|
+ Issue ID
+ |
+
+ Description
+ |
+
|---|---|
GPC-26949 |
+
+
+ Fixed an issue where the GlobalProtect embedded browser would stall in
+ a connecting state when a macOS device attempted to establish a
+ connection to the identity provider after waking from sleep. With this
+ fix, the connection process completes successfully.
+
+ |
+
GPC-26946 |
+
+
+ Fixed an issue where GlobalProtect would skip sending a Host
+ Information Profile (HIP) report after a network change, such as
+ transitioning between wired and Wi-Fi networks. This behavior
+ prevented the firewall from receiving necessary data to maintain the
+ user's session, which resulted in an outage. With this fix,
+ GlobalProtect now properly sends HIP reports after network changes.
+
+ |
+
GPC-26856 |
+
+
+ Fixed an issue where GlobalProtect Host Information Profile (HIP)
+ recognition incorrectly reported the Real-Time Protection (RTP) status
+ of a specific antivirus product, which caused endpoints to be marked
+ as non-compliant and resulted in blocked network access. This occurred
+ after an external update and rebranding of the antivirus product. With
+ this fix, GlobalProtect accurately identifies the RTP status, ensuring
+ correct compliance enforcement.
+
+ |
+
GPC-26275 |
+
+
+ Fixed an issue where the Traffic Blocking Notification message was not
+ displayed when GlobalProtect Connection for Network Access was
+ enforced and a user connected to a network behind a Captive Portal
+ before completing authentication. With this fix, the notification
+ message "To access the network, you must first connect to
+ GlobalProtect." displays as expected.
+
+ |
+
GPC-26227 |
+
+
+ Fixed an issue where your GlobalProtect client connected to a
+ geographically distant GlobalProtect gateway even when a closer,
+ preferred gateway was available. This occurred when your network
+ connection became temporarily unavailable during the GlobalProtect
+ client's attempt to connect to the preferred gateway. With this fix,
+ your GlobalProtect client correctly prioritizes and connects to the
+ optimal gateway after network connectivity is restored.
+
+ |
+
GPC-26152 |
+
+
+ Fixed an issue where GlobalProtect users would fail to authenticate
+ when their usernames contained certain special characters, which led
+ to a mismatch in character interpretation during the authentication
+ process. With this fix, GlobalProtect now correctly processes
+ usernames containing these special characters, allowing for successful
+ authentication.
+
+ |
+
GPC-25996 |
+
+
+ Fixed an issue where GlobalProtect target gateway selection reverted
+ to the default after a few seconds. With this fix, the target gateway
+ selection now persisted as configured.
+
+ |
+
GPC-25879 |
+
+
+ Fixed an issue where GlobalProtect incorrectly detected an internal
+ network over the tunnel, which happened when SAML authentication timed
+ out during a GlobalProtect gateway switch. With this fix,
+ GlobalProtect accurately determines network connectivity.
+
+ |
+
GPC-25869 |
+
+
+ (macOS clients only) Fixed an issue where GlobalProtect connections
+ would not establish after a reboot, which occurred because the
+ GlobalProtect agent did not start or connect properly. With this fix,
+ GlobalProtect connections establish as expected after a reboot.
+
+ |
+
GPC-25866 |
+
+
+ Fixed an issue where the system did not send a Host Information
+ Profile (HIP) report when real-time protection was detected as enabled
+ after an initial detection of it being disabled immediately following
+ power-on, which occurred because the system created a new HIP report
+ but did not send it. With this fix, the system correctly sends HIP
+ reports when the real-time protection status changes.
+
+ |
+
GPC-25797 |
+
+
+ Fixed an issue where GlobalProtect connections would show a connected
+ status but would not pass traffic. Attempts to refresh the connection
+ would also fail, preventing further connection establishment for a
+ period. With this fix, GlobalProtect connections properly pass traffic
+ when showing a connected status.
+
+ |
+
GPC-25792 |
+
+
+ Fixed an issue where GlobalProtect would not reconnect when Dynamic
+ Link State Awareness (DLSA) was handling dual Network Interface Cards
+ (NICs) if the gateway IP was not explicitly added to split routing,
+ which occurred because the previous implementation required the
+ gateway IP to be known and configured for split routing in such
+ scenarios. With this fix, DLSA now handles dual NIC scenarios without
+ requiring the gateway IP to be added to split routing.
+
+ |
+
GPC-25731 |
+
+
+ Fixed an issue where GlobalProtect split-tunnel configurations did not
+ correctly exclude multicast IP addresses. With this fix, multicast IP
+ addresses are excluded as configured.
+
+ |
+
GPC-25677 |
+
+
+ Fixed an issue where, on GlobalProtect deployments with Windows
+ clients configured for "Pre-logon (Always On)" connection, the
+ GlobalProtect App would incorrectly establish an external
+ GlobalProtect gateway tunnel immediately after a user logged into
+ their Windows account, even when the client was connected to the
+ internal network. This behavior occurred when the GlobalProtect Portal
+ agent configuration had the "Enable Cache Portal Configuration in
+ Absence of Pre-logon Tunnel" setting enabled and the "Pre-Logon Tunnel
+ Rename Timeout (sec) (Windows Only)" was set to a positive value,
+ leading to a bypass of internal network discovery during the pre-logon
+ tunnel rename process.
+
+ |
+
GPC-25512 |
+
+
+ Fixed an issue where the GlobalProtect Agent (PanGPA) would
+ unexpectedly terminate in a Prisma Access environment, which was
+ related to cryptographic operations. With this fix, the GlobalProtect
+ Agent maintains stable operation.
+
+ |
+
GPC-25511 |
+
+
+ Fixed an issue where macOS GlobalProtect clients running version
+ 6.2.8-h7 experienced a failure in IPv6 routing and traffic flow
+ through the VPN tunnel. This occurred because the GlobalProtect client
+ did not correctly install IPv6 routes when the gateway's Fully
+ Qualified Domain Name (FQDN) lacked an AAAA DNS record, leading to an
+ empty remoteHostV6 variable and the IPv6 system configuration being
+ skipped, even when the gateway assigned an IPv6 tunnel IP and provided
+ access routes.
+
+ |
+
GPC-25484 |
+
+
+ Fixed an issue where the GlobalProtect Agent software (versions 6.2.8
+ H4, 6.2.8 H7, and 6.3.3) would crash, disconnect from the VPN, and
+ restart when a user clicked outside the 'Add Portal Address' window
+ while it was open.
+
+ |
+
GPC-25459 |
+
+
+ Fixed an issue where GlobalProtect exclude routes were not installed
+ correctly on Windows endpoints. With this fix, exclude routes install
+ as expected.
+
+ |
+
GPC-25444 |
+
+
+ Fixed an issue where GlobalProtect clients on macOS would display a
+ "Portal not found" or "Could not connect to Authentication server"
+ error on the first connection attempt to the GlobalProtect portal
+ after an upgrade or system reboot, requiring a second attempt to
+ successfully connect.
+
+ |
+
GPC-25425 |
+
+
+ (GlobalProtect client on Windows 11 only) Fixed an issue where the
+ GlobalProtect client window displayed a blank screen, which prevented
+ the connection status from appearing. This issue occurred
+ intermittently, particularly after the computer woke up. With this
+ fix, the client window displays the connection status as expected.
+
+ |
+
GPC-25396 |
+
+
+ Fixed an issue where macOS GlobalProtect clients lost internet
+ connectivity after switching between different GlobalProtect portals.
+ This occurred because the client retained incorrect Domain Name System
+ (DNS) server assignments from the previously connected portal, which
+ prevented successful name resolution. With this fix, the client
+ properly updates DNS settings when switching portals.
+
+ |
+
GPC-25286 |
+
+
+ Fixed an issue where importing a self-signed root certificate into the
+ user trust store through the GlobalProtect (GP) portal's
+ Agent -> Trusted Root CA -> install in local root
+ certificate store
+ option would not complete, which occurred when strict certificate
+ checking options were enabled, even if the GlobalProtect portal's own
+ certificate was trusted. With this fix, the import process completes
+ as expected under these conditions.
+
+ |
+
GPC-25221 |
+
+
+ Fixed an issue where the Real Time protection status for Carbon Black
+ Cloud Sensor was displayed as 'n/a', which occurred even after the
+ sensor product was correctly detected. With this fix, the Real Time
+ protection status is now correctly recognized and populated.
+
+ |
+
GPC-24969 |
+
+
+ Fixed an issue where on Windows endpoints, the system's proxy
+ AutoConfigURL was not restored to its original value after
+ GlobalProtect disconnected, specifically when GlobalProtect had pushed
+ a different proxy AutoConfigURL during the connection.
+
+ |
+
GPC-24968 |
+
+
+ Fixed an issue where GlobalProtect clients failed to correctly parse
+ the internal gateway IP address provided via DHCP option 43 with
+ sub-option 100, causing the client to attempt connection to an
+ incorrect IP address.
+
+ |
+
GPC-24587 |
+
+
+ Fixed an issue where GlobalProtect client version 6.2.8, when
+ installed in FIPS-CC mode on client machines with AMD chipsets, failed
+ with an error message indicating that the CPU does not support
+ RDSEED/RDRAND instructions. This occurred because the openssl library
+ was built with the RDCPU flag, leading to an incorrect assessment of
+ CPU capabilities on AMD platforms.
+
+ |
+
GPC-24138 |
+
+
+ Fixed an issue where GlobalProtect Portal and Gateway logs (pan_gp_event.log) did not provide detailed error messages when client certificate
+ authentication failed during the pre-logon stage, particularly when
+ the private key was stored on a Trusted Platform Module (TPM).
+
+ |
+
GPC-24065 |
+
+
+ Fixed an issue where GlobalProtect displayed a connected status, but
+ internet connectivity was interrupted, which led to dropped calls and
+ other service disruptions. This occurred because the GlobalProtect
+ virtual adapter unexpectedly disconnected when an IPSec tunnel failed
+ to gracefully fall back to an SSL tunnel. With this fix, the
+ GlobalProtect virtual adapter maintains its connection and properly
+ transitions between tunnel types.
+
+ |
+
GPC-23848 |
+
+
+ Fixed an issue where the GlobalProtect client (version 6.2.8-243) on
+ macOS 15.5 (Build 24F74) caused excessive memory consumption, with the
+ GlobalProtect process consuming up to 27 GB of memory, due to improper
+ memory management related to autoreleasepool.
+
+ |
+
GPC-23551 |
+
+
+ Fixed an issue where the virtual network adapter retained the static
+ IP address assigned by GlobalProtect even after the GlobalProtect
+ client disconnected. This caused DNS registration conflicts, making
+ workstations unreachable by hostname even after a reboot.
+
+ |
+
GPC-22392 |
+
+
+ Fixed an issue where the GlobalProtect client for Windows (Spanish
+ version) displayed an incorrect translation, "Logs ficticios" (Fake
+ logs), for the log collection option in the Settings >
+ Troubleshooting menu.
+
+ |
+
GPC-17407 |
+
+
+ Fixed an issue where traffic to loopback addresses within the
+ 127.0.0.0/8 subnet, excluding 127.0.0.1, was dropped when Endpoint
+ Traffic Policy Enforcement was enabled, which prevented applications
+ from using these loopback addresses for internal communication. With
+ this fix, traffic to the entire loopback subnet is handled correctly.
+
+ |
+
|
+ Issue ID
+ |
+
+ Description
+ |
+
|---|---|
GPC-27179 |
+
+
+ Fixed an issue where GlobalProtect portal registration was prevented
+ during SAML authentication hand-off, which caused agents to remain
+ disconnected despite successful authentication with an identity
+ provider. This occurred because an internal data buffer became
+ corrupted during the authentication token hand-off, which led to the
+ loss of session identity. With this fix, the authentication token is
+ correctly processed, allowing agents to register with the portal.
+
+ |
+
GPC-27177 |
+
+
+ Fixed an issue where GlobalProtect Host Information Profile (HIP)
+ reports had an invalid XML format. With this fix, HIP reports are
+ generated with the correct XML structure.
+
+ |
+
|
+ Issue ID
+ |
+
+ Description
+ |
+
|---|---|
GPC-27851 |
+
+
+ Fixed an issue where GlobalProtect could not connect after an upgrade,
+ which occurred because the GlobalProtect service sent portal
+ configuration and gateway authentication requests to the portal's
+ connected IP address instead of its fully qualified domain name
+ (FQDN), causing certificate verification to not succeed. Users
+ encountered the error "The network connection is unreachable or the
+ gateway is unresponsive. Check the network connection and reconnect."
+ With this fix, GlobalProtect correctly routes requests to the portal
+ FQDN and connects as expected.
+
+ |
+
GPC-27846 |
+
+
+ (macOS devices) Fixed an issue where GlobalProtect authentication did
+ not complete during the portal sign-in process, which caused users to
+ encounter an "Authentication Failed" error. This occurred because the
+ GlobalProtect service stopped unexpectedly during SAML authentication.
+ With this fix, GlobalProtect authenticates and connects as expected.
+
+ |
+
GPC-27555 |
+
+
+ Fixed an issue where GlobalProtect user connections were disconnecting
+ after one hour, which occurred when the portal refresh process
+ initiated and the client encountered an error during its network
+ configuration update. With this fix, GlobalProtect connections now
+ refresh as expected without interruption.
+
+ |
+
GPC-27513 |
+
+
+ Fixed an issue where GlobalProtect intermittently did not detect the
+ Real-time Protection (RTP) state of Windows Defender, which prevented
+ authorized users from accessing resources when Host Information
+ Profile (HIP) policies were applied. This behavior occurred after an
+ upgrade of Windows Defender. With this fix, GlobalProtect properly
+ detects the RTP state of Windows Defender.
+
+ |
+
GPC-27403 |
+
+
+ (GlobalProtect client on Windows devices using SmartCard
+ authentication) Fixed an issue where the GlobalProtect client would
+ unexpectedly terminate and fail to establish a connection, which was
+ caused by inter-process communication issues during the authentication
+ process. With this fix, the client connects as expected.
+
+ |
+
GPC-27394 |
+
+
+ Fixed an issue where GlobalProtect gateway certificate verification
+ would fail after a software upgrade, which prevented connections to
+ the gateway. With this fix, gateway certificate verification proceeds
+ as expected.
+
+ |
+
GPC-27281 |
+
+
+ Fixed an issue where GlobalProtect Host Information Profile (HIP)
+ checks intermittently failed with an "Invalid authentication cookie"
+ error after machines woke up from modern standby, which caused traffic
+ to incorrectly match policies without HIP requirements or fall through
+ to default rules. With this fix, HIP checks proceed as expected, and
+ traffic correctly matches policies based on HIP requirements.
+
+ |
+
GPC-27202 |
+
+
+ Fixed an issue where GlobalProtect log entries for macOS agents that
+ disconnected using ticket were not displayed in the Strata Cloud
+ Manager Log Viewer, which led to an inconsistency in log reporting
+ compared with Windows agents. With this fix, log entries for macOS
+ agents are displayed correctly.
+
+ |
+
GPC-27149 |
+
+
+ Fixed an issue where GlobalProtect connections would intermittently
+ stall, preventing internet access. With this fix, GlobalProtect
+ connections establish and maintain properly.
+
+ |
+
GPC-26994 |
+
+
+ Fixed an issue where Host Information Profile (HIP) reports were not
+ sent to the gateway intermittently, which resulted in issues with
+ user-IP mapping. With this fix, HIP reports are sent consistently,
+ ensuring accurate user-IP mapping.
+
+ |
+
GPC-26933 |
+
+
+ (macOS endpoints only) Fixed an issue where the GlobalProtect app
+ would not connect to the GlobalProtect service after a macOS upgrade
+ and a sleep-wake event. With this fix, the GlobalProtect app connects
+ as expected.
+
+ |
+
GPC-26928 |
+
+
+ Fixed an issue where the GlobalProtect client would remain in a
+ connecting state after an initial authentication attempt failed, and
+ would not attempt to connect to alternate gateways. With this fix, the
+ GlobalProtect client now properly transitions out of the connecting
+ state and attempts alternate gateways when authentication fails.
+
+ |
+
GPC-26808 |
+
+
+ Fixed an issue where GlobalProtect did not detect a specific version
+ of the Broadcom Endpoint Security Agent (ESA) on macOS endpoints. With
+ this fix, the agent is correctly detected, and administrators can
+ configure policies for it.
+
+ |
+
GPC-26790 |
+
+
+ (macOS devices running GlobalProtect) Fixed an issue where
+ GlobalProtect would not connect, which caused users to encounter a
+ "Could not connect to the GlobalProtect service" error after a macOS
+ update or system reboot. This occurred because the GlobalProtect
+ service would not start or would stop unexpectedly. With this fix,
+ GlobalProtect connects successfully.
+
+ |
+
GPC-26780 |
+
+
+ (macOS devices only) Fixed an issue where GlobalProtect would get
+ stuck in a connecting state after the device woke from sleep or
+ reconnected to a network, which resulted from GlobalProtect attempting
+ to resolve the gateway's fully qualified domain name (FQDN) using the
+ tunnel's DNS instead of the local internet service provider (ISP) DNS.
+ With this fix, GlobalProtect correctly uses the local ISP DNS for
+ gateway FQDN resolution when disconnected.
+
+ |
+
GPC-26764 |
+
+
+ (GlobalProtect app on macOS devices) Fixed an issue where the
+ GlobalProtect app initiated unexpected portal requests after a manual
+ gateway selection. With this fix, the app behaves as expected after a
+ manual gateway selection.
+
+ |
+
GPC-26699 |
+
+
+ (macOS only) Fixed an issue where the GlobalProtect user interface
+ popover would not dismiss after a successful connection, which
+ occurred because the GlobalProtect menu bar icon became inaccessible
+ when hidden by the operating system. With this fix, the popover
+ automatically dismisses after a successful connection.
+
+ |
+
GPC-26682 |
+
+
+ Fixed an issue where internet connectivity would stop working on macOS
+ when the GlobalProtect client was connected to certain mobile hotspots
+ that assigned IP addresses from a specific reserved range, which
+ occurred because the GlobalProtect client did not properly process
+ this particular IP address range used in some mobile network
+ environments. With this fix, internet connectivity is maintained in
+ these scenarios.
+
+ |
+
GPC-26657 |
+
+
+ Fixed an issue where the HIP process repeatedly launched in a
+ rapid-fire loop, which triggered alerts. With this fix, the process
+ launches as expected.
+
+ |
+
GPC-26619 |
+
+
+ (GlobalProtect app on macOS only) Fixed an issue where the
+ GlobalProtect app remained in a connecting state for approximately two
+ minutes after a local network-extension or route-change event, which
+ required a restart of the app to recover. With this fix, the
+ GlobalProtect app now connects as expected after such events.
+
+ |
+
GPC-26618 |
+
+
+ (GlobalProtect app on macOS) Fixed an issue where the GlobalProtect
+ app would fail to connect to gateways after a manual gateway
+ selection. With this fix, the GlobalProtect app connects successfully
+ to gateways after manual selection.
+
+ |
+
GPC-26560 |
+
+
+ Fixed an issue where GlobalProtect app connections experienced a delay
+ when Autonomous Digital Experience Management (ADEM) was disabled in
+ the portal, which occurred because the agent continued to search for
+ the ADEM configuration file. With this fix, the agent no longer
+ attempts to locate the ADEM configuration file when ADEM is disabled.
+
+ |
+
GPC-26558 |
+
+
+ Fixed an issue where GlobalProtect App disconnect reason text was
+ truncated in the user interface when the GlobalProtect Portal was
+ configured with a custom disconnect reason, which prevented the full
+ message from being displayed. With this fix, the user interface now
+ properly displays the complete disconnect reason.
+
+ |
+
GPC-26537 |
+
+
+ Fixed an issue where an unauthorized user could disconnect a
+ GlobalProtect connection after interrupting Security Assertion Markup
+ Language (SAML) authentication during a connection refresh. With this
+ fix, the Disconnect button no longer appeared for unauthorized users
+ in this scenario.
+
+ |
+
GPC-26536 |
+
+
+ Fixed an issue where the GlobalProtect client on macOS would
+ intermittently become stuck in a connecting state after the system
+ resumed from sleep mode, which prevented internet access even after
+ disconnecting the virtual private network (VPN). With this fix, the
+ client now connects as expected and allows proper network access.
+
+ |
+
GPC-26224 |
+
+
+ Fixed an issue where the GlobalProtect client stole focus when a user
+ entered a PIN for PINGID/Security Assertion Markup Language (SAML)
+ authentication. With this fix, the GlobalProtect client no longer
+ unexpectedly takes focus during this authentication process.
+
+ |
+
GPC-26133 |
+
+
+ Fixed an issue where the
+ DisplayVersion registry key for
+ GlobalProtect clients on Windows reported an incomplete version
+ string, which led to other software misidentifying the installed
+ GlobalProtect version. With this fix, the registry key now accurately
+ reflects the full client version.
+
+ |
+
GPC-26088 |
+
+
+ Fixed an issue where the GlobalProtect Enforcer did not unblock
+ network traffic after a GlobalProtect connection was established,
+ which resulted in the blocking of traffic not explicitly excluded from
+ enforcement. With this fix, the GlobalProtect Enforcer now correctly
+ unblocks traffic upon successful GlobalProtect connection.
+
+ |
+
GPC-25840 |
+
+
+ Fixed an issue where applications configured for split tunneling would
+ not function correctly after a network transition. With this fix,
+ applications would function as expected after network changes.
+
+ |
+
GPC-25670 |
+
+
+ Fixed an issue where the GlobalProtect app would intermittently get
+ stuck in a connecting state after a laptop woke up from standby,
+ preventing it from establishing a connection to the gateway. With this
+ fix, the GlobalProtect agent connects successfully.
+
+ |
+
GPC-25575 |
+
+
+ (macOS devices only) Fixed an issue where custom Host Information
+ Profile (HIP) checks did not correctly evaluate certain system
+ configuration parameters, which prevented macOS devices from matching
+ the intended HIP objects. With this fix, HIP checks accurately
+ evaluate the system configuration parameters.
+
+ |
+
GPC-25567 |
+
+
+ Fixed an issue where the GlobalProtect Client would intermittently not
+ complete Kerberos Single Sign-On (SSO) during pre-login. This occurred
+ when the client did not post the Kerberos token back after receiving
+ an initial authentication challenge from the portal, which prompted
+ users for credentials and displayed an error message indicating an
+ unreachable network or unresponsive portal. With this fix, Kerberos
+ SSO now succeeds consistently.
+
+ |
+
GPC-25308 |
+
+
+ Fixed an issue where the GlobalProtect app intermittently stopped
+ transmitting Host Information Profile (HIP) reports, which caused
+ User-ID entries to be cleared and resulted in missing user-to-IP
+ mappings. With this fix, the GlobalProtect app now consistently
+ transmits HIP reports, maintaining accurate user-to-IP mappings.
+
+ |
+
GPC-25219 |
+
+
+ Fixed an issue where users were unable to select the GlobalProtect
+ icon from the status bar on macOS.
+
+ |
+
|
+ Issue ID
+ |
+
+ Description
+ |
+
|---|---|
GPC-26946 |
+
+
+ Fixed an issue where GlobalProtect would skip sending a Host
+ Information Profile (HIP) report after a network change, such as
+ transitioning between wired and Wi-Fi networks. This behavior
+ prevented the firewall from receiving necessary data to maintain the
+ user's session, which resulted in an outage. With this fix,
+ GlobalProtect now properly sends HIP reports after network changes.
+
+ |
+
GPC-26919 |
+
+
+ Fixed an issue where there was a delay in Captive Portal detection on
+ macOS endpoints. With this fix, Captive Portal detection now functions
+ as expected.
+
+ |
+
GPC-26856 |
+
+
+ Fixed an issue where GlobalProtect Host Information Profile (HIP)
+ recognition incorrectly reported the Real-Time Protection (RTP) status
+ of a specific antivirus product, which caused endpoints to be marked
+ as non-compliant and resulted in blocked network access. This occurred
+ after an external update and rebranding of the antivirus product. With
+ this fix, GlobalProtect accurately identifies the RTP status, ensuring
+ correct compliance enforcement.
+
+ |
+
GPC-26266 |
+
+
+ Fixed an issue where excessive memory consumption occurred when the
+ GlobalProtect app ran for extended periods, which was caused by proxy
+ stream states that were not properly released and WebView2 instances
+ that the GlobalProtect app retained after use. With this fix, the
+ GlobalProtect app now properly releases memory resources.
+
+ |
+
GPC-26152 |
+
+
+ Fixed an issue where GlobalProtect users would fail to authenticate
+ when their usernames contained certain special characters, which led
+ to a mismatch in character interpretation during the authentication
+ process. With this fix, GlobalProtect now correctly processes
+ usernames containing these special characters, allowing for successful
+ authentication.
+
+ |
+
GPC-26092 |
+
+
+ Fixed an issue where GlobalProtect remained in a "Connecting" state
+ after attempting to reconnect, which occurred when the client stalled
+ during SAML authentication. With this fix, the GlobalProtect client
+ now proceeds correctly with the connection or disconnection process.
+
+ |
+
GPC-25996 |
+
+
+ Fixed an issue where GlobalProtect target gateway selection reverted
+ to the default after a few seconds. With this fix, the target gateway
+ selection now persisted as configured.
+
+ |
+
GPC-25978 |
+
+
+ Fixed an issue where Enhanced Split Tunneling (EST) configurations did
+ not apply when the EST XML file was hosted on a web server that
+ rejected the HTTP method used for the download, which caused the
+ system to revert to the normal split tunnel configuration. With this
+ fix, EST configurations are now correctly applied.
+
+ |
+
GPC-25957 |
+
+
+ Fixed an issue where GlobalProtect client version 6.3.3-915 on macOS
+ 26.x experienced repeated crashes of the PanGPS service process,
+ preventing the GlobalProtect app (PanGPA) from communicating with the
+ service and establishing or maintaining a VPN tunnel. The crash was
+ caused by a null pointer dereference in the
+ CPanMSService::ProcessIntelligentPortal()
+ function when parsing the GeoIP API response from
+ geoip.gpcloudservice.com/getIPLocation. Specifically, if the
+ countryCode field was missing
+ from the JSON response, the function would attempt to access a
+ valuestring without a null check,
+ leading to a crash during sleep/wake and network discovery operations.
+
+ |
+
GPC-25879 |
+
+
+ Fixed an issue where GlobalProtect incorrectly detected an internal
+ network over the tunnel, which happened when SAML authentication timed
+ out during a GlobalProtect gateway switch. With this fix,
+ GlobalProtect accurately determines network connectivity.
+
+ |
+
GPC-25869 |
+
+
+ (macOS clients only) Fixed an issue where GlobalProtect connections
+ would not establish after a reboot, which occurred because the
+ GlobalProtect agent did not start or connect properly. With this fix,
+ GlobalProtect connections establish as expected after a reboot.
+
+ |
+
GPC-25866 |
+
+
+ Fixed an issue where the system did not send a Host Information
+ Profile (HIP) report when real-time protection was detected as enabled
+ after an initial detection of it being disabled immediately following
+ power-on, which occurred because the system created a new HIP report
+ but did not send it. With this fix, the system correctly sends HIP
+ reports when the real-time protection status changes.
+
+ |
+
GPC-25797 |
+
+
+ Fixed an issue where GlobalProtect connections would show a connected
+ status but would not pass traffic. Attempts to refresh the connection
+ would also fail, preventing further connection establishment for a
+ period. With this fix, GlobalProtect connections properly pass traffic
+ when showing a connected status.
+
+ |
+
GPC-25792 |
+
+
+ Fixed an issue where GlobalProtect would not reconnect when Disable
+ Local Subnet Access (DLSA) was handling dual Network Interface Cards
+ (NICs) if the gateway IP was not explicitly added to split routing,
+ which occurred because the previous implementation required the
+ gateway IP to be known and configured for split routing in such
+ scenarios. With this fix, DLSA now handles dual NIC scenarios without
+ requiring the gateway IP to be added to split routing.
+
+ |
+
GPC-25731 |
+
+
+ Fixed an issue where GlobalProtect split-tunnel configurations did not
+ correctly exclude multicast IP addresses. With this fix, multicast IP
+ addresses are excluded as configured.
+
+ |
+
GPC-25511 |
+
+
+ Fixed an issue where macOS GlobalProtect clients running version
+ 6.2.8-h7 experienced a failure in IPv6 routing and traffic flow
+ through the VPN tunnel. This occurred because the GlobalProtect client
+ did not correctly install IPv6 routes when the gateway's Fully
+ Qualified Domain Name (FQDN) lacked an AAAA DNS record, leading to an
+ empty remoteHostV6 variable and the IPv6 system configuration being
+ skipped, even when the gateway assigned an IPv6 tunnel IP and provided
+ access routes.
+
+ |
+
GPC-25484 |
+
+
+ Fixed an issue where the GlobalProtect Agent software (versions 6.2.8
+ H4, 6.2.8 H7, and 6.3.3) would crash, disconnect from the VPN, and
+ restart when a user clicked outside the 'Add Portal Address' window
+ while it was open.
+
+ |
+
GPC-25459 |
+
+
+ Fixed an issue where GlobalProtect exclude routes were not installed
+ correctly on Windows endpoints. With this fix, exclude routes install
+ as expected.
+
+ |
+
GPC-25444 |
+
+
+ Fixed an issue where GlobalProtect clients on macOS would display a
+ "Portal not found" or "Could not connect to Authentication server"
+ error on the first connection attempt to the GlobalProtect portal
+ after an upgrade or system reboot, requiring a second attempt to
+ successfully connect.
+
+ |
+
GPC-25425 |
+
+
+ (GlobalProtect client on Windows 11 only) Fixed an issue where the
+ GlobalProtect client window displayed a blank screen, which prevented
+ the connection status from appearing. This issue occurred
+ intermittently, particularly after the computer woke up. With this
+ fix, the client window displays the connection status as expected.
+
+ |
+
GPC-25396 |
+
+
+ Fixed an issue where macOS GlobalProtect clients lost internet
+ connectivity after switching between different GlobalProtect portals.
+ This occurred because the client retained incorrect Domain Name System
+ (DNS) server assignments from the previously connected portal, which
+ prevented successful name resolution. With this fix, the client
+ properly updates DNS settings when switching portals.
+
+ |
+
GPC-25392 |
+
+
+ Fixed an issue where GlobalProtect Agent (PanGPA) version 6.3.3-h4 on
+ client devices was crashing multiple times per week with
+ ntdll.dll as the faulting module,
+ even when the client was operating under normal conditions.
+
+ |
+
GPC-25286 |
+
+
+ Fixed an issue where importing a self-signed root certificate into the
+ user trust store through the GlobalProtect (GP) portal's
+ Agent -> Trusted Root CA -> install in local root
+ certificate store
+ option would not complete, which occurred when strict certificate
+ checking options were enabled, even if the GlobalProtect portal's own
+ certificate was trusted. With this fix, the import process completes
+ as expected under these conditions.
+
+ |
+
GPC-25221 |
+
+
+ Fixed an issue where the Real Time protection status for Carbon Black
+ Cloud Sensor was displayed as 'n/a', which occurred even after the
+ sensor product was correctly detected. With this fix, the Real Time
+ protection status is now correctly recognized and populated.
+
+ |
+
GPC-25121 |
+
+
+ Fixed an issue where the GlobalProtect DNS proxy Network Extension on
+ macOS endpoints failed to start due to retaining an incorrect Process
+ ID (PID) for the GlobalProtect app (PanGPA) after PanGPA restarted.
+ This prevented split-tunnel exclude applications from functioning
+ correctly.
+
+ |
+
GPC-24827 |
+
+
+ Fixed an issue where, on GlobalProtect client version 6.2.8-h3, HIP
+ checks for CrowdStrike Falcon or Microsoft/Windows Defender
+ intermittently took longer than expected to complete, sometimes
+ exceeding the default 20-second limit. This resulted in partial HIP
+ reports being sent to the gateway, causing connectivity issues for
+ users accessing internal resources or the internet.
+
+ |
+
GPC-24587 |
+
+
+ Fixed an issue where GlobalProtect client version 6.2.8, when
+ installed in FIPS-CC mode on client machines with AMD chipsets, failed
+ with an error message indicating that the CPU does not support
+ RDSEED/RDRAND instructions. This occurred because the openssl library
+ was built with the RDCPU flag, leading to an incorrect assessment of
+ CPU capabilities on AMD platforms.
+
+ |
+
GPC-24138 |
+
+
+ Fixed an issue where GlobalProtect Portal and Gateway logs (pan_gp_event.log) did not provide detailed error messages when client certificate
+ authentication failed during the pre-logon stage, particularly when
+ the private key was stored on a Trusted Platform Module (TPM).
+
+ |
+
GPC-23848 |
+
+
+ Fixed an issue where the GlobalProtect client (version 6.2.8-243) on
+ macOS 15.5 (Build 24F74) caused excessive memory consumption, with the
+ GlobalProtect process consuming up to 27 GB of memory, due to improper
+ memory management related to autoreleasepool.
+
+ |
+
GPC-23174 |
+
+
+ Fixed an issue where the GlobalProtect failed to detect DNS during the
+ Network Detection stage, causing the GlobalProtect app to stop
+ working.
+
+ |
+
GPC-22862 |
+
+
+ Fixed an issue where the GlobalProtect client was unable to
+ successfully upload "Report an issue" logs (GPLogs zip) to the Cloud
+ Device Logging (CDL) service. This occurred because the GlobalProtect
+ client was triggering a 30-second timeout when the Google Cloud
+ Platform (GCP) was not responding, leading to upload failures.
+
+ |
+
GPC-22392 |
+
+
+ Fixed an issue where the GlobalProtect client for Windows (Spanish
+ version) displayed an incorrect translation, "Logs ficticios" (Fake
+ logs), for the log collection option in the Settings >
+ Troubleshooting menu.
+
+ |
+
|
+ Issue ID
+ |
+
+ Description
+ |
+
|---|---|
GPC-27119 |
+
+
+ (Windows clients only) Fixed an issue where, after waking from Modern
+ Standby in Always-On Hybrid mode with an expired Explicit Proxy (EP)
+ token, GlobalProtect moved to an "Enabled" (proxy-only) state instead
+ of returning to a "Connected" (tunnel) state following successful SAML
+ re-authentication. This occurred because the portal refresh process
+ incorrectly triggered a tunnel teardown while the VPN was already
+ connected. With this fix, GlobalProtect correctly reconnects and
+ reaches the "Connected" state after Modern Standby wake and
+ re-authentication.
+
+ |
+
|
+ GPC-27179
+ |
+
+
+ Fixed an issue where GlobalProtect portal registration was prevented
+ during SAML authentication hand-off, which caused agents to remain
+ disconnected despite successful authentication with an identity
+ provider. This occurred because an internal data buffer became
+ corrupted during the authentication token hand-off, which led to the
+ loss of session identity. With this fix, the authentication token is
+ correctly processed, allowing agents to register with the portal.
+
+ |
+
|
+ GPC-27177
+ |
+
+
+ Fixed an issue where GlobalProtect Host Information Profile (HIP)
+ reports had an invalid XML format. With this fix, HIP reports are
+ generated with the correct XML structure.
+
+ |
+
|
+ Issue ID
+ |
+
+ Description
+ |
+
|---|---|
GPC-27851 |
+
+
+ Fixed an issue where GlobalProtect could not connect after an upgrade,
+ which occurred because the GlobalProtect service sent portal
+ configuration and gateway authentication requests to the portal's
+ connected IP address instead of its fully qualified domain name
+ (FQDN), causing certificate verification to not succeed. Users
+ encountered the error "The network connection is unreachable or the
+ gateway is unresponsive. Check the network connection and reconnect."
+ With this fix, GlobalProtect correctly routes requests to the portal
+ FQDN and connects as expected.
+
+ |
+
GPC-27846 |
+
+
+ (macOS devices) Fixed an issue where GlobalProtect authentication did
+ not complete during the portal sign-in process, which caused users to
+ encounter an "Authentication Failed" error. This occurred because the
+ GlobalProtect service stopped unexpectedly during SAML authentication.
+ With this fix, GlobalProtect authenticates and connects as expected.
+
+ |
+
GPC-27555 |
+
+
+ Fixed an issue where GlobalProtect user connections were disconnecting
+ after one hour, which occurred when the portal refresh process
+ initiated and the client encountered an error during its network
+ configuration update. With this fix, GlobalProtect connections now
+ refresh as expected without interruption.
+
+ |
+
GPC-27513 |
+
+
+ Fixed an issue where GlobalProtect intermittently did not detect the
+ Real-time Protection (RTP) state of Windows Defender, which prevented
+ authorized users from accessing resources when Host Information
+ Profile (HIP) policies were applied. This behavior occurred after an
+ upgrade of Windows Defender. With this fix, GlobalProtect properly
+ detects the RTP state of Windows Defender.
+
+ |
+
GPC-27431 |
+
+
+ Fixed an issue where the GlobalProtect app service did not start on
+ Windows 11 (Traditional Chinese Edition), which prevented the agent
+ from launching and displayed a memory read error. With this fix, the
+ GlobalProtect app now starts successfully on this operating system
+ configuration.
+
+ |
+
GPC-27408 |
+
+
+ Fixed an issue where, on Mac computers, previously configured proxy
+ settings were not restored after a fresh installation of GlobalProtect
+ 6.3.3-830 or 6.3.3-H14, which occurred because a necessary
+ configuration file for proxy information was not installed during the
+ initial setup. With this fix, previously configured proxy settings are
+ correctly restored.
+
+ |
+
GPC-27403 |
+
+
+ (GlobalProtect client on Windows devices using SmartCard
+ authentication) Fixed an issue where the GlobalProtect client would
+ unexpectedly terminate and fail to establish a connection, which was
+ caused by inter-process communication issues during the authentication
+ process. With this fix, the client connects as expected.
+
+ |
+
GPC-27394 |
+
+
+ Fixed an issue where GlobalProtect gateway certificate verification
+ would fail after a software upgrade, which prevented connections to
+ the gateway. With this fix, gateway certificate verification proceeds
+ as expected.
+
+ |
+
GPC-27281 |
+
+
+ Fixed an issue where GlobalProtect Host Information Profile (HIP)
+ checks intermittently failed with an "Invalid authentication cookie"
+ error after machines woke up from modern standby, which caused traffic
+ to incorrectly match policies without HIP requirements or fall through
+ to default rules. With this fix, HIP checks proceed as expected, and
+ traffic correctly matches policies based on HIP requirements.
+
+ |
+
GPC-27149 |
+
+
+ Fixed an issue where GlobalProtect connections would intermittently
+ stall, preventing internet access. With this fix, GlobalProtect
+ connections establish and maintain properly.
+
+ |
+
GPC-27056 |
+
+
+ Fixed an issue where .pfx and .dat files were removed from the Native
+ store upon reboot.
+
+ |
+
GPC-26994 |
+
+
+ Fixed an issue where Host Information Profile (HIP) reports were not
+ sent to the gateway intermittently, which resulted in issues with
+ user-IP mapping. With this fix, HIP reports are sent consistently,
+ ensuring accurate user-IP mapping.
+
+ |
+
GPC-26933 |
+
+
+ (macOS endpoints only) Fixed an issue where the GlobalProtect app
+ would not connect to the GlobalProtect service after a macOS upgrade
+ and a sleep-wake event. With this fix, the GlobalProtect app connects
+ as expected.
+
+ |
+
GPC-26928 |
+
+
+ Fixed an issue where the GlobalProtect client would remain in a
+ connecting state after an initial authentication attempt failed, and
+ would not attempt to connect to alternate gateways. With this fix, the
+ GlobalProtect client now properly transitions out of the connecting
+ state and attempts alternate gateways when authentication fails.
+
+ |
+
GPC-26842 |
+
+
+ Fixed an issue where GlobalProtect Host Information Profile (HIP)
+ checks for FileVault disk encryption produced incorrect reports on
+ certain macOS 27 version, which led to failed HIP checks and also
+ resulted in the macOS version being unexpectedly included in the
+ FileVault section of the report. With this fix, Host Information
+ Profile checks for FileVault disk encryption now populate correctly,
+ and the macOS version is no longer included in the FileVault section
+ of the report.
+
+ |
+
GPC-26811 |
+
+
+ (On Ubuntu 20.04 systems) Fixed an issue where the GlobalProtect App
+ user interface would not launch after installation. With this fix, the
+ user interface launches as expected.
+
+ |
+
GPC-26808 |
+
+
+ Fixed an issue where GlobalProtect did not detect a specific version
+ of the Broadcom Endpoint Security Agent (ESA) on macOS endpoints. With
+ this fix, the agent is correctly detected, and administrators can
+ configure policies for it.
+
+ |
+
GPC-26790 |
+
+
+ (macOS devices running GlobalProtect) Fixed an issue where
+ GlobalProtect would not connect, which caused users to encounter a
+ "Could not connect to the GlobalProtect service" error after a macOS
+ update or system reboot. This occurred because the GlobalProtect
+ service would not start or would stop unexpectedly. With this fix,
+ GlobalProtect connects successfully.
+
+ |
+
GPC-26789 |
+
+
+ (GlobalProtect 6.3.3 Linux clients only) Fixed an issue where
+ GlobalProtect clients enforced Federal Information Processing Standard
+ Publication 140-2 Cryptographic Module Validation Program (FIPS-CC)
+ certificate validation despite FIPS-CC mode being disabled, which
+ prevented clients from establishing a connection. With this fix,
+ GlobalProtect clients correctly respect the FIPS-CC setting.
+
+ |
+
GPC-26780 |
+
+
+ (macOS devices only) Fixed an issue where GlobalProtect would get
+ stuck in a connecting state after the device woke from sleep or
+ reconnected to a network, which resulted from GlobalProtect attempting
+ to resolve the gateway's fully qualified domain name (FQDN) using the
+ tunnel's DNS instead of the local internet service provider (ISP) DNS.
+ With this fix, GlobalProtect correctly uses the local ISP DNS for
+ gateway FQDN resolution when disconnected.
+
+ |
+
GPC-26764 |
+
+
+ (GlobalProtect app on macOS devices) Fixed an issue where the
+ GlobalProtect app initiated unexpected portal requests after a manual
+ gateway selection. With this fix, the app behaves as expected after a
+ manual gateway selection.
+
+ |
+
GPC-26699 |
+
+
+ (macOS only) Fixed an issue where the GlobalProtect user interface
+ popover would not dismiss after a successful connection, which
+ occurred because the GlobalProtect menu bar icon became inaccessible
+ when hidden by the operating system. With this fix, the popover
+ automatically dismisses after a successful connection.
+
+ |
+
GPC-26696 |
+
+
+ Fixed an issue where the GlobalProtect Linux client failed to
+ initialize for users with high-range enterprise user IDs (UIDs), which
+ caused the gpa.service systemd
+ unit to drop into a failed state immediately during execution. This
+ occurred because the client introduced a restrictive UID validation
+ that prevented the service from starting if the UID was greater than
+ 60000. With this fix, the GlobalProtect Linux client now supports
+ valid non-system users regardless of their enterprise UID allocation
+ range.
+
+ |
+
GPC-26682 |
+
+
+ Fixed an issue where internet connectivity would stop working on macOS
+ when the GlobalProtect client was connected to certain mobile hotspots
+ that assigned IP addresses from a specific reserved range, which
+ occurred because the GlobalProtect client did not properly process
+ this particular IP address range used in some mobile network
+ environments. With this fix, internet connectivity is maintained in
+ these scenarios.
+
+ |
+
GPC-26657 |
+
+
+ Fixed an issue where the HIP process repeatedly launched in a
+ rapid-fire loop, which triggered alerts. With this fix, the process
+ launches as expected.
+
+ |
+
GPC-26619 |
+
+
+ (GlobalProtect app on macOS only) Fixed an issue where the
+ GlobalProtect app remained in a connecting state for approximately two
+ minutes after a local network-extension or route-change event, which
+ required a restart of the app to recover. With this fix, the
+ GlobalProtect app now connects as expected after such events.
+
+ |
+
GPC-26618 |
+
+
+ (GlobalProtect app on macOS) Fixed an issue where the GlobalProtect
+ app would fail to connect to gateways after a manual gateway
+ selection. With this fix, the GlobalProtect app connects successfully
+ to gateways after manual selection.
+
+ |
+
GPC-26560 |
+
+
+ Fixed an issue where GlobalProtect app connections experienced a delay
+ when Autonomous Digital Experience Management (ADEM) was disabled in
+ the portal, which occurred because the agent continued to search for
+ the ADEM configuration file. With this fix, the agent no longer
+ attempts to locate the ADEM configuration file when ADEM is disabled.
+
+ |
+
GPC-26558 |
+
+
+ Fixed an issue where GlobalProtect App disconnect reason text was
+ truncated in the user interface when the GlobalProtect Portal was
+ configured with a custom disconnect reason, which prevented the full
+ message from being displayed. With this fix, the user interface now
+ properly displays the complete disconnect reason.
+
+ |
+
GPC-26537 |
+
+
+ Fixed an issue where an unauthorized user could disconnect a
+ GlobalProtect connection after interrupting Security Assertion Markup
+ Language (SAML) authentication during a connection refresh. With this
+ fix, the Disconnect button no longer appeared for unauthorized users
+ in this scenario.
+
+ |
+
GPC-26224 |
+
+
+ Fixed an issue where the GlobalProtect client stole focus when a user
+ entered a PIN for PINGID/Security Assertion Markup Language (SAML)
+ authentication. With this fix, the GlobalProtect client no longer
+ unexpectedly takes focus during this authentication process.
+
+ |
+
GPC-26133 |
+
+
+ Fixed an issue where the
+ DisplayVersion registry key for
+ GlobalProtect clients on Windows reported an incomplete version
+ string, which led to other software misidentifying the installed
+ GlobalProtect version. With this fix, the registry key now accurately
+ reflects the full client version.
+
+ |
+
GPC-26088 |
+
+
+ Fixed an issue where the GlobalProtect Enforcer did not unblock
+ network traffic after a GlobalProtect connection was established,
+ which resulted in the blocking of traffic not explicitly excluded from
+ enforcement. With this fix, the GlobalProtect Enforcer now correctly
+ unblocks traffic upon successful GlobalProtect connection.
+
+ |
+
GPC-25840 |
+
+
+ Fixed an issue where applications configured for split tunneling would
+ not function correctly after a network transition. With this fix,
+ applications would function as expected after network changes.
+
+ |
+
GPC-25670 |
+
+
+ Fixed an issue where the GlobalProtect app would intermittently get
+ stuck in a connecting state after a laptop woke up from standby,
+ preventing it from establishing a connection to the gateway. With this
+ fix, the GlobalProtect agent connects successfully.
+
+ |
+
GPC-25575 |
+
+
+ (macOS devices only) Fixed an issue where custom Host Information
+ Profile (HIP) checks did not correctly evaluate certain system
+ configuration parameters, which prevented macOS devices from matching
+ the intended HIP objects. With this fix, HIP checks accurately
+ evaluate the system configuration parameters.
+
+ |
+
GPC-25567 |
+
+
+ Fixed an issue where the GlobalProtect Client would intermittently not
+ complete Kerberos Single Sign-On (SSO) during pre-login. This occurred
+ when the client did not post the Kerberos token back after receiving
+ an initial authentication challenge from the portal, which prompted
+ users for credentials and displayed an error message indicating an
+ unreachable network or unresponsive portal. With this fix, Kerberos
+ SSO now succeeds consistently.
+
+ |
+
GPC-25432 |
+
+
+ (GlobalProtect client on Red Hat Enterprise Linux (RHEL) 8.10 systems)
+ Fixed an issue where the GlobalProtect client would not update the
+ resolv.conf file with configured Domain Name System (DNS) servers,
+ which resulted in internal DNS resolution not functioning correctly.
+ With this fix, the resolv.conf file updates as expected.
+
+ |
+
GPC-25419 |
+
+
+ Fixed an issue where GlobalProtect clients on Linux did not send Host
+ Information Profile (HIP) report checks to internal gateways, which
+ caused IP mappings to time out. With this fix, HIP report checks are
+ sent correctly to internal gateways.
+
+ |
+
GPC-25308 |
+
+
+ Fixed an issue where the GlobalProtect app intermittently stopped
+ transmitting Host Information Profile (HIP) reports, which caused
+ User-ID entries to be cleared and resulted in missing user-to-IP
+ mappings. With this fix, the GlobalProtect app now consistently
+ transmits HIP reports, maintaining accurate user-to-IP mappings.
+
+ |
+
GPC-25219 |
+
+
+ Fixed an issue where users were unable to select the GlobalProtect
+ icon from the status bar on macOS.
+
+ |
+