAN-293858
 
@@ -1142,7 +1206,7 @@ Fixed an issue where the file URL was not displayed on SCM LogViewer when a file
 
 ## PAN-293848
 
-Fixed an issue where Panorama failed to push the default value of None for the secondary NTP server address to managed firewalls, resulting in a commit validation error. This occurred even when configuring the secondary NTP server address as None in Panorama's web interface, and affected both newly deployed and long-standing production firewalls after upgrading.
+Fixed an issue where Panorama failed to push the default value of **None** for the secondary NTP server address to managed firewalls, resulting in a commit validation error. This occurred even when configuring the secondary NTP server address as **None** in Panorama's web interface, and affected both newly deployed and long-standing production firewalls after upgrading.
 
 ## PAN-293847
 
@@ -1156,17 +1220,21 @@ Fixed an issue on the Panorama web interface where SNMP settings configured in P
 
 Fixed an issue where packets with bad TCP checksums were transmitted even when the Strict TCP/IP checksum option was enabled.
 
+## PAN-293708
+
+Fixed an issue where the configd process stopped responding when a partial revert operation was performed on a newly added rule in a rulebase that was empty in the running configuration.
+
 ## PAN-293686
 
 Fixed an issue where importing a device state file was incorrectly allowed during an existing commit job.
 
 ## PAN-293561
 
-Fixed an issue where users with a custom role-based administrator role were unable to download the GlobalProtect client application via the web interface even when the GlobalProtect Client option was enabled in the admin role profile.
+Fixed an issue where users with a custom role-based administrator role were unable to download the GlobalProtect client application via the web interface even when the **GlobalProtect Client** option was enabled in the admin role profile.
 
 ## PAN-293297
 
-Fixed an issue on Panorama where a full push to device groups was initiated instead of a selective push when using Commit and Push Changes Made By in the commit and push.
+Fixed an issue on Panorama where a full push to device groups was initiated instead of a selective push when using **Commit and Push Changes Made By** in the commit and push.
 
 ## PAN-293281
 
@@ -1198,7 +1266,7 @@ Fixed an issue where HA configuration synchronization failed between HA firewall
 
 ## PAN-292447
 
-Fixed an issue where Panorama did not display data in the Feature Adoption tab in Strata Cloud Manager due to the system creating and deleting a CLI user for each interval instead of reusing a permanent CLI user for telemetry.
+Fixed an issue where Panorama did not display data in the **Feature Adoption** tab in Strata Cloud Manager due to the system creating and deleting a CLI user for each interval instead of reusing a permanent CLI user for telemetry.
 
 ## PAN-292306
 
@@ -1226,11 +1294,11 @@ Fixed an issue where the Status LED on PA-7500 SFCs did not work.
 Panorama appliances only
 ```
 
-Fixed an issue where the data on scheduled SaaS Application Usage Reports was different than the data on on-demand reports generated via Run Now.
+Fixed an issue where the data on scheduled SaaS Application Usage Reports was different than the data on on-demand reports generated via **Run Now**.
 
 ## PAN-292019
 
-Fixed an issue on the Panorama web interface where cloud applications were not displayed under Objects > Applications after a new content upgrade and Cloud App Catalog download, and were only visible in application groups, security policy rules, and the CLI.
+Fixed an issue on the Panorama web interface where cloud applications were not displayed under **Objects > Applications** after a new content upgrade and Cloud App Catalog download, and were only visible in application groups, security policy rules, and the CLI.
 
 ## PAN-291984
 
@@ -1312,13 +1380,17 @@ Fixed an issue where the Agent User Override Key was incorrectly available for c
 
 Fixed an issue where the debug dataplane nat sync-ippool command may not accurately account for all allocated ports or display/sync leaks when multiple NAT rules use the same IP pool. This could result in inaccurate reporting of leaked ports. The fix modifies the implementation to directly compare the original pool against the temporary pool across all vsys.
 
+## PAN-290757
+
+Fixed an issue where the user, region, and external IP address were reported as unknown in the AppSec logs due to an incorrect packet adjust logic.
+
 ## PAN-290728
 
-Fixed an issue where modifying an interface IP address on an existing vsys caused a default vsys1 to be created, which led to commit failures due to the maximum supported number of vsys being reached.
+Fixed an issue where modifying an interface IP address on an existing vsys caused a default **vsys1** to be created, which led to commit failures due to the maximum supported number of vsys being reached.
 
 ## PAN-290681
 
-Fixed an issue on Panorama and Panorama managed firewalls where template settings reverted during a device group push when Include Device and Network Templates was checked, even if no changes were made to the template. This caused the SAML IDP server profile certificate to revert to an older, invalid certificate, and resulted in GlobalProtect users being unable to authenticate via SAML.
+Fixed an issue on Panorama and Panorama managed firewalls where template settings reverted during a device group push when **Include Device and Network Templates** was checked, even if no changes were made to the template. This caused the SAML IDP server profile certificate to revert to an older, invalid certificate, and resulted in GlobalProtect users being unable to authenticate via SAML.
 
 ## PAN-289852
 
@@ -1330,7 +1402,7 @@ Fixed an issue on Panorama where a selective push of policy rule changes to a fi
 
 ## PAN-289736
 
-Fixed an issue where partial-revert operations were taking a long time, causing config lock timeout issues and resulting in frequent error messages being displayed: Timed out while getting config lock. Please try again.
+Fixed an issue where partial-revert operations were taking a long time, causing config lock timeout issues and resulting in frequent error messages being displayed: **Timed out while getting config lock. Please try again.**
 
 ## PAN-289706
 
@@ -1376,6 +1448,10 @@ Fixed an issue where the debug data-plane sync ippool CLI command did not work f
 
 Fixed an issue where the firewall incorrectly identified ports as leaking when the session was not active even though the ports were allocated.
 
+## PAN-287599
+
+Fixed an issue where the prefix value for a BGP neighbor caused the firewall to leak routes to a different BGP peer.
+
 ## PAN-287581
 
 ```caveat
@@ -1398,7 +1474,7 @@ Fixed an issue where, when an application stopped responding, a large file was c
 
 ## PAN-287034
 
-Fixed an issue where sequence numbers were skipped for all types of logs on the firewall due to audit logs being generated but not written to disk when Audit Tracking is enabled.
+Fixed an issue where sequence numbers were skipped for all types of logs on the firewall due to audit logs being generated but not written to disk when Audit Tracking was enabled.
 
 ## PAN-285758
 
@@ -1434,7 +1510,7 @@ Fixed an issue where log forwarding to all syslog servers failed if one syslog s
 
 ## PAN-283237
 
-Fixed an issue where traffic logs incorrectly displayed the action as allow for traffic matching a Security policy rule configured with the action set to deny. This issue occurred due to the child session being used for policy rule lookup when a configuration update triggered a rematch if the FTP-data application was not in the rule.
+Fixed an issue where traffic logs incorrectly displayed the action as **allow** for traffic matching a Security policy rule configured with the action set to **deny**. This issue occurred due to the child session being used for policy rule lookup when a configuration update triggered a rematch if the FTP-data application was not in the rule.
 
 ## PAN-283101
 
@@ -1484,9 +1560,12 @@ To disable the retry mechanism: debug user-id dscd retry-enable off.
 
 Additionally, a system log is now generated when a group sync fails, and you are able to monitor the group sync status with the following CLI commands:
 
-show user group count list cloud-identity-engine
+- show user group count list cloud-identity-engine
+- show user group count name <group_name>
 
-show user group count name <group_name>
+## PAN-279552
+
+Fixed an issue where configuring a custom vulnerability object signature condition failed to commit when the **negate** option was disabled on the condition, and changes made to a custom vulnerability object were successfully committed to Panorama but not pushed to the firewall. This occurred when a vulnerability object contained two signatures.
 
 ## PAN-278288
 
@@ -1508,7 +1587,7 @@ Fixed an issue where the Japanese translation for the URL filtering option to ad
 
 ## PAN-274484
 
-Fixed an issue where commits failed when Data Services was in a Service route configuration was configured with the MGMT interface.
+Fixed an issue where commits failed when **Data Services** was in a Service route configuration was configured with the **MGMT** interface.
 
 ## PAN-274333
 
@@ -1546,9 +1625,13 @@ Fixed an issue where newly bootstrapped firewalls sent an incorrect, non-DHCP-as
 
 Fixed an issue where the reportd process stopped responding with a SIGSEGV at schedule_report_es_response.
 
+## PAN-264349
+
+Fixed an issue where the Management Processor Card (MPC) on modular firewalls became unresponsive when a disk drive entered a low-power state and failed to wake up.
+
 ## PAN-259853
 
-Fixed an issue where, when the DHCP server was enabled for GlobalProtect, the commit error message was not properly displayed when Any was selected as the source interface in the service router configuration (Device > Setup > Service > Service Router Configuration).
+Fixed an issue where, when the DHCP server was enabled for GlobalProtect, the commit error message was not properly displayed when **Any** was selected as the source interface in the service router configuration (**Device > Setup > Service > Service Router Configuration**).
 
 ## PAN-257195
 
@@ -1558,6 +1641,10 @@ PA-5400 Series firewalls only
 
 Fixed an issue where the mp-monitor logs did not print disk SMART data.
 
+## PAN-248913
+
+Fixed an issue where the Elasticsearch client certificate was not auto renewed, which caused it to enter a Red state, and logs were not displayed in Panorama.
+
 ## PAN-242952
 
 Fixed an issue where high SSL traffic depleted flex memory, which prevented the firewall from revalidating SSLVPN client CAs during configuration pushes.
@@ -1570,10 +1657,10 @@ Fixed an issue where the firewall did not have a heartbeat mechanism for the aut
 
 Fixed an issue where the firewall was unable to parse the URL path and host when the host header was located in a different packet, which resulted in the firewall not logging the URL path in the first packet.
 
-The fix is disabled by default. The following CLI commands can be used to enable/disable the feature: set system setting ctd url-crosspkt-host-path-caching enableset system setting ctd url-crosspkt-host-path-caching disableset system setting ctd url-crosspkt-host-path-caching default
+The fix is disabled by default. The following CLI commands can be used to enable/disable the feature:
 
-set system setting ctd url-crosspkt-host-path-caching enable
+- set system setting ctd url-crosspkt-host-path-caching enable
+- set system setting ctd url-crosspkt-host-path-caching disable
+- set system setting ctd url-crosspkt-host-path-caching default
 
-set system setting ctd url-crosspkt-host-path-caching disable
+set system setting ctd url-crosspkt-host-path-caching enable set system setting ctd url-crosspkt-host-path-caching disable set system setting ctd url-crosspkt-host-path-caching default
-
-set system setting ctd url-crosspkt-host-path-caching default

web/data/issues/PAN-OS/addressed/12.1.6.md

@@ -16,10 +16,18 @@ Fixed an issue where a newly bootstrapped firewall required a management server
 
 Fixed an issue on PAN-OS 12.1 releases where intermittent traffic drops occurred over IPSec VPN tunnels to third-party firewalls during the IPSec rekey due to the firewall failing to inform the peer to delete the old SA after moving to the new one.
 
+## PAN-313216
+
+Fixed an issue where firewalls with Prisma Access incorrectly displayed some traffic as unsanctioned in traffic logs for cloud applications that were tagged as sanctioned.
+
 ## PAN-311512
 
 Fixed an issue where HIP (Host Information Profile) reports were blocked on GlobalProtect when **Authentication Cookie Usage Restrictions** was enabled and the Prisma Access Agent protocol was in use. This occurred because the system failed to correctly process HIP messages that were relayed via IPSec tunnels with a Virtual IP as the source, leading to their rejection.
 
+## PAN-311412
+
+Fixed an issue where the show advanced-routing resource CLI command failed to execute successfully when invoked through the XML API and returned an error message.
+
 ## PAN-311261
 
 Fixed an issue where the firewall generated duplicate URL Filtering logs due to an error condition when the new XFF feature was enabled.
@@ -40,6 +48,14 @@ Fixed an issue where IPv6 Routed HA did not function correctly when the HA1 (con
 
 Fixed an issue where software packet buffers were completely utilized when performing a Data Loss Prevention longevity test.
 
+## PAN-308507
+
+```caveat
+Panorama managed firewalls only
+```
+
+Fixed an issue where the firewall intermittently failed to maintain active log forwarding streams to Strata Logging Service (SLS) even when duplicate logging and enhanced application logging were enabled.
+
 ## PAN-308418
 
 Fixed an issue where, when Advanced DNS Security was enabled and experienced unusually high loads, DNS resolution failures occurred with the error **resources-unavailable**.

web/data/issues/PAN-OS/known/12.1.2.md

@@ -7,7 +7,7 @@ version: 12.1.2
 ## PAN-314201
 
 ```caveat
-This issue is now resolved. See PAN-OS 12.1.6 Addressed Issues
+This issue is now resolved. See PAN-OS 12.1.6 Addressed Issues.
 ```
 
 On firewalls running PAN-OS 12.1, IPsec VPN tunnels to third-party peer devices may experience intermittent traffic loss during rekey operations. When a new Security Association (SA) forms before the old SA expires, traffic may stop flowing until the older SA naturally expires or you manually clear it. During this time, the output of show vpn ipsec-sa may show two SAs for the same proxy ID. This issue primarily affects tunnels to third-party peer devices and does not occur with Palo Alto Networks to Palo Alto Networks tunnels.
@@ -24,6 +24,28 @@ When the firewall is initially powered on, the FAN-0 LED does not turn on. The f
 
 **Workaround:** Remove and reinsert the fan to turn on the LED.
 
+## PAN-308564
+
+Packets are dropped on SD-WAN interfaces if they require fragmentation for an interface but have the **Don't Fragment (DF)** bit set. This results in unexpected packet drops. This affects client to server sessions when using SD-WAN for NGFW.
+
+**Workaround:** Allow fragmenting packets with DF bit set (`debug dataplane set ip4-ignore-df yes`).
+
+## PAN-308507
+
+```caveat
+This issue is now resolved. See PAN-OS 12.1.6 Addressed Issues.
+```
+
+Strata Logging Service (SLS) log-forwarding streams intermittently show as inactive. When checking the status of log-forwarding connections, one or more streams are reported as inactive. Restarting the log-receiver process temporarily resolves the issue, but the streams become inactive again after approximately 1-2 hours. This intermittent inactivity results in log loss.
+
+## PAN-307702
+
+```caveat
+This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues.
+```
+
+When LACP pre-negotiation is enabled on firewalls in HA configurations, traffic passing through aggregate Ethernet (AE) interfaces may be interrupted for several minutes during HA failovers. This occurs because the suspended (formerly active) firewall continues to forward packets for active sessions even after the failover completes, causing MAC address flapping on neighboring switches.
+
 ## PAN-305301
 
 ```caveat
@@ -34,6 +56,16 @@ The timing of GlobalProtect lifetime expiry or inactivity logout notifications u
 
 **Workaround:** Select **Network > GlobalProtect > Gateways > <gateway-config> > Agent > <agent-config> > Connection Settings** and change the value of both **Notify Before Lifetime Expires (min)** and **Notify Before Inactivity Logout (min)** to 0.
 
+## PAN-304718
+
+```caveat
+This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues.
+```
+
+When using GlobalProtect Clientless VPN, the firewall may restart unexpectedly, causing routing protocol (OSPF and BGP) outages. This issue occurs during web content processing for clientless VPN sessions.
+
+**Workaround:** To prevent this issue until you can upgrade to a fixed release, disable clientless VPN in your GlobalProtect portal configuration.
+
 ## PAN-303959
 
 ```caveat
@@ -64,6 +96,14 @@ Panorama cannot display Threat log entries (**Monitor > Logs > Threat**) when th
 
 Workaround: Upgrade the log collectors to the same version as Panorama.
 
+## PAN-300671
+
+```caveat
+This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues.
+```
+
+Traffic reports that display destination/source IP addresses or destination/source hostnames may incorrectly show IPv4 addresses in IPv6 format (for example, ::ffff:x.x.x.x). This issue affects both custom reports and scheduled reports, including PDF exports.
+
 ## PAN-300627
 
 AutoCommit fails when the Traffic Object is used on AI Runtime Security, which consequently impacts the workloads that utilize overlapping subnets.

web/data/issues/PAN-OS/known/12.1.3.md

@@ -14,6 +14,10 @@ On firewalls running PAN-OS 12.1, IPsec VPN tunnels to third-party peer devices
 
 **Workaround:** Manually clear the affected Security Association using the command `clear vpn ipsec-sa tunnel <tunnel-name>` to restore connectivity.
 
+## PAN-313623
+
+On firewalls with TPM (Trusted Platform Module) support, device certificate renewals may fail due to a disk partition being full. This latter occurs because temporary files aren't being deleted during device certificate status checks.
+
 ## PAN-309604
 
 ```caveat
@@ -32,6 +36,28 @@ When the firewall is initially powered on, the FAN-0 LED does not turn on. The f
 
 **Workaround:** Remove and reinsert the fan to turn on the LED.
 
+## PAN-308564
+
+Packets are dropped on SD-WAN interfaces if they require fragmentation for an interface but have the **Don't Fragment (DF)** bit set. This results in unexpected packet drops. This affects client to server sessions when using SD-WAN for NGFW.
+
+**Workaround:** Allow fragmenting packets with DF bit set (`debug dataplane set ip4-ignore-df yes`).
+
+## PAN-308507
+
+```caveat
+This issue is now resolved. See PAN-OS 12.1.6 Addressed Issues.
+```
+
+Strata Logging Service (SLS) log-forwarding streams intermittently show as inactive. When checking the status of log-forwarding connections, one or more streams are reported as inactive. Restarting the log-receiver process temporarily resolves the issue, but the streams become inactive again after approximately 1-2 hours. This intermittent inactivity results in log loss.
+
+## PAN-307702
+
+```caveat
+This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues.
+```
+
+When LACP pre-negotiation is enabled on firewalls in HA configurations, traffic passing through aggregate Ethernet (AE) interfaces may be interrupted for several minutes during HA failovers. This occurs because the suspended (formerly active) firewall continues to forward packets for active sessions even after the failover completes, causing MAC address flapping on neighboring switches.
+
 ## PAN-305880
 
 ```caveat
@@ -50,6 +76,16 @@ The timing of GlobalProtect lifetime expiry or inactivity logout notifications u
 
 **Workaround:** Select **Network > GlobalProtect > Gateways > <gateway-config> > Agent > <agent-config> > Connection Settings** and change the value of both **Notify Before Lifetime Expires (min)** and **Notify Before Inactivity Logout (min)** to 0.
 
+## PAN-304718
+
+```caveat
+This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues.
+```
+
+When using GlobalProtect Clientless VPN, the firewall may restart unexpectedly, causing routing protocol (OSPF and BGP) outages. This issue occurs during web content processing for clientless VPN sessions.
+
+**Workaround:** To prevent this issue until you can upgrade to a fixed release, disable clientless VPN in your GlobalProtect portal configuration.
+
 ## PAN-304576
 
 ```caveat
@@ -90,6 +126,14 @@ Panorama cannot display Threat log entries (**Monitor > Logs > Threat**) when th
 
 Workaround: Upgrade the log collectors to the same version as Panorama.
 
+## PAN-300671
+
+```caveat
+This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues.
+```
+
+Traffic reports that display destination/source IP addresses or destination/source hostnames may incorrectly show IPv4 addresses in IPv6 format (for example, ::ffff:x.x.x.x). This issue affects both custom reports and scheduled reports, including PDF exports.
+
 ## PAN-300627
 
 AutoCommit fails when the Traffic Object is used on AI Runtime Security, which consequently impacts the workloads that utilize overlapping subnets.
@@ -199,10 +243,6 @@ PA-5500 Series firewalls only
 
 The **Monitor** tab in the Web Interface does not display a pop-up to indicate that high-speed log forwarding is enabled and that logs are only viewable from Panorama.
 
-## PAN-298505
-
-After upgrading multi-vsys firewalls, the sequence of the virtual system IDs (vsys ID) changes causing autocommit failures with validation errors. This occurs when the multi-vsys firewall has virtual systems created and managed via Panorama, and the vsys ID sequence is broken because an unused virtual system was deleted and the change was pushed to the firewall.
-
 ## PAN-298083
 
 After you change the system mode on an M-700 appliance from Panorama mode to PAN-DB private cloud mode, the snmpd process fails to work.

web/data/issues/PAN-OS/known/12.1.4.md

@@ -14,6 +14,10 @@ On firewalls running PAN-OS 12.1, IPsec VPN tunnels to third-party peer devices
 
 **Workaround:** Manually clear the affected Security Association using the command `clear vpn ipsec-sa tunnel <tunnel-name>` to restore connectivity.
 
+## PAN-313623
+
+On firewalls with TPM (Trusted Platform Module) support, device certificate renewals may fail due to a disk partition being full. This latter occurs because temporary files aren't being deleted during device certificate status checks.
+
 ## PAN-312706
 
 ```caveat
@@ -40,6 +44,28 @@ When the firewall is initially powered on, the FAN-0 LED does not turn on. The f
 
 **Workaround:** Remove and reinsert the fan to turn on the LED.
 
+## PAN-308564
+
+Packets are dropped on SD-WAN interfaces if they require fragmentation for an interface but have the **Don't Fragment (DF)** bit set. This results in unexpected packet drops. This affects client to server sessions when using SD-WAN for NGFW.
+
+**Workaround:** Allow fragmenting packets with DF bit set (`debug dataplane set ip4-ignore-df yes`).
+
+## PAN-308507
+
+```caveat
+This issue is now resolved. See PAN-OS 12.1.6 Addressed Issues.
+```
+
+Strata Logging Service (SLS) log-forwarding streams intermittently show as inactive. When checking the status of log-forwarding connections, one or more streams are reported as inactive. Restarting the log-receiver process temporarily resolves the issue, but the streams become inactive again after approximately 1-2 hours. This intermittent inactivity results in log loss.
+
+## PAN-307702
+
+```caveat
+This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues.
+```
+
+When LACP pre-negotiation is enabled on firewalls in HA configurations, traffic passing through aggregate Ethernet (AE) interfaces may be interrupted for several minutes during HA failovers. This occurs because the suspended (formerly active) firewall continues to forward packets for active sessions even after the failover completes, causing MAC address flapping on neighboring switches.
+
 ## PAN-305880
 
 ```caveat
@@ -58,6 +84,16 @@ The timing of GlobalProtect lifetime expiry or inactivity logout notifications u
 
 **Workaround:** Select **Network > GlobalProtect > Gateways > <gateway-config> > Agent > <agent-config> > Connection Settings** and change the value of both **Notify Before Lifetime Expires (min)** and **Notify Before Inactivity Logout (min)** to 0.
 
+## PAN-304718
+
+```caveat
+This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues.
+```
+
+When using GlobalProtect Clientless VPN, the firewall may restart unexpectedly, causing routing protocol (OSPF and BGP) outages. This issue occurs during web content processing for clientless VPN sessions.
+
+**Workaround:** To prevent this issue until you can upgrade to a fixed release, disable clientless VPN in your GlobalProtect portal configuration.
+
 ## PAN-304576
 
 ```caveat
@@ -98,6 +134,14 @@ Panorama cannot display Threat log entries (**Monitor > Logs > Threat**) when th
 
 Workaround: Upgrade the log collectors to the same version as Panorama.
 
+## PAN-300671
+
+```caveat
+This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues.
+```
+
+Traffic reports that display destination/source IP addresses or destination/source hostnames may incorrectly show IPv4 addresses in IPv6 format (for example, ::ffff:x.x.x.x). This issue affects both custom reports and scheduled reports, including PDF exports.
+
 ## PAN-300627
 
 AutoCommit fails when the Traffic Object is used on AI Runtime Security, which consequently impacts the workloads that utilize overlapping subnets.
@@ -207,10 +251,6 @@ PA-5500 Series firewalls only
 
 The **Monitor** tab in the Web Interface does not display a pop-up to indicate that high-speed log forwarding is enabled and that logs are only viewable from Panorama.
 
-## PAN-298505
-
-After upgrading multi-vsys firewalls, the sequence of the virtual system IDs (vsys ID) changes causing autocommit failures with validation errors. This occurs when the multi-vsys firewall has virtual systems created and managed via Panorama, and the vsys ID sequence is broken because an unused virtual system was deleted and the change was pushed to the firewall.
-
 ## PAN-298083
 
 After you change the system mode on an M-700 appliance from Panorama mode to PAN-DB private cloud mode, the snmpd process fails to work.

web/data/issues/PAN-OS/known/12.1.5.md

@@ -37,6 +37,10 @@ When a firewall node is removed from a PA-5500 Series cluster, after the cluster
 - Manually assign zone configurations to ports eth1/1 (for example, untrust) and eth1/2 (for example, trust), then open and close security policy rule1 without making changes, and **Commit**.
 - Delete the default rule and the default virtual wire Ethernet interfaces, then commit.
 
+## PAN-313623
+
+On firewalls with TPM (Trusted Platform Module) support, device certificate renewals may fail due to a disk partition being full. This latter occurs because temporary files aren't being deleted during device certificate status checks.
+
 ## PAN-312247
 
 In generated PDF upgrade check reports, long remediation URLs might be truncated due to UI framework export limitations, leaving only the first line hyperlinked. However, these links remain fully functional within the Panorama web interface. The PDF link directs to the correct destination if the complete URL is copied from the PDF and pasted in the browser.
@@ -59,6 +63,20 @@ When the firewall is initially powered on, the FAN-0 LED does not turn on. The f
 
 **Workaround:** Remove and reinsert the fan to turn on the LED.
 
+## PAN-308564
+
+Packets are dropped on SD-WAN interfaces if they require fragmentation for an interface but have the **Don't Fragment (DF)** bit set. This results in unexpected packet drops. This affects client to server sessions when using SD-WAN for NGFW.
+
+**Workaround:** Allow fragmenting packets with DF bit set (`debug dataplane set ip4-ignore-df yes`).
+
+## PAN-308507
+
+```caveat
+This issue is now resolved. See PAN-OS 12.1.6 Addressed Issues.
+```
+
+Strata Logging Service (SLS) log-forwarding streams intermittently show as inactive. When checking the status of log-forwarding connections, one or more streams are reported as inactive. Restarting the log-receiver process temporarily resolves the issue, but the streams become inactive again after approximately 1-2 hours. This intermittent inactivity results in log loss.
+
 ## PAN-300850
 
 Manual scheduling of cloud verdicts is required if a new host in an Host Compliance Service-enabled environment has a refresh event entry without a corresponding update event entry.

web/data/issues/PAN-OS/known/12.1.6.md

@@ -27,6 +27,10 @@ When a firewall node is removed from a PA-5500 Series cluster, after the cluster
 - Manually assign zone configurations to ports eth1/1 (for example, untrust) and eth1/2 (for example, trust), then open and close security policy rule1 without making changes, and **Commit**.
 - Delete the default rule and the default virtual wire Ethernet interfaces, then commit.
 
+## PAN-313623
+
+On firewalls with TPM (Trusted Platform Module) support, device certificate renewals may fail due to a disk partition being full. This latter occurs because temporary files aren't being deleted during device certificate status checks.
+
 ## PAN-312247
 
 In generated PDF upgrade check reports, long remediation URLs might be truncated due to UI framework export limitations, leaving only the first line hyperlinked. However, these links remain fully functional within the Panorama web interface. The PDF link directs to the correct destination if the complete URL is copied from the PDF and pasted in the browser.
@@ -49,6 +53,12 @@ When the firewall is initially powered on, the FAN-0 LED does not turn on. The f
 
 **Workaround:** Remove and reinsert the fan to turn on the LED.
 
+## PAN-308564
+
+Packets are dropped on SD-WAN interfaces if they require fragmentation for an interface but have the **Don't Fragment (DF)** bit set. This results in unexpected packet drops. This affects client to server sessions when using SD-WAN for NGFW.
+
+**Workaround:** Allow fragmenting packets with DF bit set (`debug dataplane set ip4-ignore-df yes`).
+
 ## PAN-300850
 
 Manual scheduling of cloud verdicts is required if a new host in an Host Compliance Service-enabled environment has a refresh event entry without a corresponding update event entry.