From e4edafa02069b33e3760fa7cd26bab4b4f415b36 Mon Sep 17 00:00:00 2001 From: Aaron Axvig Date: Mon, 16 Mar 2026 16:42:45 -0500 Subject: [PATCH] Add PAN-OS 11.0 addressed issues --- .../PAN-OS/addressed/11.0.0-h1_2026-03-16.md | 18 + .../PAN-OS/addressed/11.0.0-h2_2026-03-16.md | 43 + .../PAN-OS/addressed/11.0.0-h3_2026-03-16.md | 9 + .../PAN-OS/addressed/11.0.0-h4_2026-03-16.md | 10 + .../PAN-OS/addressed/11.0.0_2026-03-16.md | 143 ++ .../PAN-OS/addressed/11.0.1-h2_2026-03-16.md | 70 + .../PAN-OS/addressed/11.0.1-h3_2026-03-16.md | 43 + .../PAN-OS/addressed/11.0.1-h4_2026-03-16.md | 9 + .../PAN-OS/addressed/11.0.1-h5_2026-03-16.md | 10 + .../PAN-OS/addressed/11.0.1_2026-03-16.md | 570 +++++++ .../PAN-OS/addressed/11.0.2-h1_2026-03-16.md | 52 + .../PAN-OS/addressed/11.0.2-h2_2026-03-16.md | 42 + .../PAN-OS/addressed/11.0.2-h3_2026-03-16.md | 43 + .../PAN-OS/addressed/11.0.2-h4_2026-03-16.md | 9 + .../PAN-OS/addressed/11.0.2-h5_2026-03-16.md | 10 + .../PAN-OS/addressed/11.0.2_2026-03-16.md | 473 ++++++ .../PAN-OS/addressed/11.0.3-h10_2026-03-16.md | 46 + .../PAN-OS/addressed/11.0.3-h12_2026-03-16.md | 40 + .../PAN-OS/addressed/11.0.3-h13_2026-03-16.md | 10 + .../PAN-OS/addressed/11.0.3-h1_2026-03-16.md | 16 + .../PAN-OS/addressed/11.0.3-h3_2026-03-16.md | 91 ++ .../PAN-OS/addressed/11.0.3-h5_2026-03-16.md | 153 ++ .../PAN-OS/addressed/11.0.3_2026-03-16.md | 642 ++++++++ .../PAN-OS/addressed/11.0.4-h1_2026-03-16.md | 9 + .../PAN-OS/addressed/11.0.4-h2_2026-03-16.md | 15 + .../PAN-OS/addressed/11.0.4-h5_2026-03-16.md | 9 + .../PAN-OS/addressed/11.0.4-h6_2026-03-16.md | 10 + .../PAN-OS/addressed/11.0.4_2026-03-16.md | 1327 +++++++++++++++++ .../PAN-OS/addressed/11.0.5-h1_2026-03-16.md | 14 + .../PAN-OS/addressed/11.0.5-h2_2026-03-16.md | 10 + .../PAN-OS/addressed/11.0.5_2026-03-16.md | 399 +++++ .../PAN-OS/addressed/11.0.6-h1_2026-03-16.md | 10 + .../PAN-OS/addressed/11.0.6_2026-03-16.md | 17 + web/data/products.json | 38 + 34 files changed, 4410 insertions(+) create mode 100644 web/data/issues/PAN-OS/addressed/11.0.0-h1_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.0-h2_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.0-h3_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.0-h4_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.0_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.1-h2_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.1-h3_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.1-h4_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.1-h5_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.1_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.2-h1_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.2-h2_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.2-h3_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.2-h4_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.2-h5_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.2_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.3-h10_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.3-h12_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.3-h13_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.3-h1_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.3-h3_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.3-h5_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.3_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.4-h1_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.4-h2_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.4-h5_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.4-h6_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.4_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.5-h1_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.5-h2_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.5_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.6-h1_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/11.0.6_2026-03-16.md diff --git a/web/data/issues/PAN-OS/addressed/11.0.0-h1_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.0-h1_2026-03-16.md new file mode 100644 index 0000000..39ce577 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.0-h1_2026-03-16.md @@ -0,0 +1,18 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.0-h1 +--- + +## PAN-202450 + +Fixed an issue where the +device-client-cert was set to +expire on December 31, 2023. With this fix, the expiration date has +been extended. + +## PAN-198372 + +Fixed an issue where the root-cert was +set to expire on December 31, 2023. With this fix, the expiration +date has been extended. diff --git a/web/data/issues/PAN-OS/addressed/11.0.0-h2_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.0-h2_2026-03-16.md new file mode 100644 index 0000000..877aa36 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.0-h2_2026-03-16.md @@ -0,0 +1,43 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.0-h2 +--- + +## PAN-238792 + +Fixed the following device certificate issues: + +- The firewall was unable to automatically renew the device + certificate. +- Fetching device certificates failed incorrectly with the error + message OTP is not valid. +- Firewalls disconnected from Cortex Data Lake after renewing the + device certificate. +- The device certificate was not correctly generated on the log + forwarding card (LFC). +- WildFire cloud logs did not log thermite certificate usage + status. + +## PAN-237876 + +Extended the firewall Panorama root CA certificate which was +previously set to expire on April 7th, 2024. + +## PAN-231771 + +Fixed an issue where the firewall issued /box/getserv/ requests with +PAN-OS 7.1.0 and did not take device certificates. + +## PAN-227568 + +When a device certificate is installed, renewed, or removed, the +firewall will reconnect to the WildFire cloud to use the newest +certificate. + +## PAN-215576 + +Fixed an issue where the userID-Agent +and TS-Agent certificates were set to +expire on November 18, 2024. With this fix, the expiration date has +been extended to January 2032. diff --git a/web/data/issues/PAN-OS/addressed/11.0.0-h3_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.0-h3_2026-03-16.md new file mode 100644 index 0000000..9ff729b --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.0-h3_2026-03-16.md @@ -0,0 +1,9 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.0-h3 +--- + +## PAN-252214 + +A fix was made to address CVE-2024-3400. diff --git a/web/data/issues/PAN-OS/addressed/11.0.0-h4_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.0-h4_2026-03-16.md new file mode 100644 index 0000000..e70d748 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.0-h4_2026-03-16.md @@ -0,0 +1,10 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.0-h4 +--- + +## PAN-272809 + +A fix was made to address CVE-2024-0012 (PAN-SA-2024-0015) and +CVE-2024-9474. diff --git a/web/data/issues/PAN-OS/addressed/11.0.0_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.0_2026-03-16.md new file mode 100644 index 0000000..40a9a39 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.0_2026-03-16.md @@ -0,0 +1,143 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.0 +--- + +## PAN-231823 + +A fix was made to address CVE-2024-5916. + +## PAN-207505 + +Fixed an issue where Email schedules (MonitorPDF ReportsEmail Scheduler) were not supported for SaaS Application Usage (MonitorPDF ReportsSaaS Application Usage) reports. + +## PAN-204615 + +Fixed an issue where BGP sessions could flap even when an unrelated +configuration was committed. This resulted in the BGP session going +down and getting established again. As a result, BGP routes were +exchanged again, which could lead to momentary traffic disruption if +BGP routes were in use for establishing traffic. + +## PAN-202783 + +```caveat +PA-7000 Series firewalls with 100G NPC (Network Processing Cards) only +``` + +Fixed an issue where sudden, +large bursts of traffic destined for an interface that was down +caused packet buffers to fill, which stalled path monitor heartbeat +packets. + +## PAN-202535 + +Fixed an issue where the Device Telemetry +configuration for a region was unable to be set or edited via the +web interface. + +## PAN-199726 + +Fixed an issue with firewalls in HA configurations +where both firewalls responded with gARP messages after a switchover. + +## PAN-199654 + +Fixed an issue where ACC reports did not +work for custom RBAC users when more than 12 access domains were +associated with the username. + +## PAN-198733 + +```caveat +PA-5450 firewalls only +``` + +Fixed +an issue where tcpdump was hardcoded +to eth0 instead of bond0. + +## PAN-198332 + +```caveat +PA-5400 Series only +``` + +Fixed an +issue where swapping Network Processing Cards (NPCs) caused high +root partition use. + +## PAN-198244 + +Fixed an issue where using the load config partial CLI +command to x-paths removed address object entries from address groups. + +## PAN-197383 + +Fixed an issue where, after upgrading to +PAN-OS 10.2 release, the firewall ran a RAID rebuild for the log +disk after ever every reboot. + +## PAN-197341 + +Fixed an issue on Panorama where, when you created multiple device group objects with the same +name in the shared device group and any additional device groups (PanoramaDevice Groups) under the same device group hierarchy that were used +in one or more policies, renaming the object with a shared name in +any device group caused the object name to change in the policies +that it was used in. This issue occurred with device group objects +that were referenced in a Security policy rule. + +## PAN-196558 + +Fixed an issue where IP address tag policy +updates were delayed. + +## PAN-196398 + +```caveat +PA-7000 Series SMC-B firewalls only +``` + +Fixed an issue where the firewall did not capture data when the +active management interface was MGT-B. + +## PAN-194615 + +Fixed an issue where the packet broker session +timeout value did not match the master sessions timeout value after +the firewall received a TCP FIN or RST packet. The fix ensures that +Broker session times out within 1 second after the master session +timed out. + +## PAN-194152 + +```caveat +PA-5410, PA-5420, PA-5430, and PA-5440 firewalls in HA configurations only +``` + +Fixed an issue where HA1-A +and HA1-B port information didn't match to front panel mappings. + +## PAN-189270 + +Fixed an issue that caused a memory leak +on the reportd process. + +## PAN-188096 + +```caveat +VM-Series firewalls only +``` + +Fixed +an issue where, on firewalls licensed with Software NGFW Credit +(VM-FLEX-4 and higher), HA clustering was unable to be established. + +## PAN-171714 + +Fixed an issue where, when NetBIOS format +(domain\user) was used for the IP address-to-username mapping and +the firewall received the group mapping information from the Cloud +Identity Engine, the firewall did not match the user to the correct +group. diff --git a/web/data/issues/PAN-OS/addressed/11.0.1-h2_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.1-h2_2026-03-16.md new file mode 100644 index 0000000..5d556c1 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.1-h2_2026-03-16.md @@ -0,0 +1,70 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.1-h2 +--- + +## PAN-217431 + +```caveat +PA-5400 Series firewalls with DPC (Data Processing Cards) only +``` + +Fixed an issue with slot 2 DPCs where URL filtering +did not work as expected after upgrading to PAN-OS 10.1.9. + +## PAN-216710 + +Fixed an issue with firewalls in active/active high availability (HA) +configurations where GlobalProtect disconnected when the original +suspected Active-Primary firewall became Active-Secondary. + +## PAN-215899 + +Fixed an issue with Panorama appliances in HA configurations where +configuration synchronization between the HA peers failed. + +## PAN-215496 + +Fixed an issue where 100G ports did not come up with BIDI QSFP +modules. + +## PAN-215461 + +Fixed an issue where the packet descriptor leaked over time with GRE +tunnels and keepalives. + +## PAN-211870 + +Fixed an issue where path monitoring failure occurred, which caused +high availability failover. + +## PAN-211519 + +Fixed an issue where RTP/RTCP packets were dropped for SIP calls by +SIP ALG when the source NAT translation type was persistent +Dynamic IP And Port. + +## PAN-210607 + +Fixed an issue where enabling Inline Cloud Analysis on Anti-Spyware, +Vulnerability Protection, or URL Filtering Security profiles caused +the dataplane to stop responding. + +## PAN-208189 + +Fixed an issue when traffic failed to match and reach all +destinations if a Security policy rule includes FQDN objects that +resolve to two or more IP addresses. + +## PAN-206007 + +Fixed an issue where a debug command generated an incomplete core +file. + +## PAN-202450 + +Fixed an issue where the +device-client-cert was set to +expire on December 31, 2023. With this fix, the expiration date has +been extended. diff --git a/web/data/issues/PAN-OS/addressed/11.0.1-h3_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.1-h3_2026-03-16.md new file mode 100644 index 0000000..66a5593 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.1-h3_2026-03-16.md @@ -0,0 +1,43 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.1-h3 +--- + +## PAN-238792 + +Fixed the following device certificate issues: + +- The firewall was unable to automatically renew the device + certificate. +- Fetching device certificates failed incorrectly with the error + message OTP is not valid. +- Firewalls disconnected from Cortex Data Lake after renewing the + device certificate. +- The device certificate was not correctly generated on the log + forwarding card (LFC). +- WildFire cloud logs did not log thermite certificate usage + status. + +## PAN-237876 + +Extended the firewall Panorama root CA certificate which was +previously set to expire on April 7th, 2024. + +## PAN-231771 + +Fixed an issue where the firewall issued /box/getserv/ requests with +PAN-OS 7.1.0 and did not take device certificates. + +## PAN-227568 + +When a device certificate is installed, renewed, or removed, the +firewall will reconnect to the WildFire cloud to use the newest +certificate. + +## PAN-215576 + +Fixed an issue where the userID-Agent +and TS-Agent certificates were set to +expire on November 18, 2024. With this fix, the expiration date has +been extended to January 2032. diff --git a/web/data/issues/PAN-OS/addressed/11.0.1-h4_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.1-h4_2026-03-16.md new file mode 100644 index 0000000..68ebd18 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.1-h4_2026-03-16.md @@ -0,0 +1,9 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.1-h4 +--- + +## PAN-252214 + +A fix was made to address CVE-2024-3400. diff --git a/web/data/issues/PAN-OS/addressed/11.0.1-h5_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.1-h5_2026-03-16.md new file mode 100644 index 0000000..1346237 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.1-h5_2026-03-16.md @@ -0,0 +1,10 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.1-h5 +--- + +## PAN-272809 + +A fix was made to address CVE-2024-0012 (PAN-SA-2024-0015) and +CVE-2024-9474. diff --git a/web/data/issues/PAN-OS/addressed/11.0.1_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.1_2026-03-16.md new file mode 100644 index 0000000..eb12b6d --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.1_2026-03-16.md @@ -0,0 +1,570 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.1 +--- + +## PAN-231823 + +A fix was made to address CVE-2024-5916. + +## PAN-216656 + +Fixed an issue where the firewall was unable to fully process the user list from a child group when the child group contained more than 1,500 users. + +## PAN-215911 + +Fixed an issue that resulted in a race condition, which caused the configd process +to stop responding. + +## PAN-215488 + +Fixed an issue where an expired Trusted Root CA was used to sign the forward proxy leaf certificate during SSL Decryption. + +## PAN-210561 + +Fixed an issue where the all_task process repeatedly restarted due to missed heartbeats. + +## PAN-210513 + +Fixed an issue where Captive Portal authentication via SAML did not work. + +## PAN-210481 + +Fixed an issue where botnet reports were not generated on the firewall. + +## PAN-210449 + +Fixed an issue where the value for shared objects used in policy rules were not displayed on multi-vsys firewalls when pushed from Panorama. + +## PAN-210331 + +Fixed an issue where the firewall did not send device telemetry files to Cortex Data Lake with the error message send the file to CDL receiver failed. + +## PAN-210327 + +```caveat +PA-5200 Series firewalls only +``` + +Fixed an issue where upgrading to PAN-OS 10.1.7, an internal loop caused an increase in the packets received per second. + +## PAN-210237 + +Fixed an issue where system logs generated by Panorama for commit operations showed the severity as High instead of Informational. + +## PAN-210080 + +Fixed an issue where the useridd process stopped responding when add and delete member parameters in an incremental sync query were empty. + +## PAN-209799 + +Fixed an issue where logging was not disabled on passive nodes, which caused the logrcvr to stop responding. + +## PAN-209491 + +Fixed an issue on the web interface where the Session Expire Time displayed a past date if the device time was in December. + +## PAN-209069 + +Fixed an issue where IP addresses in the X-Forwarded-For (XFF) field were not logged when the IP address contained an associated port number. + +## PAN-209036 + +Fixed an issue where the dataplane restarted, which led to slot failures occurring and a core file being generated. + +## PAN-208987 + +```caveat +PA-5400 Series only +``` + +Fixed an issue where packets were not transmitted from the firewall if its fragments were received on different slots. This occurred when aggregate ethernet (AE) members in an AE interface were placed on a different slot. + +## PAN-208922 + +A fix was made to address an issue where an authenticated +administrator was able to commit a specifically created +configuration to read local files and resources from the system +(CVE-2023-38046). + +## PAN-208930 + +```caveat +PA-7000 Series firewalls only +``` + +Fixed an issue where auto-tagging in log forwarding did not work. + +## PAN-208902 + +Fixed an issue where, when a client sent a TCP/FIN packet, the firewall displayed the end reason as aged-out instead of tcp-fin. + +## PAN-208724 + +Fixed an issue where port pause frame settings did not work as expected and incorrect pause frames occurred. + +## PAN-208718 + +Additional debug information was added to capture internal details during traffic congestion. + +## PAN-208711 + +```caveat +PA-5200 Series firewalls only +``` + +The CLI command debug dataplane set pow no-desched yes/no was added to address an issue where the all_pktproc process stopped responding and caused traffic issues. + +## PAN-208537 + +Fixed an issue where the licensed-device-capacity was reduced when multiple device management license key files were present. + +## PAN-208525 + +Fixed an issue where Security policy rules with user groups did not match when Kerberos authentication was configured for explicit proxy. + +## PAN-208485 + +Fixed an issue where NAT policies were not visible on the CLI if they contained more than 32 characters. + +## PAN-208343 + +Fixed an issue where telemetry regions were not visible on Panorama. + +## PAN-208157 + +Fixed an issue where malformed hints sent from the firewall caused the logd process to stop responding on Panorama, which caused a system reboot into maintenance mode. + +## PAN-207940 + +Fixed an issue where platforms with RAID disk checks were performed weekly, which caused logs to incorrectly state that RAID was rebuilding. + +## PAN-207740 + +Fixed an issue that resulted in a race condition, which caused the configd process to stop responding. + +## PAN-207738 + +Fixed an issue where the ocsp-next-update-time CLI command did not execute for leaf certificates with certificate chains that did not specify OCSP or CRL URLs. As a result, the next update time was 60 minutes even if a different time was set. + +## PAN-207663 + +Fixed a Clientless VPN issue where JSON stringify caused issues with the application rewrite. + +## PAN-207629 + +Fixed an issue where a selective push to firewalls failed if the +firewalls were enabled with multiple vsys and the push scope +contained shared objects in device groups. + +## PAN-207610 + +```caveat +PA-5200 Series and PA-7000 Series firewalls only +``` + +Fixed an issue where Log Admin Activity was not visible on the web interface. + +## PAN-207601 + +Fixed an issue where URL cloud connections were unable to resolve the proxy server hostname. + +## PAN-207426 + +Fixed an issue where a selective push did not include the Share Unused Address and Service Objects with Devices option on Panorama, which caused the firewall to not receive the objects during the configuration push. + +## PAN-207400 + +Fixed an issue on Octeon based platforms where fragmented VLAN tagged packets dropped on an aggregate interface. + +## PAN-207390 + +Fixed an issue where, even after disabling Telemetry, Telemetry system logs were still generated. + +## PAN-207260 + +A commit option was enabled for Device Group and Template administrators after a password change. + +## PAN-207045 + +```caveat +PA-800 Series firewalls only +``` + +Fixed an issue where PAN-SFP-SX transceivers used on ports 5 to 8 did not renegotiate with peer ports after a reload. + +## PAN-206963 + +```caveat +M-700 Appliances only +``` + +A CLI command was added to check the status of each physical port of a bond1 interface. + +## PAN-206858 + +Fixed an issue where a segmentation fault occurred due to the useridd process being restarted. + +## PAN-206755 + +Fixed an issue when a scheduled multi-device group push occurred, the configd process stopped responding, which caused the push to fail. + +## PAN-206684 + +```caveat +PA-7000 Series firewalls with Log Forwarding Cards (LFCs) only +``` + +Fixed an issue where, after upgrading the firewall from a PAN-OS 10.0 release to a PAN-OS 10.1 release, the firewall did not duplicate logs to local log collectors or to Cortex Data Lake when a device certificate was already installed. + +## PAN-206658 + +Fixed a timeout issue in the Intel ixgbe driver that resulted in internal path monitoring failure. + +## PAN-206466 + +Fixed an issue where the push scope was displaying duplicate shared objects for each device group that were listed under the shared-object group. + +## PAN-206393 + +```caveat +PA-5280 firewalls only +``` + +Fixed an issue where memory allocation errors caused decryption failures that disrupted traffic with SSL forward proxy enabled. + +## PAN-206382 + +Fixed an issue where authentication sequences were not populated in the drop down when selecting authentication profiles during administrator creation in a template. + +## PAN-206251 + +```caveat +PA-7000 Series firewalls with Log Forwarding Cards (LFCs) only +``` + +Fixed an issue where the logrcvr process did not send the system-start SNMP trap during startup. + +## PAN-206233 + +Fixed an issue where the pan_comm process stopped responding when a content update and a cloud application update occurred at the same time. + +## PAN-206128 + +```caveat +PA-7000 Series firewalls with NPCs (Network Processing Cards) only +``` + +Improved debugging capability for an issue where the firewall restarted due to heartbeat failures and then failed with the following error message: Power not OK. + +## PAN-206069 + +Fixed an issue where the firewall was unable to boot up on older Intel CPUs. + +## PAN-206017 + +Fixed an issue where the show dos-protection rule command displayed a character limit error. + +## PAN-206005 + +```caveat +PA-1400 Series, PA-3400 Series, and PA-5440 firewalls only +``` + +Fixed an issue where the +l7_misc memory pool was undersized +and caused connectivity loss when the limit was reached. + +## PAN-205877 + +```caveat +PA-5450 firewalls only +``` + +Added debug commands for an issue where a MAC address flap occurred on a neighbor firewall when connecting both MGT-A and MGT-B interfaces. + +## PAN-205829 + +Fixed an issue where logs did not display Host-ID details for GlobalProtect users despite having a quarantine Security policy rule. This occurred due to a missed local cache lookup. + +## PAN-205804 + +Fixed an issue on Panorama where a WildFire scheduled update for managed devices triggered multiple UploadInstall jobs per minute. + +## PAN-205729 + +```caveat +PA-3200 Series and PA-7000 Series firewalls only +``` + +Fixed an issue where the CPLD watchdog timeout caused the firewall to reboot unexpectedly. + +## PAN-205699 + +Fixed an issue where the cloud plugin configuration was automatically deleted from Panorama after a reboot or a configd process restart. + +## PAN-205698 + +Fixed an issue where GlobalProtect authentication did not work on Apple MacOS devices when the authentication method used was CIE with SAML Authentication. + +## PAN-205590 + +Fixed an issue where the fan tray fault LED light was on even though no alarm was reported in the system environment. + +## PAN-205453 + +Fixed an issue where running reports or queries under a user group caused the reportd process to stop responding. + +## PAN-205396 + +Fixed an issue where SD-WAN adaptive SaaS path monitoring did not work correctly during a next hop link down failure. + +## PAN-205260 + +Fixed an issue where there was an IP address conflict after a reboot due to a transaction ID collision. + +## PAN-205255 + +Fixed a rare issue that caused the dataplane to restart unexpectedly. + +## PAN-205231 + +Fixed an issue where a commit operation remained at 55% for longer than expected if more than 7,500 Security policy rules were configured. + +## PAN-205211 + +Fixed an issue where the reportd process stopped responding while querying logs (Monitor > Logs > ). + +## PAN-205096 + +Fixed an issue where promoted sessions were not synced with all cluster members in an HA cluster. + +## PAN-204749 + +Fixed an issue where sudden, large bursts of traffic destined for an interface that was down caused packet buffers to fill, which stalled path monitor heartbeat packets. + +## PAN-204581 + +Fixed an issue where, when accessing a web application via the GlobalProtect Clientless VPN, the web application landing page continuously reloaded. + +## PAN-204575 + +```caveat +PA-7000 Series firewalls with Log Forwarding Cards (LFCs) only +``` + +Fixed an issue where the firewall did not forward logs to the log collector. + +## PAN-204572 + +Fixed an issue where python scripts were not working as expected. + +## PAN-204456 + +Fixed an issue related to the logd process that caused high memory consumption. + +## PAN-204335 + +Fixed an issue where Panorama became unresponsive, and when refreshed, the error 504 Gateway not Reachable was displayed. + +## PAN-203964 + +```caveat +Firewalls in FIPS-CC mode only +``` + +Fixed an issue where the firewall went into maintenance mode due to downloading a corrupted software image, which resulted in the error message FIPS-CC failure. Image File Authentication Error. + +## PAN-203851 + +Fixed an issue with firewalls in HA configurations where host information profile (HIP) sync did not work between peer firewalls. + +## PAN-203681 + +```caveat +Panorama appliances in FIPS-CC mode only +``` + +Fixed an issue where a leaf certificate was unable to be imported into a template stack. + +## PAN-203663 + +Fixed an issue where administrators were unable to change the password of a local database for users configured as a local admin user via an authentication profile. + +## PAN-203453 + +Fixed an issue on Panorama where the log query failed due to a high number of User-ID redistribution messages. + +## PAN-203430 + +Fixed an issue where, when the User-ID agent had collector name/secret configured, the configuration was mandatory on clients on PAN-OS 10.0 and later releases. + +## PAN-203339 + +Fixed an issue where services failed due to the RAID rebuild not being completed on time. + +## PAN-203147 + +```caveat +Firewalls in FIPS-CC mode only +``` + +Fixed an issue where the firewall unexpectedly rebooted when downloading a new PAN-OS software image. + +## PAN-203137 + +```caveat +PA-5450 firewalls only +``` + +Fixed an issue where HSCI ports did not come up when QSFP DAC cables were used. + +## PAN-202543 + +An enhancement was made to improve path monitor data collection by verifying the status of the control network. + +## PAN-202248 + +Fixed an issue where, due to a tunnel content inspection (TCI) policy match, IPSec traffic did not pass through the firewall when NAT was performed on the traffic. + +## PAN-201701 + +Fixed an issue where the firewall generated system log alerts if the raid for a system or log disk was corrupted. + +## PAN-201580 + +Fixed an issue where the useridd process stopped responding due to an invalid vsys_id request. + +## PAN-200845 + +```caveat +M-600 Appliances in Management-only mode only +``` + +Fixed an issue where XML API queries failed due to the configuration size being larger than expected. + +## PAN-200160 + +Fixed a memory leak issue on Panorama related to the logd process that caused an out-of-memory (OOM) condition. + +## PAN-200116 + +Fixed an issue where Elasticsearch displayed red due to frequent tunnel check failures between HA clusters. + +## PAN-199965 + +Fixed an issue where the reportd process stopped responding on log collectors during query and report operations due to a race condition between request handling threads. + +## PAN-199807 + +Fixed an issue where the dataplane frequently restarted due to high memory usage on wifclient. + +## PAN-196597 + +Fixed an issue where the dnsproxyd process stopped +responding due to corruption. + +## PAN-198306 + +Fixed an issue where the useridd process stopped responding when booting up the firewall. + +## PAN-198266 + +Fixed an issue where, when predicts for UDP packets were created, a configuration change occurred that triggered a new policy lookup, which caused the dataplane stopped responding when converting the predict. This resulted in a dataplane restart. + +## PAN-198038 + +A CLI command was added to address an issue where long-lived sessions were aging out even when there was ongoing traffic. + +## PAN-197872 + +Fixed an issue where the useridd process generated false positive critical errors. + +## PAN-197298 + +Fixed an issue where the audit comment archive for Security rule changes output had overlapping formats. + +## PAN-196410 + +Fixed an issue where you were unable to customize the risk value in Risk-of-app. + +## PAN-195756 + +Fixed an issue that caused an API request timeout when parsing requests using large header buffers. + +## PAN-194805 + +Fixed an issue where scheduled configuration backups to the SCP +server failed with error message No ECDSA host key is +known. + +## PAN-194068 + +```caveat +PA-5200 Series firewalls only +``` + +Fixed an issue where the firewall unexpectedly rebooted with the log message Heartbeat failed previously. + +## PAN-192513 + +Fixed an issue where log migration did not work when converting a Legacy mode Panorama appliance to Log Collector mode. + +## PAN-192282 + +```caveat +PA-415 and PA-445 firewalls only +``` + +Fixed an issue where, in +1G mode, the MGT and Ethernet 1/1 port LEDs incorrectly displayed as +amber instead of green. + +## PAN-191222 + +Fixed an issue where Panorama became inaccessible when after a push to the collector group. + +## PAN-190502 + +Fixed an issue where the Policy filter and Policy optimizer filter were required to have the exact same syntax, including nested conditions with rules that contained more than one tag when filtering via the neq operator. + +## PAN-189335 + +Fixed an issue where the varrcvr process restarted repeatedly, which caused the firewall to restart. + +## PAN-189200 + +Fixed an issue where sinkholes did not occur for AWS Gateway Load Balancer dig queries. + +## PAN-186412 + +Fixed an issue where invalid packet-ptr was seen in work entries. + +## PAN-186270 + +Fixed an issue where, when HA was enabled and a dynamic update schedule was configured, the configd process unexpectedly stopped responding during configuration commits. + +## PAN-183375 + +Fixed an issue where traffic arriving on a tunnel with a bad IP address header checksum was not dropped. + +## PAN-180948 + +Fixed an issue where an external dynamic list fetch failed with the error message Unable to fetch external dynamic list. Couldn't resolve host name. Using old copy for refresh. + +## PAN-179174 + +Fixed an issue where exported PDF report of the ACC was the incorrect color after upgrading from a PAN-OS 10.1 or later release. + +## PAN-178594 + +Fixed an issue where the descriptions of options under the set syslogng ssl-conn-validation CLI command were not accurate. + +## PAN-175142 + +Fixed an issue on Panorama where executing a debug command caused the logrcvr process to stop responding. + +## PAN-170414 + +Fixed an issue related to an OOM condition in the dataplane, which was caused by multiple panio commands using extra memory. diff --git a/web/data/issues/PAN-OS/addressed/11.0.2-h1_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.2-h1_2026-03-16.md new file mode 100644 index 0000000..99acb31 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.2-h1_2026-03-16.md @@ -0,0 +1,52 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.2-h1 +--- + +## PAN-225184 + +Fixed an issue where disk space utilization was higher than expected +due to excessive logging for a KNI: Out of +memory event under a specific traffic load +condition. + +## PAN-222712 + +```caveat +PA-5450 firewalls only +``` + +Fixed a low frequency DPC restart +issue. + +## PAN-221984 + +```caveat +VM-Series firewalls in Microsoft Azure environments only +``` + +Fixed an issue where an interface went down after a hotplug event +and was only recoverable by restarting the firewall. + +## PAN-220921 + +Fixed an issue where return tunnel traffic was dropped with the +counter flow_tunnel_encap_err when +Enforce Symmetric Return was enabled in a +Policy Based Forwarding rule. + +## PAN-195439 + +```caveat +VM-Series firewalls in Microsoft Azure environments only +``` + +Fixed an issue where the dataplane interface status went down after +a hotplug event triggered by Azure infrastructure. + +## PAN-193004 + +Fixed an issue where /opt/pancfg +partition utilization reached 100%, which caused access to the +Panorama web interface to fail. diff --git a/web/data/issues/PAN-OS/addressed/11.0.2-h2_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.2-h2_2026-03-16.md new file mode 100644 index 0000000..cd08c6e --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.2-h2_2026-03-16.md @@ -0,0 +1,42 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.2-h2 +--- + +## PAN-230250 + +Fixed an issue where selected applications serving partial content +were dropped when Inline Cloud Analysis in Anti-Spyware was +enabled. + +## PAN-223787 + +```caveat +PA-400 Series and PA-1400 Series firewalls only +``` + +Fixed an +issue where commits failed with the error message +Error unserializing profile objects failed to +handle CONFIG_UPDATE_START. + +## PAN-222957 + +Fixed an issue where managed firewalls did not reflect changes pushed +by users that were not in a Superuser role. + +## PAN-218107 + +Fixed an issue with ciphers used for SSH tunnels where packet lengths +were too large, which made the SSH tunnel unstable. + +## PAN-214942 + +Fixed an issue where SD-WAN traffic failed over to a non-member path +after a flap of an SD-WAN virtual interface. + +## PAN-204868 + +Fixed an issue where disk utilization was continuously high due to +the log purger not sufficiently reducing the utilization level. diff --git a/web/data/issues/PAN-OS/addressed/11.0.2-h3_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.2-h3_2026-03-16.md new file mode 100644 index 0000000..b6eb240 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.2-h3_2026-03-16.md @@ -0,0 +1,43 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.2-h3 +--- + +## PAN-238792 + +Fixed the following device certificate issues: + +- The firewall was unable to automatically renew the device + certificate. +- Fetching device certificates failed incorrectly with the error + message OTP is not valid. +- Firewalls disconnected from Cortex Data Lake after renewing the + device certificate. +- The device certificate was not correctly generated on the log + forwarding card (LFC). +- WildFire cloud logs did not log thermite certificate usage + status. + +## PAN-237876 + +Extended the firewall Panorama root CA certificate which was +previously set to expire on April 7th, 2024. + +## PAN-231771 + +Fixed an issue where the firewall issued /box/getserv/ requests with +PAN-OS 7.1.0 and did not take device certificates. + +## PAN-227568 + +When a device certificate is installed, renewed, or removed, the +firewall will reconnect to the WildFire cloud to use the newest +certificate. + +## PAN-215576 + +Fixed an issue where the userID-Agent +and TS-Agent certificates were set to +expire on November 18, 2024. With this fix, the expiration date has +been extended to January 2032. diff --git a/web/data/issues/PAN-OS/addressed/11.0.2-h4_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.2-h4_2026-03-16.md new file mode 100644 index 0000000..b4f5531 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.2-h4_2026-03-16.md @@ -0,0 +1,9 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.2-h4 +--- + +## PAN-252214 + +A fix was made to address CVE-2024-3400. diff --git a/web/data/issues/PAN-OS/addressed/11.0.2-h5_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.2-h5_2026-03-16.md new file mode 100644 index 0000000..0da8c56 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.2-h5_2026-03-16.md @@ -0,0 +1,10 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.2-h5 +--- + +## PAN-272809 + +A fix was made to address CVE-2024-0012 (PAN-SA-2024-0015) and +CVE-2024-9474. diff --git a/web/data/issues/PAN-OS/addressed/11.0.2_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.2_2026-03-16.md new file mode 100644 index 0000000..adb0a2d --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.2_2026-03-16.md @@ -0,0 +1,473 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.2 +--- + +## PAN-231823 + +A fix was made to address CVE-2024-5916. + +## PAN-221708 + +Fixed an issue where temporary files remained under /opt/pancfg/tmp/sw-images/ even after manually uploading the content or AV file to the firewall. + +## PAN-221519 + +```caveat +VM-Series firewalls only +``` + +Fixed an issue where the all_task process stopped responding due to DPDK driver compatibility issues. + +## PAN-219686 + +Fixed an issue where a device group push operation from Panorama +failed with the following error on managed firewalls. + +vsys -> vsys1 -> plugins unexpected +here + +vsys is invalid + +Commit failed + +## PAN-218644 + +Fixed an issue where the firewall generated incorrect VSA attribute codes when radius was configured with EAP based authentication protocols. + +## PAN-218335 + +Fixed an issue with hardware destination MAC filtering on the Log Processing Card (LPC) that caused the logging card interface to be susceptible to unicast flooding. + +## PAN-218264 + +```caveat +PA-3400 and PA-1400 Series firewalls only +``` + +Fixed an issue where packet drops occurred due to slow servicing of internal hardware queries. + +## PAN-217681 + +Fixed an issue caused by out of order TCP segments where the FIN flag and TCP data was truncated in a packet, which resulted in retransmission failure. + +## PAN-217581 + +Fixed an issue where the firewall did not initiate scheduled log uploads to the FTP server. + +## PAN-217493 + +Fixed an issue where superusers with read-only privileges were unable to view SCEP object configurations. + +## PAN-217484 + +Fixed an issue where the rasmgr process used 100% CPU due to a maximum duration timer not being set, which caused the GlobalProtect gateway to be unavailable. + +## PAN-217477 + +Fixed an issue where the drop counter was incremented incorrectly. Drop counter calculations did not account for failures to send out logs from logrcvr/logd to syslog-ng. + +## PAN-217284 + +Fixed an intermittent issue where LACP flap occurred when the LACP transmission rate was set to Fast. + +## PAN-216996 + +Fixed an issue where, after upgrading Panorama to PAN-OS 10.1.9, multiple User-ID alerts were generated every 10 minutes. + +## PAN-216821 + +Fixed an issue where the reportd process stopped responding after upgrading an M-200 +appliance to PAN-OS 11.0.1. + +## PAN-216710 + +Fixed an issue with firewalls in active/active HA configurations where GlobalProtect disconnected when the original suspected Active-Primary firewall became Active-Secondary. + +## PAN-216590 + +Fixed an issue where User-ID logs in Panorama displayed incorrect results for the filter not (ugflags has user-group-found). + +## PAN-216360 + +Fixed an issue on Panorama where No Default Selections under Push to Devices was intermittently deselected after performing a commit operation. + +## PAN-216170 + +```caveat +PA-400 Series firewalls in HA configurations only +``` + +Fixed an +issue where an HA switchover took longer than expected to bring up ports +on the newly active firewall. + +## PAN-216036 + +Fixed an issue where the all_pktproc process stopped responding, which caused the firewall to enter a nonfunctional state. + +## PAN-215911 + +Fixed an issue that resulted in a race condition, which caused the configd process to stop responding. + +## PAN-215899 + +Fixed an issue with Panorama appliances in high availability (HA) configurations where +configuration synchronization between the HA peers failed. + +## PAN-215857 + +Fixed an issue where the option to reboot the entire firewall was visible to vsys admins. + +## PAN-215808 + +Fixed an issue where after upgrading to PAN-OS 10.1, the log-forwarding rate towards the Syslog server was reduced. The overall log-forwarding rate has also been improved. + +## PAN-215780 + +Fixed an issue where, changes to Zone Protection profiles made via XML API were not reflected in the Zone Protection configuration. + +## PAN-215778 + +Fixed an issue where API Get requests for /config timed out due to insufficient buffer size. + +## PAN-215503 + +Fixed a memory related issue where the MEMORY_POOL address was mapped incorrectly. + +## PAN-215496 + +Fixed an issue where 100G ports did not come up with BIDI QSFP modules. + +## PAN-215324 + +```caveat +PA-5400 Series firewalls with Jumbo Frames enabled only +``` + +Fixed an issue with CPU throttling and buffer depletion. + +## PAN-215315 + +Fixed an issue where the dataplane stopped responding due to ager and inline packet processing occurring concurrently on different cores for the same session. + +## PAN-215125 + +Fixed an issue where false negatives occurred for some script samples. + +## PAN-214925 + +Fixed an issue where temporary files remained in their temporary locations even after manually uploading the files to the firewall. + +## PAN-214889 + +Fixed an issue where commits took longer than expected due to application dependency checks. + +## PAN-214847 + +Fixed an issue where, when certificate authentication for admin user authentication was enabled, vulnerability scans that used usernames or passwords against the management interface reported a vulnerability due to a missing HSTS header in the Access Denied response page. + +## PAN-214634 + +Fixed an issue where an elink parser did not work. + +## PAN-214337 + +Fixed an issue on the firewall related to the gp_broker configuration transform that led to longer commit times. + +## PAN-214187 + +Fixed an issue where superreaders were able to execute the request restart +system CLI command. + +## PAN-214100 + +Fixed an issue where selecting a threat name under Threat Monitor displayed the threat ID instead of the threat name. + +## PAN-214037 + +```caveat +PA-5440, PA-5430, PA-5420, and PA-5410 firewalls only +``` + +Fixed an issue where firewalls in active/active HA configurations experienced packet drop when running asymmetric traffic. + +## PAN-214026 + +Fixed an issue where, when using an ECMP weighted-round-robin algorithm, traffic was not redistributed among the links proportionally as expected from the configuration. + +## PAN-213942 + +```caveat +PA-400 Series firewalls +``` + +Fixed an issue where the firewall required an explicit allow rule to forward broadcast traffic. + +## PAN-213932 + +Fixed an issue where, when an incorrect log filter was configured, the commit did not fail. + +## PAN-213746 + +Fixed an issue on Panorama where the Hostkey displayed as **undefined** if a SSH Service Profile +Hostkey configured in a Template from the Template Stack was +overridden. + +## PAN-212848 + +Fixed an issue where attempting to change the disk-usage cleanup threshold to 90 resulted in the error message Server error : op command for client dagger timed out as client is not available. + +## PAN-212726 + +Fixed an issue where RTP/RTCP packets were dropped for SIP calls by SIP ALG when the source NAT translation type was persistent Dynamic IP And Port. + +## PAN-212530 + +Fixed an issue on log collectors where root partition reached 100% utilization. + +## PAN-212409 + +Fixed an issue where there were duplicate IPSec Security Associations (SAs) for the same tunnel, gateway, or proxy ID. + +## PAN-211997 + +Fixed an issue where large OSPF control packets were fragmented, which caused the neighborship to fail. + +## PAN-211887 + +Fixed an issue on Panorama that caused recently committed changes to not be displayed when previewing the changes to push to device groups. + +## PAN-211843 + +Fixed an issue where renaming a Zone Protection profile failed with the error message Obj does not exist. + +## PAN-211602 + +Fixed an issue where, when viewing a WildFire Analysis Report via the web interface, the detailed log view was not accessible if the browser window was resized. + +## PAN-211519 + +Fixed an issue where RTP/RTCP packets were dropped for SIP calls by SIP ALG when the source NAT translation type was persistent Dynamic IP And Port. + +## PAN-211422 + +Fixed an issue where the show session packet-buffer-protection buffer-latency CLI command randomly displayed incorrect values. + +## PAN-211242 + +Fixed an issue where missed heartbeats caused the Data Processing Card (DPC) and its corresponding Network Processing Card (NPC) to restart due to internal packet path monitoring failure. + +## PAN-211041 + +```caveat +Panorama virtual appliances only +``` + +Fixed an issue where DHCP assigned interfaces did not send ICMP unreachable - Fragmentation needed messages when the received packets were higher than the maximum transmission unit (MTU). + +## PAN-210921 + +```caveat +Panorama appliances in Legacy Mode only +``` + +Fixed an issue where Blocked Browsing Summary by Website in the user activity report contained scrambled characters. + +## PAN-210919 + +Fixed an issue where the Data Processing Card remained in a Starting state after a restart. + +## PAN-210875 + +Fixed an issue where the pan_task process stopped responding due to software packet buffer 3 trailer corruption, which caused the firewall to restart. + +## PAN-210736 + +Fixed an issue where configuration changes related to the SSH service profile were not reflected when pushed from Panorama. With this fix, the deletion of ciphers, MAC, and kex fields of SSH server profiles and HA profiles won't clear the values under template stacks and will retain the values configured from templates. + +## PAN-210661 + +Fixed an issue where firewalls disconnected from Cortex Data Lake after renewing the device certificate. + +## PAN-210563 + +Fixed an issue on Panorama where Security policy rules with a Tag target did not appear in the pre-rule list of a dynamic address group that was part of the tag. + +## PAN-209898 + +Fixed an issue where the logrcvr process stopped due to memory corruption. + +## PAN-209696 + +Fixed an issue where link-local address communication for IPv6, BFD, and OSPFv3 neighbors was dropped when IP address spoofing check was enabled in a Zone Protection profile. + +## PAN-209683 + +Fixed an issue where Panorama was unable to retrieve IP address-to-username mapping from a firewall on a PAN-OS 8.1 release. + +## PAN-209660 + +Fixed an issue where a selective push from Panorama to multiple firewalls failed due to a missing configuration file, which caused a communication error. + +## PAN-209617 + +Fixed an issue with firewalls in active/passive HA configurations where the passive firewall created an incorrect SCTP association due to the HA sync messages from the active firewall having an incorrect value. + +## PAN-209275 + +Fixed an issue where Override cookie authentication into the GlobalProtect gateway failed when an allow list was configured under the authentication profile. + +## PAN-209021 + +Fixed an issue where packets were fragmented when SD-WAN VPN tunnel was configured on aggregate ethernet interfaces and sub-interfaces. + +## PAN-208877 + +Fixed an issue where the all_task process stopped responding when freeing the HTTP2 stream, which caused the dataplane to go down. + +## PAN-208737 + +Fixed an issue where domain information wasn't populated in IP address-to-username matching after a successful GlobalProtect authentication using an authentication override cookie. + +## PAN-208325 + +```caveat +PA-5400 Series, PA-3400 Series, and PA-400 Series only +``` + +Fixed an issue where the firewall was unable to automatically renew the device certificate. + +## PAN-208201 + +Fixed an issue on the firewall where the modified date and time was incorrectly updated after a commit operation, PAN-OS upgrade, or reboot. + +## PAN-207842 + +Fixed an issue where WildFire Analysis Reports were not visible when the WF-500 appliance was on private cloud. + +## PAN-207741 + +Fixed an issue where Large Scale VPN (LSVPN) Portal authentication failed with the error invalid http response. return error(Authentication failed; Retry authentication when the satellite connected to more than one portal. + +## PAN-207700 + +Fixed an issue where the show system info and show system ztp status CLI commands displayed a different Zero Touch Provisioning (ZTP) status if a firewall upgrade was initiated from Panorama before the initial commit push succeeded. + +## PAN-207562 + +Fixed an issue where the shard count displayed by the show log-collector-es-cluster health CLI command was higher than the recommended limit. The recommended limit can be calculated with the formula 20* heap-memory * no-of-data-nodes. + +## PAN-206396 + +Fixed an issue where HIP report flip and HIP checks failed when a user was part of multiple user groups with different domains. + +## PAN-206333 + +Fixed an issue where the Include/Exclude IP filter under Data Distribution did not work correctly. + +## PAN-206253 + +```caveat +PA-1400 Series and PA-3400 Series firewalls only +``` + +Fixed an issue where the default log rate was too low and the maximum configurable log rate was incorrectly capped, which caused the firewall to not generate logs at more than 6826 logs per second. + +## PAN-205955 + +Fixed an issue where RAID rebuilds occurred even with healthy disks and a clean shutdown. + +## PAN-205513 + +Fixed an issue where the stats dump file generated by Panorama for a device firewall differed from the stats dump file generated by the managed device. + +## PAN-205086 + +Fixed an issue where DNS Security categories were able to be deleted from Spyware profiles. + +## PAN-204838 + +Fixed an issue where the dot1q VLAN tag was missing in ARP reply packets. + +## PAN-204718 + +```caveat +PA-5200 Series firewalls only +``` + +Fixed an issue where, after upgrading to PAN-OS 10.1.6-h3, a TACACS user login displayed the following error message during the first login attempt: Could not chdir to home directory /opt/pancfg/home/user: Permission denied. + +## PAN-204238 + +Fixed an issue where, when View Rulebase as Groups was enabled, the Tags field did not display a scroll down arrow for navigation. + +## PAN-204068 + +Fixed an issue where a newly created vsys (virtual system) in a template was not able to be pushed from Panorama to the firewall. + +## PAN-203330 + +Fixed an issue where the certificate for an External Dynamic List (EDL) incorrectly changed from invalid to valid, which caused the EDL file to be removed. + +## PAN-202963 + +Fixed an issue where the system log message dsc HA state is changed from 1 to 0 was generated with the severity High. With this fix, the severity was changed to Info. + +## PAN-202795 + +Fixed an issue where file identification failed with a large HTTP header. + +## PAN-201721 + +Fixed an issue with firewalls in HA configurations where HA setup generated the error mismatch due to device update during a content update even though the version was the same. + +## PAN-200019 + +Fixed an issue on Panorama where Virtual Routers (Network > Virtual Routers) was not available when configuring a custom Panorama admin role (Panorama > Admin Roles). + +## PAN-199557 + +Fixed an issue on Panorama where virtual memory usage exceeded the set limit, which caused the configd process to restart. + +## PAN-197121 + +Fixed an issue where incorrect user details were displayed under the USER DETAIL drop-down (ACC > Network activity > User activity). + +## PAN-196309 + +```caveat +PA-5450 firewalls only +``` + +Fixed an issue where a firewall configured with a Policy-Based Forwarding policy flapped when a commit was performed, even when the next hop was reachable. + +## PAN-195788 + +Fixed an issue where zip files did not download when applying Security inspection and the following error message displayed: resources-unavailable. + +## PAN-195695 + +Fixed an issue where the AppScope Summary report and PDF report export function did not work as expected. + +## PAN-192456 + +Fixed an issue where GlobalProtect SSL VPN processing during a high traffic load caused the dataplane to stop responding. + +## PAN-189666 + +Fixed an issue where GlobalProtect portal connections failed after random commits when multiple agent configurations were provisioned and configuration selection criteria using certificate profile was used. + +## PAN-187763 + +Fixed an issue where DNS Security logs did not display a threat category, threat name, or threat ID when domain names contained 64 or more characters. + +## PAN-187279 + +Fixed an issue where not all quarantined devices were displayed as expected. + +## PAN-184630 + +Fixed an issue where TLS clients, such as those using OpenSSL 3.0, +enforced the TLS renegotiation extension (RFC 5746). diff --git a/web/data/issues/PAN-OS/addressed/11.0.3-h10_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.3-h10_2026-03-16.md new file mode 100644 index 0000000..8dcd87e --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.3-h10_2026-03-16.md @@ -0,0 +1,46 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.3-h10 +--- + +## PAN-252214 + +A fix was made to address CVE-2024-3400. + +## PAN-246707 + +Fixed an issue where failover was not triggered when multiple +processes stopped responding. + +## PAN-244493 + +Fixed a memory limitation with mapping subinterfaces to VPCE +endpoints for GCP IPS, Amazon Web Services (AWS) integration with +GWLB, and NSX service chain mapping. + +## PAN-240347 + +Fixed an issue with the web interface where the +Dashboard and a Device +Group policy rule took longer than expected to +load. + +## PAN-240166 + +Fixed an issue where, when explicit proxy was configured on the +firewall, websites loaded more slowly than expected or did not load +due to DNS using TCP. + +## PAN-239279 + +Fixed an issue related to web proxy where the masterd +process monitoring envoy process memory restarted when it reached an +unexpected limit. + +## PAN-230746 + +Fixed an issue on the web interface where device groups with a large +number of managed firewalls displayed the +Policy page more slowly than +expected. diff --git a/web/data/issues/PAN-OS/addressed/11.0.3-h12_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.3-h12_2026-03-16.md new file mode 100644 index 0000000..78e9149 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.3-h12_2026-03-16.md @@ -0,0 +1,40 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.3-h12 +--- + +## PAN-253317 + +```caveat +VM-Series firewalls on Microsoft Azure environments only +``` + +Fixed an issue where you were unable to log in to the firewall after +a private data reset. + +## PAN-246960 + +Fixed an issue where firewalls failed to fetch content updates from +the Wildfire Private Cloud due to an Unsupported +protocol error. + +## PAN-244648 + +```caveat +PA-5200 Series only +``` + +Fixed an issue where the firewall did +not boot up after a factory reset, and, with FIPS mode enabled, the +firewall rebooted into maintenance mode. + +## PAN-238769 + +```caveat +VM-Series firewalls in FIPS-CC mode only +``` + +Fixed an issue +where upgrading Panorama caused all locally created Security policy rule +actions to Deny. diff --git a/web/data/issues/PAN-OS/addressed/11.0.3-h13_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.3-h13_2026-03-16.md new file mode 100644 index 0000000..c8fe632 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.3-h13_2026-03-16.md @@ -0,0 +1,10 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.3-h13 +--- + +## PAN-272809 + +A fix was made to address CVE-2024-0012 (PAN-SA-2024-0015) and +CVE-2024-9474. diff --git a/web/data/issues/PAN-OS/addressed/11.0.3-h1_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.3-h1_2026-03-16.md new file mode 100644 index 0000000..e100a93 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.3-h1_2026-03-16.md @@ -0,0 +1,16 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.3-h1 +--- + +## PAN-237871 + +```caveat +WF-500 appliances and PAN-DB private cloud deployments only +``` + +Fixed an issue where the +root-cert was set to expire on +December 31, 2023. With this fix, the expiration date has been +extended. diff --git a/web/data/issues/PAN-OS/addressed/11.0.3-h3_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.3-h3_2026-03-16.md new file mode 100644 index 0000000..5287d49 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.3-h3_2026-03-16.md @@ -0,0 +1,91 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.3-h3 +--- + +## PAN-239769 + +Fixed an issue where object references in a rule were renamed, and +while doing a selective revert of the changes with Commit +changes by me caused a reference error. + +## PAN-237876 + +Extended the firewall Panorama root CA certificate which was +previously set to expire on April 7th, 2024. + +## PAN-235476 + +Fixed an issue where threat logs from different Security zones were +aggregated into one log. + +## PAN-233039 + +Fixed an issue where GENEVE encapsulated packets coming from a GFE +Proxy mapped to an incorrect Security policy rule. + +## PAN-231507 + +```caveat +PA-1400 Series firewalls only +``` + +Fixed an issue where, when +an HSCI interface was used as an HA2 interface, HA2 packets were +intermittently dropped on the passive firewall, which caused the HA2 +connection to flap due to missing HA2 keepalive messages. + +## PAN-230092 + +Fixed an issue where the routed process stopped +responding when committing routing-related changes if Advanced +routing was enabled. + +## PAN-227568 + +When a device certificate is installed, renewed, or removed, the +firewall will reconnect to the WildFire cloud to use the newest +certificate. + +## PAN-227064 + +Fixed an issue with high availability (HA) sync failure when +performing a partial commit after creating a Security policy via +REST API. + +## PAN-226792 + +Fixed an issue where the logrcvr process stored older +content versions in the shared memory even when newer content +updates were installed. + +## PAN-225886 + +Fixed an issue where, when explicit proxy mode was enabled for the +web proxy, intermittent errors and unexpected TCP reconnections +occurred. + +## PAN-218620 + +Fixed an issue where scheduled configuration exports and SCP server +connection testing failed. + +## PAN-215576 + +Fixed an issue where the userID-Agent +and TS-Agent certificates were set to +expire on November 18, 2024. With this fix, the expiration date has +been extended to January 2032. + +## PAN-202361 + +Fixed an issue where packets queued to the pan_task +process were still transmitted when the process was not +responding. + +## PAN-193004 + +Fixed an issue where /opt/pancfg +partition utilization reached 100%, which caused access to the +Panorama web interface to fail. diff --git a/web/data/issues/PAN-OS/addressed/11.0.3-h5_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.3-h5_2026-03-16.md new file mode 100644 index 0000000..3abe8a8 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.3-h5_2026-03-16.md @@ -0,0 +1,153 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.3-h5 +--- + +## PAN-242561 + +Fixed an issue where GlobalProtect tunnels disconnected shortly after +being established when SSL was used as the transfer protocol. + +## PAN-241772 + +Fixed an issue where, when TLSv1.3 was used, an incorrect error +message invalid padding was displayed +instead of the expected error message Invalid server +certificate. + +## PAN-240786 + +Fixed an issue on firewalls in HA configurations where VXLAN sessions +were allocated, but not installed or freed, which resulted in a +constant high session table usage that was not synced between the +firewalls. This resulted in a session count mismatch. + +## PAN-240487 + +Fixed an issue where fan speed increased significantly after +upgrading the firewall. + +## PAN-240197 + +Fixed an issue where configuration changes made in Panorama and +pushed to the firewall were not reflected on the firewall. + +## PAN-238996 + +Fixed an issue where commits did not complete and remained in a +pending state due to a race condition. With this fix, the commit +will fail after 60 seconds and not remain in a pending state. + +## PAN-238769 + +```caveat +VM-Series firewalls in FIPS-CC mode only +``` + +Fixed an issue +where upgrading Panorama caused all locally created Security policy +rule actions to Deny. + +## PAN-236120 + +Fixed an issue where the /opt/panlogs partition reached capacity due +to the logdb-quota for the User-ID log folder not being matched. + +## PAN-234929 + +Fixed an issue where tabs in the ACC such as +Network Activity +Threat Activity and Blocked +Activity did not display data when you applied a +Time filter of Last 15 +Minutes, Last Hour, +Last 6 Hours, or Last 12 +Hours, and the data that was displayed with the +Last 24 Hours filter was not accurate. +Reports that were run against summary logs also did not display +accurate results. + +## PAN-232800 + +Fixed an issue where critical disk usage for /opt/pancfg increased +continuously and the system logs displayed the following message: +Disk usage for /opt/pancfg exceeds limit, + percent in use. + +## PAN-231802 + +Fixed an issue where an Advanced Routing BGP session flapped with +commits when BGP peer authentication was enabled. + +## PAN-230746 + +Fixed an issue on the web interface where device groups with a large +number of managed firewalls displayed the +Policy page more slowly than +expected. + +## PAN-229691 + +Fixed an issue on Panorama where configuration lock timeout errors +were observed during normal operational commands by increasing +thread stack size on Panorama. + +## PAN-228515 + +Fixed an issue where the Elasticsearch cluster health status +displayed as yellow or red due to Elasticsearch SSH tunnel +flaps. + +## PAN-228187 + +Fixed an issue where the management server restarted due to the +virtual memory exceeding the limit. + +## PAN-227397 + +Fixed an issue where selective pushes on Panorama removed a +previously pushed configuration from the firewalls. + +## PAN-227368 + +Fixed an issue where the GlobalProtect app was unable to connect to a +portal or gateway and GlobalProtect Clientless VPN users were unable +to access applications if authentication took more than 20 +seconds. + +## PAN-223798 + +Fixed an issue on the firewall where, when Advanced Routing was +enabled, PIM join messages were not sent to the RN due to a missing +OIF. + +## PAN-223259 + +Fixed an issue where selective pushes failed with the error message +Failed to generate selective push configuration. +Unable to retrieve last in-sync configuration for the device, +either a push was never done or version is too old. Please try a +full push. + +## PAN-220907 + +```caveat +VM-Series firewalls only +``` + +Fixed an issue where large +packets were dropped from the dataplane to the management plane, +which caused OSPF neighborship to fail. + +## PAN-220659 + +Fixed an issue on the firewall where scheduled Antivirus updates +failed when external dynamic lists were configured on the +firewall. + +## PAN-218928 + +Fixed an issue where the reportd process stopped +responding after querying logs or generating ACC reports with some +filters. diff --git a/web/data/issues/PAN-OS/addressed/11.0.3_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.3_2026-03-16.md new file mode 100644 index 0000000..769d750 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.3_2026-03-16.md @@ -0,0 +1,642 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.3 +--- + +## PAN-231823 + +A fix was made to address CVE-2024-5916. + +## PAN-233954 + +Fixed an issue where the firewall was unable to retrieve correct groups from the LDAP server. + +## PAN-232059 + +Fixed an issue with memory management when processing large certificates using TLSv1.3. + +## PAN-229691 + +Fixed an issue on Panorama where configuration lock timeout errors were observed during normal operational commands by increasing thread stack size on Panorama. + +## PAN-228877 + +```caveat +PA-7050 firewalls only +``` + +Fixed an issue with OOM conditions which caused slot restarts +due to pan_cmd consuming more than 300 +MB. + +## PAN-227639 + +Fixed an issue where the ACC displayed an incorrect DNS-base application traffic byte count. + +## PAN-227376 + +Fixed an issue where a memory overrun caused the all_task process to stop responding. + +## PAN-227179 + +Fixed an issue where routes were not updated in the forwarding table. + +## PAN-226418 + +A CLI command was added to address an issue where long-lived sessions aged out even when there was ongoing traffic. + +## PAN-226198 + +Fixed an issue on Panorama where the configd process repeatedly restarted when attempting to make configuration changes. + +## PAN-225920 + +Fixed an issue where duplicate predict sessions didn't release NAT resources. + +## PAN-225183 + +Fixed an issue where SSH tunnels were unstable due to ciphers used as part of the high availability SSH configuration. + +## PAN-225169 + +Added a CLI command to view Cortex Data Lake queue usage. + +## PAN-224145 + +Fixed an issue in multi-vsys environments where, when Panorama was on a PAN-OS 10.2 release and the firewall was on a PAN-OS 10.1 release, commits failed on the firewall when inbound inspection mode was configured in the decryption policy rule. + +## PAN-223852 + +Fixed an issue where all_pktproc stopped responding when network packet broker or decryption broker chains failed. + +## PAN-223741 + +Fixed an issue where the mprelay process stopped responding, which caused a slot restart when another slot rebooted. + +## PAN-223501 + +```caveat +PA-5200 Series and PA-7000 Series firewalls only +``` + +Fixed an issue where diagnostic information for the dataplane in the dp-monitor.log file was not complete. + +## PAN-223488 + +Fixed an issue where closed ElasticSearch shards were not deleted, which resulted in shard +purging not working as expected. + +## PAN-223457 + +Fixed an issue where, if the number of group queries exceeded the Okta rate limit threshold, the firewall cleared the cache for the groups. + +## PAN-223317 + +Fixed an issue where SSL traffic failed with the error message: Error: General TLS protocol error. + +## PAN-223185 + +Fixed an issue where the distributord process stopped responding. + +## PAN-222957 + +Fixed an issue where managed firewalls did not reflect changes pushed by users who were not in a +superuser role. + +## PAN-222941 + +Fixed an issue where viewing the latest logs took longer than expected due to log indexer failures. + +## PAN-222533 + +```caveat +VM-Series firewalls on Microsoft Azure and Amazon Web Services (AWS) environments +``` + +Added support for high availability (HA) link monitoring and path monitoring. + +## PAN-222418 + +Fixed an issue where the firewall intermittently recorded a reconnection message to the authentication server as an error, even if no disconnection occurred. + +## PAN-222162 + +Fixed an issue where the show transceiver CLI command +showed the RX and TX powers as 0.00 mW. + +## PAN-221984 + +```caveat +VM-Series firewalls in Microsoft Azure environments only +``` + +Fixed an issue where an interface went down after a hotplug event and was only recoverable by restarting the firewall. + +## PAN-221836 + +Fixed an issue where improper SNI detection caused incorrect URL categorization. + +## PAN-221787 + +Fixed an issue where a User Principal Name (UPN) was incorrectly required in the pre-logon machine certificate. + +## PAN-221647 + +Fixed an issue where the Apps seen value was not reflected on Panorama. + +## PAN-221577 + +Fixed an issue where a static route for a branch or hub over the respective virtual interface was not installed in the routing table even when the tunnel to the branch or hub was active. + +## PAN-221208 + +Fixed an issue where the tunnel monitor was unable to remain up when zone protection with Strict +IP was enabled and NAT Traversal was applied. + +## PAN-221126 + +Fixed an issue where Email server profiles (Device > Server Profiles > Email and +Panorama > Server Profiles > Email) to forward +logs as email notifications were not forwarded in a readable +format. + +## PAN-220910 + +Fixed an issue where an internal management plane NIC caused a kernel panic when doing a transmit due to the driver reinitializing under certain failure or change conditions on the same interface during transmit. + +## PAN-220899 + +Fixed an issue where you were unable to choose the manual GlobalProtect gateway. + +## PAN-220747 + +Fixed an issue where logs were not visible after restarting the log collector. + +## PAN-220626 + +Fixed an issue where system warning logs were written every 24 hours. + +## PAN-220448 + +Fixed an issue where the GlobalProtect client connection remained at the prelogin stage when +Kerberos SSO failed and was unable to fall back to the realm +authentication. + +## PAN-220401 + +Fixed an issue where, during a reboot, an unexpected error message was displayed that the syslog configuration file format was too old. + +## PAN-220281 + +```caveat +PA-7080 firewalls only +``` + +Fixed an issue where autocommitting changes after rebooting the +Log Forwarding Card (LFC) caused the logrcvr process to +fail to read the configuration file. + +## PAN-220180 + +Fixed an issue where configured botnet reports (Monitor > Botnet) were not generated. + +## PAN-219813 + +Fixed an issue where the configuration log displayed incorrect information after a multidevice +group Validate-all operation. + +## PAN-219659 + +Fixed an issue where root partition frequently filled up and the following error message was displayed: Disk usage for / exceeds limit, xx percent in use, cleaning filesystem. + +## PAN-219644 + +Fixed an issue where firewalls that forwarded logs to a syslog server over TLS (Objects > Log Forwarding) used the default Palo Alto Networks certificate instead of the configured custom certificate. + +## PAN-219623 + +Fixed an issue where, when a multidynamic group validate job was pushed on the firewall, logs +displayed Panorama push instead of +ValidateAll push. + +## PAN-219498 + +Fixed an issue where the Threat ID/Name detail in Threat logs was not +included in syslog messages sent to Splunk. + +## PAN-219300 + +Fixed an issue where the task manager displayed only limited data. + +## PAN-219253 + +Fixed an issue where, after making changes in a template, the Commit and Push option was grayed out. + +## PAN-218988 + +Fixed an issue in FIPS mode where, when importing a certificate with a new private key, and the certificate used the name of an existing certificate on the Panorama, the following error message was displayed: Mismatched public and private keys. + +## PAN-218947 + +Fixed an issue where logs were not displayed in Elasticsearch under ingestion load. + +## PAN-218697 + +Fixed an issue where the ElasticSearch status frequently changed to red or yellow after a PAN-OS upgrade. + +## PAN-218663 + +A fix was made to address CVE-2024-2433 + +## PAN-218404 + +Fixed an issue where ikemgr stopped responding due to receiving CREATE_CHILD messages with a malformed SA payload. + +## PAN-218340 + +Fixed an issue where selective pushes to template stack and multi device group pushes caused a buildup of resident memory, which caused the configd process to stop responding. + +## PAN-218318 + +Fixed an issue where the firewall changed the time zone automatically instead of retrieving the correct time zone from the NTP server. + +## PAN-218273 + +Fixed an issue where TCP keepalive packets from the client to the server weren't forwarded when SSL decryption was enabled. + +## PAN-218267 + +Fixed an issue where a commit and push operation from Panorama to managed firewalls did not complete or took longer to complete than expected. + +## PAN-218252 + +Fixed an issue where the slot-1 data processor showed the status as down during an SNMP +query. + +## PAN-218107 + +Fixed an issue with ciphers used for SSH tunnels where packet lengths were too large, which made the SSH tunnel unstable. + +## PAN-218046 + +Fixed an issue where the Virtual Routers (Network > Virtual Routers) setting was not available when configuring a custom admin role (Device > Admin Roles). + +## PAN-218001 + +```caveat +PA-400 Series firewalls only +``` + +Fixed an issue where shutdown commands rebooted the system instead of correctly triggering a shutdown. + +## PAN-217650 + +```caveat +VM-Series firewalls and Panorama virtual appliances in Microsoft Azure environments only +``` + +Fixed an issue where management interface +Speed/Duplex was reported as unknown. + +## PAN-217493 + +Fixed an issue where superusers with read-only privileges were unable to view SCEP object configurations. + +## PAN-217169 + +Fixed an issue where the logrcvr stopped forwarding logs to the syslog server after a restart. + +## PAN-217053 + +Fixed an issue where the configd process stopped responding after a selective push to multiple device groups failed. + +## PAN-216957 + +Fixed an issue where allow list checks in an authentication profile did not work if the group +Distinguished Name contains the ampersand ( & ) character. + +## PAN-216775 + +Fixed an issue where the devsrvr process stopped responding at pan_cloud_agent_get_curl_connection() and the URL cloud could not be connected. + +## PAN-216366 + +Fixed an issue where, when custom signatures used a certain syntax, false positives were generated on devices on a PAN-OS 10.0 release. + +## PAN-216214 + +```caveat +Panorama managed firewalls in active/active HA configurations only +``` + +Fixed an issue where the HA status displayed as Out of Sync (Panorama > Managed Devices > Health) if local firewall configurations were made on one of the HA peers. This caused the next HA configuration sync to overwrite the local firewall configuration made on the HA peer. + +## PAN-216048 + +Fixed an issue where, when upgrading from a PAN-OS 9.1 release to a PAN-OS 10.0 release, commits failed with the error message: hip profiles unexpected here. + +## PAN-215767 + +Fixed an issue where, after a high availability failover, IKE SA negotiation failed with the error message INVALID_SPI, which resulted in temporary loss of traffic over some proxy IDs. + +## PAN-215655 + +Fixed an issue where, after a multidynamic group push, Security policy rules with the target +device tag were added to a firewall that did not have the tag. + +## PAN-215338 + +```caveat +PA-5400 Series firewalls only +``` + +Fixed an issue where the inner VLAN tag for Q-in-Q traffic was stripped when forwarding. + +## PAN-215317 + +Fixed an issue where the dataplane stopped responding unexpectedly with the error message comm exited with signal of 10. + +## PAN-215066 + +Fixed an issue on Panorama where push scope rendering caused the Commit and Push or Push to Devices operation window to hang for several minutes. + +## PAN-214990 + +Fixed an issue where firewall copper ports flapped intermittently when device telemetry was enabled. + +## PAN-214987 + +Fixed an issue where Application Filter names were not random, and they matched or included internal protocol names. + +## PAN-214815 + +Fixed an issue where SNMP queries were not replied to due to an internal process timeout. + +## PAN-214727 + +Fixed an issue where a memory leak related to the useridd process resulted in an OOM +condition, which caused the process to stop responding. + +## PAN-214669 + +Fixed an issue where FIN and RESET packets were sent in reverse order. + +## PAN-214463 + +Fixed an issue where IKE re-key negotiation failed with a third-party vendor and the firewall +acting as the initiator received a response with the VENDOR_ID +payload and the error message unexpected critical +payload (type 43). + +## PAN-214201 + +Fixed an issue where, after exporting custom reports to CSV format, the letter b appeared at the beginning of each column. + +## PAN-214186 + +Fixed an issue where category length was incorrect, which caused the +dataplane to restart. + +## PAN-213956 + +Fixed an issue where the firewall interface did not go down even after the peer link/switch port went down. + +## PAN-213931 + +Fixed an issue where the logrcvr process cache was not in sync with the mapping on the firewall. + +## PAN-213296 + +Fixed an issue where Single Log-out (SLO) was not correctly triggered from the firewall toward +the client, which caused the client to not initiate the SLO request +toward the identity provider (IdP). This resulted in the IdP not +making the SLO callback to the firewall to remove the user. + +## PAN-213162 + +Fixed an issue where an SD-WAN object was not displayed under a child device group. + +## PAN-213112 + +Fixed an issue where executing the show report directory-listing CLI command resulted in no output after upgrading to a PAN-OS 10.1 release. + +## PAN-212978 + +Fixed an issue where the firewall stopped responding when executing an SD-WAN debug CLI +command. + +## PAN-212726 + +Fixed an issue where RTP/RTCP packets were dropped for SIP calls by SIP ALG when the source NAT translation type was persistent Dynamic IP And Port. + +## PAN-212577 + +```caveat +PA-5200 Series and PA-7080 firewalls only +``` + +Fixed an issue where commits took longer than expected when more than 45,000 Security policy rules were configured. + +## PAN-212240 + +Fixed an issue where packet capture was logged for an unknown application session when packet capture logging was disabled. + +## PAN-212057 + +Fixed an issue where Advanced Threat Prevention caused SSL delays when no URL licenses were present. + +## PAN-211441 + +Fixed a memory leak issue related to SSL crypto operations that resulted in failed commits. + +## PAN-211398 + +Fixed an issue where dataplane processes stopped responding when handling HTTP/2 streams. + +## PAN-211384 + +Fixed an issue where the size of the redisthost_1 in the Redis database continuously increased, which caused an OOM condition. + +## PAN-210640 + +Fixed an issue where applications were not displayed after authenticating into the clientless VPN. + +## PAN-210502 + +Fixed an issue where Panorama was unable to convert to PAN-OS 9.1 syntax for WF-500 +appliances. + +## PAN-210456 + +Fixed an issue where high latency occurred on PA-850-ZTP when SSL decryption was enabled. + +## PAN-210452 + +Fixed an issue where application packet capture (pcap) was not generated when Security policy +rules were used as a filter. + +## PAN-210429 + +```caveat +VM-Series firewalls only +``` + +Fixed an issue where the HTTP service failed to come up on DHCP dataplane interfaces after rebooting the firewall, which resulted in health-check failure on HTTP/80 with a 503 error code on the public load balancer. + +## PAN-210364 + +Fixed an issue where high latency was observed when accessing internal web applications, which interrupted development activities related to the web server. + +## PAN-209585 + +The Palo Alto Networks QoS implementation now supports a new QoS mode called lockless QoS for PA-3400, PA-5410, PA-5420, PA-5430, and PA-5440 firewalls. For firewalls with higher bandwidth QoS requirements, the lockless QoS dedicates cores to the QoS function that improves QoS performance, resulting in improved throughput and latency. + +## PAN-209375 + +Fixed an issue on the firewall where log filtering did not work as expected. + +## PAN-209288 + +Fixed an issue where generating certificates with SCEP did not work. + +## PAN-209172 + +Fixed an issue where the firewall was unable to handle GRE packets for Point-to-Point Tunneling Protocol (PPTP) connections. + +## PAN-209108 + +Fixed an issue where a Panorama in Management Only mode was unable to display logs from log +collectors due to missing schema files. + +## PAN-208567 + +Fixed an issue with email formatting where, when a scheduled email contained two or more attachments, only one attachment was visible. + +## PAN-208438 + +Fixed an issue on Panorama where Security policy rules incorrectly displayed as disabled. + +## PAN-208395 + +Fixed an issue where user authentication failed in multi-vsys environments with the error message User is not in allowlist when an authentication profile was created in a shared configuration space. + +## PAN-208316 + +Fixed an issue where user-group names were unable to be configured as the source user via the test security-policy-match command. + +## PAN-208240 + +Fixed an issue where, when attempting to replace an existing certificate, importing a new certificate with the same name as the existing certificate failed due to mismatched public and private keys. + +## PAN-208198 + +Fixed an issue with firewalls in active/passive HA configurations where, after rebooting the passive firewall, interfaces were briefly shown as powered up, and then shown as down or shutdown. + +## PAN-208090 + +Fixed an issue where the ACC report did not display data when querying the filter for the fields Source and Destination IP. + +## PAN-207604 + +Fixed an issue where system logs continuously generated the log message Not enough space to load content to SHM. + +## PAN-207577 + +Fixed an issue where Panorama > Setup > Interfaces was not accessible for users with custom admin roles even when the interface option was selected for the custom admin roles. + +## PAN-206765 + +Fixed an issue where log forwarding filters involving negation did not work. + +## PAN-205015 + +Fixed an issue where not all users were included in the user group after an incremental sync between the firewall and the Cloud Identity Engine. + +## PAN-204868 + +Fixed an issue where disk utilization was continuously high due to the log purger not sufficiently reducing the utilization level. + +## PAN-204718 + +```caveat +PA-5200 Series firewalls only +``` + +Fixed an issue where, after upgrading to PAN-OS 10.1.6-h3, a TACACS user login displayed the following error message during the first login attempt: Could not chdir to home directory /opt/pancfg/home/user: Permission denied. + +## PAN-203611 + +Fixed an issue where URL categorization was not recognized for URLs that contained more than 100 characters. + +## PAN-202524 + +Fixed an issue where the session ID was missing in the session details section of the ingress-backlogs XML API output. + +## PAN-199819 + +Fixed an issue where, if a decryption profile allowed TLSv1.3, but the server only supported +TLSv1.2, and the cipher used by the first connection to the server +was a CBC SHA2 cipher suite, the connection failed. + +## PAN-198509 + +Fixed an issue where commits failed due to insufficient CFG memory. + +## PAN-198453 + +Fixed an issue where you were unable to resize the Description pop-up window (Policies > Security > Prerules). + +## PAN-198050 + +Fixed an issue where Connection to update server is successful messages displayed even when connections failed. + +## PAN-197339 + +Fixed an issue where template configuration for the User-ID agent was not reflected on the template stack on Panorama appliances on PAN-OS 10.2.1. + +## PAN-196345 + +Fixed an issue where scheduled dynamic content updates failed to be retrieved by managed firewalls from Panorama when connectivity was slow. + +## PAN-189328 + +Fixed an issue where traffic belonging to the same session was sent out from different ECMP enabled interfaces. + +## PAN-187989 + +Fixed an issue where a user who did not have permissions of other access domains were able to view the commit and configuration lock. + +## PAN-185360 + +Fixed an issue where, when Authentication Portal Authentication was configured, +l3svc_ngx_error.log and +l3svc_access.log did not roll over +after exceeding 10 megabytes, which caused the root partition to +reach full utilization. + +## PAN-180082 + +Fixed an issue where errors in brdagent logs caused dataplane path monitoring failure. + +## PAN-177227 + +```caveat +VM-Series firewalls on Amazon Web Services environments only +``` + +Fixed an issue where traffic sent from a GENEVE tunnel to the firewall was dropped if the firewall attempted to encapsulate traffic into an IPSec tunnel. + +## PAN-169586 + +Fixed an issue where scheduled log view reports in emails didn't match the monitor page query result for the same time interval. + +## PAN-160633 + +```caveat +PA-3200 Series, PA-5200 Series, and PA-7000 Series firewalls only +``` + +Fixed an issue where +the dataplane restarted repeatedly due to an internal path +monitoring failure until a power cycle. diff --git a/web/data/issues/PAN-OS/addressed/11.0.4-h1_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.4-h1_2026-03-16.md new file mode 100644 index 0000000..9c6f7cd --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.4-h1_2026-03-16.md @@ -0,0 +1,9 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.4-h1 +--- + +## PAN-252214 + +A fix was made to address CVE-2024-3400. diff --git a/web/data/issues/PAN-OS/addressed/11.0.4-h2_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.4-h2_2026-03-16.md new file mode 100644 index 0000000..2b968a1 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.4-h2_2026-03-16.md @@ -0,0 +1,15 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.4-h2 +--- + +## PAN-252744 + +```caveat +PA-3200 Series, PA-5200 Series, and PA-7000 Series firewalls +``` + +Fixed an issue where upgrading the firewall to +PAN-OS 11.0.4 or PAN-OS 11.0.4-h1 caused the firewall to go into a +non-functional state. diff --git a/web/data/issues/PAN-OS/addressed/11.0.4-h5_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.4-h5_2026-03-16.md new file mode 100644 index 0000000..e989eb4 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.4-h5_2026-03-16.md @@ -0,0 +1,9 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.4-h5 +--- + +## PAN-247511 + +A fix was made to address CVE-2024-3596. diff --git a/web/data/issues/PAN-OS/addressed/11.0.4-h6_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.4-h6_2026-03-16.md new file mode 100644 index 0000000..fc8a1dc --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.4-h6_2026-03-16.md @@ -0,0 +1,10 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.4-h6 +--- + +## PAN-272809 + +A fix was made to address CVE-2024-0012 (PAN-SA-2024-0015) and +CVE-2024-9474. diff --git a/web/data/issues/PAN-OS/addressed/11.0.4_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.4_2026-03-16.md new file mode 100644 index 0000000..ed597b9 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.4_2026-03-16.md @@ -0,0 +1,1327 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.4 +--- + +## PAN-250686 + +Fixed an issue where selective push operations did not work when more than one admin user simultaneously performed changes and partial commits on Panorama. + +## PAN-249808 + +Fixed an issue where the configd process stopped responding when performing +multidevice group pushes via XML API. + +## PAN-246707 + +Fixed an issue where failover was not triggered when multiple processes stopped responding. + +## PAN-245701 + +Fixed an issue where the returned values to SNMP requests for data port statistics were incorrect. + +## PAN-245690 + +Fixed an issue where the managed collectors health status on Panorama displayed as empty. + +## PAN-244493 + +Fixed a memory limitation with mapping subinterfaces to VPCE endpoints for GCP IPS, Amazon Web Services (AWS) integration with GWLB, and NSX service chain mapping. + +## PAN-243951 + +Fixed an issue on Panorama appliances in active/passive HA configurations where managed devices displayed as out-of-sync on the passive appliance when peer configuration changes were made to the SD-WAN configuration on the active peer. + +## PAN-242910 + +Fixed an issue where a custom based non-Superuser was unable to push to firewalls. + +## PAN-242627 + +Fixed an issue where selective push did not work. + +## PAN-242519 + +Fixed an issue where scheduled email reports failed if the @ symbol before the mail client was missing. + +## PAN-242027 + +Fixed an issue where the all-task process repeatedly restarted during memory allocation failures. + +## PAN-241164 + +```caveat +PA-410 firewalls only +``` + +Fixed an issue where system and configuration logs sent from the firewall to Panorama contained the serial number field instead of the firewall device name. + +## PAN-241141 + +Fixed an issue where creating more than one address object in the same XML API request resulted in a commit error. + +## PAN-240618 + +Fixed an issue where configuration commits were successful even when dynamic peer IKE gateways +configured on the same interface and IP address that did not have +the same IKE Crypto profile. + +## PAN-240612 + +Fixed a kernel panic caused by a third-party issue + +## PAN-240487 + +Fixed an issue where fan speed increased significantly after upgrading the firewall. + +## PAN-240251 + +Fixed an issue where the vldmgr process incorrectly restarted during an Elasticsearch restart. + +## PAN-240225 + +Fixed an issue where authentication failed on web-based GlobalProtect portal. + +## PAN-240197 + +Fixed an issue where configuration changes made in Panorama and pushed to the firewall were not reflected on the firewall. + +## PAN-240166 + +Fixed an issue where, when explicit proxy was configured on the firewall, websites loaded more slowly than expected or did not load due to DNS using TCP. + +## PAN-239776 + +Fixed an issue where Panorama went into maintenance mode due to a GlobalProtect quota configuration that was under the minimum required quota. + +## PAN-239722 + +Fixed an issue where SNMP scans to the firewall took longer than expected and intermittently timed out. + +## PAN-239279 + +Fixed an issue where the SWG proxy did not accept new connections. + +## PAN-239256 + +Fixed an issue where ARP entries were unable to be completed for subinterfaces with SNAT configured. + +## PAN-239241 + +Extended the root certificate for WildFire appliances to December 31, 2032. + +## PAN-239200 + +Fixed an issue where the following Prisma Access SWG proxy upstream error was displayed when you attempted to access the proxy: disconnect / reset before headers: reset reason: overflow. + +## PAN-239144 + +Fixed an issue where the web interface was slower than expected when logging in, committing, and pushing changes after upgrading to PAN-OS 10.2.7. + +## PAN-238949 + +Fixed a memory corruption issue where multiple processes stopped responding. + +## PAN-238643 + +Fixed an issue where a memory leak caused multiple processes to stop responding when VM Information Sources was configured. + +## PAN-238621 + +Fixed an issue where the HA3 link status remained down when updating the HA3 interface configuration when the AE interface was up. + +## PAN-238586 + +Fixed an issue where DNS resolution failure from the LFC resulted in WildFire public cloud connectivity failure. + +## PAN-238562 + +Fixed an issue where log collectors stopped responding when gathering reports from Panorama. + +## PAN-238508 + +Fixed an issue where the routed process created excessive logs in the log file. + +## PAN-237993 + +Fixed an issue where Config Push Scheduler > Admin scope changed to an admin ID instead of a 0 value, which caused a scheduled configuration push to work as a Selective push instead of a Full push. + +## PAN-237876 + +Extended the firewall Panorama root CA certificate which was previously set to expire on April 7th, 2024. + +## PAN-237678 + +Fixed an issue with firewalls in active/passive HA configurations where the passive firewall displayed the error message Unable to read QSFP Module ID when the passive link state was set to shutdown. + +## PAN-237562 + +Fixed an issue where firewalls generated link-change system logs for SFP ports even when no cable was connected to the ports. + +## PAN-237537 + +Fixed an issue where, when deleting CTD entries, the all_pktproc process stopped responding which resulted in dataplane failure. + +## PAN-237478 + +Fixed an issue where the Traffic log displayed 0 bytes for denied sessions. + +## PAN-237454 + +Fixed an issue where Panorama stopped redistributing IP address-to-username mappings when packet loss occurred between the distributor and the client. + +## PAN-237369 + +```caveat +PA-1420 firewalls only +``` + +Fixed an issue where the all_task process stopped responding, which caused the firewall to become unresponsive. + +## PAN-236802 + +Fixed an issue on firewalls in HA configurations where unexpected failovers occurred. + +## PAN-236605 + +Fixed an issue where the configd process stopped responding due to a deadlock related to rule-hit-count. + +## PAN-235840 + +Fixed an issue where, after a configuration push from Panorama to managed firewalls, the status displayed as None and the push took longer than expected. + +## PAN-235737 + +Fixed an issue where the brdagent process stopped responding due to a sudden increase in logging to the bcm.log. + +## PAN-235628 + +Fixed an issue where you were not prompted for login credentials when you disconnected and +connected back to the GlobalProtect portal when SAML authentication +was selected along with single sign-on (SSO) and Single Log Out +(SLO). + +## PAN-235557 + +Fixed an issue where uploads from tunnels, including GlobalProtect, were slower than expected when the inner and outer sessions were on different dataplanes. + +## PAN-235476 + +Fixed an issue where Threat logs from different Security zones were aggregated into one log. + +## PAN-235385 + +Enhanced wifclient cloud connectivity redundancy. + +## PAN-235168 + +Fixed an issue where disk space became full even after clearing old logs and content images. + +## PAN-235081 + +```caveat +VM-Series firewalls only +``` + +Fixed an issue where the firewall sent packets to its own interface after configuring NAT64. + +## PAN-234977 + +Fixed an issue where, when a Layer 2 interface that was a member of a VLAN was down, all traffic transmitted over the VLAN was dropped. + +## PAN-234459 + +Fixed an issue with the firewall web interface where local SSL decryption exclusion cache entries were not visible. + +## PAN-234290 + +Fixed an issue where the firewall displayed incorrect interface transfer rates when running the CLI command show system state filter-pretty sys.s1.px with a filter. + +## PAN-234279 + +Fixed an issue where the ikemgr process crashed due to an IKEv1 timing issue, which caused commits to fail with the following error message: Client ikemgr requesting last config in the middle of a commit/validate, aborting current commit. + +## PAN-234238 + +Fixed an issue where a Security policy that referenced more than 30 HIP Profiles caused buffer +overflow, which caused other Security policies with HIP Profiles to +misidentified users and traffic was denied. + +## PAN-234190 + +Fixed an issue where the firewall incorrectly blocked URLs even when they matched the custom category. + +## PAN-234031 + +Fixed an issue on multi-core firewalls where the firewall displayed packets out of order when capturing packets on the transmit stage. + +## PAN-233957 + +```caveat +PA-5450 firewalls only +``` + +Fixed an issue where the NAT private pool was not used properly when enabling slot 6 DPC. + +## PAN-233833 + +Fixed an issue where enabling Jumbo frames resulted in software packet buffer depletion. + +## PAN-233789 + +Fixed an issue with push and commit and push operations where the user was not correctly bound to the scope, which caused all device groups to be selected for a selective push. + +## PAN-233780 + +```caveat +VM-100 firewalls only +``` + +Fixed an issue where commits failed due to the configuration memory limit. + +## PAN-233764 + +Fixed an issue where commits failed due to large inbound inspection certificates that exceeded +the buffer size of 4,096 bytes. + +## PAN-233541 + +Fixed an issue where device group and template administrators with access to a specific virtual system were able to see logs for all virtual systems via Context Switch. + +## PAN-233517 + +Fixed an issue on Panorama where managed device templates and device groups took longer than expected to display in the Push to Devices window. + +## PAN-233463 + +Fixed an issue where the X-Forwarded-For (XFF) IP address value was not displayed in Traffic +logs. + +## PAN-233390 + +Fixed an issue where the exclude-cache reason was incorrectly presented as TLS13_UNSUPPORTED instead of SSL_CLIENT_CERT. + +## PAN-233191 + +```caveat +PA-5450 firewalls only +``` + +Fixed an issue where the Data Processing Card (DPC) restarted due to path monitor failure after QSFP28 disconnected from the Network Processing Card (NPC). + +## PAN-233039 + +Fixed an issue where GENEVE encapsulated packets coming from a GFE Proxy mapped to an incorrect Security policy rule. + +## PAN-232953 + +Fixed an issue where you were able to cancel the same commit repeatedly, which displayed the error message Cannot stop job <job> at this time. + +## PAN-232924 + +Fixed an issue on firewalls in active/passive HA configurations where the passive firewall was unable to retrieve SDB data for locally inserted SFP transceivers. + +## PAN-232800 + +Fixed an issue where critical disk usage for /opt/pancfg increased continuously and the system logs displayed the following message: Disk usage for /opt/pancfg exceeds limit, <value> percent in use. + +## PAN-232377 + +Fixed an issue where the AddrObjRefresh job failed when the useridd process restarted. + +## PAN-232358 + +```caveat +PA-5450 firewalls only +``` + +Fixed an issue where the interface on QSFP28 ports did not go down when the Tx cable was removed from the QSFP28 module. + +## PAN-232290 + +```caveat +PA-5200 Series firewalls only +``` + +Fixed an issue where the First Packet Processor (FPP) did not acknowledge a query to find the owner for fragmented packets, tunnel packets, and other scenarios when the packet slot and dataplane owner was unknown. + +## PAN-232250 + +Fixed an issue where, when SSH service profiles for management access were set to None, the reported output was incorrect. + +## PAN-232132 + +Fixed an issue where DNS response packets were malformed when an antispyware Security Profile was +enabled. + +## PAN-231698 + +Fixed an issue where you were unable to set the Dynamic Updates schedule threshold to an empty +value. + +## PAN-231552 + +Fixed an issue where traffic returning from a third-party Security chain was dropped. + +## PAN-231507 + +```caveat +PA-1400 Series firewalls only +``` + +Fixed an issue where, when an HSCI interface was used as an HA2 interface, HA2 packets were intermittently dropped on the passive firewall, which caused the HA2 connection to flap due to missing HA2 keepalive messages. + +## PAN-231480 + +Fixed an issue where the firewall CLI output for GlobalProtect log quota settings did not match the settings configured on the Panorama web interface. + +## PAN-231459 + +```caveat +PA-5450 firewalls only +``` + +Fixed an issue where a large number of invalid source MAC addresses were shown in drop-stage packet captures. + +## PAN-231395 + +Fixed an intermittent issue where the OCSP query failed. + +## PAN-231329 + +Fixed an issue where the logrcvr process stopped responding due to a corrupt log in the forwarding pipeline. + +## PAN-231295 + +Fixed an issue where the logrcvr process stopped when running the hints-max CLI command. + +## PAN-231169 + +```caveat +PA-220 firewalls only +``` + +Fixed an issue where an unused plugin incorrectly used memory. + +## PAN-231148 + +Fixed an issue where no DHCP option list was defined when using GlobalProtect. + +## PAN-230813 + +Fixed an issue where flex memory leak caused decryption failure and commit failure with the error message Error preparing global objects failed to handle CONFIG_UPDATE_START. + +## PAN-230746 + +Fixed an issue on the web interface where device groups with a large number of managed firewalls displayed the Policy page more slowly than expected. + +## PAN-230656 + +```caveat +Firewalls in HA configurations only +``` + +Fixed an issue where a split brain condition occurred on both firewalls after booting up any firewall, and an HA switchover occurred after booting up a firewall with a higher HA priority even when no preemptive option was enabled on the firewall. + +## PAN-230377 + +Fixed an issue where FEC support was not enabled by default for PAN-25G-SFP28-LR modules. + +## PAN-230363 + +```caveat +PA-7050 firewalls with SMC-B only +``` + +Fixed an issue where the management interface was reported as up even when MGT-A and MGT-B were both down. + +## PAN-230362 + +Fixed an issue where the firewall truncated the payload of a TCP Out of Order segment with a FIN flag. + +## PAN-230359 + +Fixed an issue where SAML authentication failed with the error message Failed to verify signature against certificate when ds:KeyName was in the IdP metadata. + +## PAN-230198 + +Fixed an issue where URL logs were duplicated on Cortex Data Lake. + +## PAN-230106 + +Fixed an issue where the firewall was unable to retrieve the most current external dynamic list information from the server due to hostname resolution failure. + +## PAN-230092 + +Fixed an issue where the routed process stopped responding when committing routing-related changes if Advanced routing was enabled. + +## PAN-230039 + +Fixed an issue where migrating from an Enterprise License Agreement (ELA) to a Flexible VM-Series License failed with a deactivation error message. + +## PAN-229952 + +Fixed an issue where the print PDF option did not work (Panorama > Managed Devices > Health). + +## PAN-229950 + +Fixed an issue where custom response pages for the GlobalProtect login page did not load and displayed a 404 Not Found error. + +## PAN-229874 + +Fixed an issue where the firewall was unable to form OSPFv3 adjacency when using an ESP authentication profile. + +## PAN-229873 + +```caveat +PA-7050 firewalls only +``` + +Fixed an issue related to brdagent process errors. + +## PAN-229866 + +Fixed an issue where the reportd process stopped responding. + +## PAN-229824 + +Fixed an issue where Device History was not visible under Managed Devices Summary. + +## PAN-229606 + +Fixed an issue where the brdagent process stopped responding after an upgrade due to initialization failure. + +## PAN-229398 + +Fixed an issue where the Management Processor Card (MPC) stopped responding. + +## PAN-229315 + +Fixed an issue where Octets in NetFlow records were always reported to be 0 despite having a +nonzero packet count. + +## PAN-229307 + +Fixed an issue where half closed SSL decryption sessions stayed active, which caused software packet buffer depletion. + +## PAN-229115 + +Fixed an issue on the web interface where the screen was blank after logging in to Panorama. + +## PAN-229080 + +Fixed an issue where the new management IP address on the interface did not take effect. + +## PAN-229072 + +Fixed an issue where GlobalProtect did not automatically connect to an internal gateway after an endpoint was woken. + +## PAN-229069 + +Fixed an issue where clientless VPN portal users were unable to access clientless applications due to an SSL renegotiation being triggered. + +## PAN-228998 + +Fixed an issue where multiple license status checks caused an internal process to stop responding. + +## PAN-228775 + +Fixed an issue where the CLI command show bonjour interface did not display any output. + +## PAN-228457 + +```caveat +PA-7000 firewalls only +``` + +Fixed an issue where the GTP logs forwarded from the firewall to the log collector did not include the pcap. + +## PAN-228442 + +Fixed an issue on firewalls in active/passive HA configurations where sessions did not fail over from the active firewall to the passive firewall when upgrading PAN-OS. + +## PAN-228342 + +Fixed an issue where objects in the running configuration appeared to be deleted under the push scope preview. + +## PAN-228323 + +Fixed an issue where a large number of Panorama management server cookies were created in the Redis database when the Cloud-Service plugin sent an authentication request every second, and logging in to or using Panorama was slower than expected. + +## PAN-228277 + +Fixed an issue where commits took longer than expected. + +## PAN-227998 + +Fixed an issue where the zebra process stopped responding due to memory corruption. + +## PAN-227939 + +Fixed an issue where the all_task process stopped responding due to high wifclient memory usage, which caused the firewall to reboot. + +## PAN-227887 + +Fixed an issue where IP address checksums were calculated incorrectly. + +## PAN-227804 + +Fixed an issue where memory corruption caused the comm process to stop responding. + +## PAN-227774 + +Fixed an issue where commits failed with the error message Management server failed to send phase 1 to client logrcvr. + +## PAN-227539 + +Fixed an issue where excess WIF process memory use caused processes to restart due to OOM conditions. + +## PAN-227522 + +Fixed an issue where shared application filters that had application object overrides were overwritten by predefined applications. + +## PAN-227517 + +Fixed an issue related to the IPv6 character limit for the source address in static route path monitoring. + +## PAN-227510 + +Fixed an issue where the error message Failed to establish GRPC connection to UrlCat service: failed to start grpc connection was displayed in the system log when the Advanced URL Filtering license was applied but not configured. + +## PAN-227397 + +Fixed an issue where selective pushes on Panorama removed a previously pushed configuration from the firewalls. + +## PAN-227368 + +Fixed an issue where the GlobalProtect app was unable to connect to a portal or gateway and GlobalProtect Clientless VPN users were unable to access applications if authentication took more than 20 seconds. + +## PAN-227344 + +Fixed an issue on Panorama where PDF Summary Reports (Monitor > PDF Reports > Manage PDF Summary) displayed no data and were blank when predefined widgets were included in the summary report. + +## PAN-227305 + +Fixed an issue where SCEP certificate generation failed when a service route was used to reach the SCEP server. + +## PAN-227064 + +Fixed an issue with high availability (HA) sync failure when performing a partial commit after creating a Security policy via REST API. + +## PAN-227058 + +Fixed an issue where traffic did not match Security policy rules with the destination as FQDN and instead hit the default deny rule. + +## PAN-226923 + +Fixed an issue where an excessive tab displayed *Device > Setup** when using Simplified Chinese. + +## PAN-226860 + +Fixed an issue where macOS X-Auth clients disconnected prematurely from the GlobalProtect gateway +during a Phase 2 re-key event. + +## PAN-226768 + +Fixed an issue where, when the GlobalProtect app was installed on iOS endpoints and the gateway was configured to accept cookies, the app remained in the Connecting stage after authentication, and the GlobalProtect log displayed the error message User is not in allow list. This occurred when the app was restarted or when the app attempted to reconnect after disconnection. + +## PAN-226626 + +Fixed an issue where the firewall generated numerous logrcvr error messages related +to NetFlow. + +## PAN-226470 + +Fixed an issue where previewing changes for selective admins took longer than expected or displayed the error message commands succeeded with no output. + +## PAN-226128 + +Fixed an issue where selective push failed on Panorama after deleting shared objects that were +referenced in multi-device group environments with the error +message: Schema validation failed. Please try a full +push. + +## PAN-226021 + +Fixed an issue where content push operations failed for a URL category Scanning Activity. + +## PAN-225975 + +Fixed an issue where the CLI command show system disk details was not available. + +## PAN-225394 + +Fixed an issue on the firewall where SNMP incorrectly reported high packet descriptor usage. + +## PAN-225337 + +Fixed an issue on Panorama related to Shared configuration objects where configuration pushes to multi-vsys firewalls failed. + +## PAN-225203 + +Fixed an issue where the Log Forwarding Card (LFC) did not honor the negotiated MSS on the logging connection. + +## PAN-225110 + +Fixed an issue with firewalls in HA configurations where HA configuration syncs did not complete or logging data was missing until firewall processes were manually restarted or the firewalls were rebooted. + +## PAN-225094 + +Fixed an issue where performing a commit operation failed and the following error message was displayed: failed to handle CUSTOM_UPDATE. + +## PAN-225090 + +Fixed an issue on Panorama where Commit and Push was grayed out when +making changes to a template or device group. + +## PAN-225082 + +Fixed an issue where GlobalProtect quarantine-delete logs were incorrectly shown on passive firewalls. + +## PAN-225013 + +```caveat +PA-5450 firewalls only +``` + +Fixed an issue where the firewall rebooted unexpectedly when a Network Card was on Slot 2 instead of a DPC. + +## PAN-224955 + +Fixed an issue where the devsrvr process stopped responding when Zone Protection had more than 255 profiles. + +## PAN-224954 + +Fixed an issue where, after upgrading and rebooting a Panorama appliance in Panorama or Log Collector mode, managed firewalls continuously disconnected. + +## PAN-224938 + +Fixed an issue where the CLI command settings for set system setting logging max-log-rate did not persist after a mgmtsrvr process restart. + +## PAN-224882 + +Fixed an issue where the session end reason was incorrectly logged as decrypt-cert-validation for allowed sessions when the decryption profile was configured for a no-decrypt policy. + +## PAN-224788 + +Fixed an issue where the Power Supplies was not present in the show system environmentals CLI command output. + +## PAN-224772 + +Fixed a high memory usage issue with the mongodb process that caused an OOM condition. + +## PAN-224656 + +Fixed an issue where the devsrvr process caused delays when Dynamic Address Groups +with large entry lists were being processed during a commit, which +caused commits to take longer than expected. + +## PAN-224500 + +Fixed an issue where IPv6 addresses in XFF were displayed in Traffic logs. + +## PAN-224424 + +```caveat +PA-3440 firewalls only +``` + +Fixed an issue where you were unable to set the link speed as +25Gbps from the drop-down in the template for Ethernet ports 1/23 +through 1/26. + +## PAN-224405 + +Fixed an issue where the distributord process repeatedly stopped responding. + +## PAN-224404 + +Fixed an issue where a memory leak caused decryption failures when SSL Forward Proxy was +configured. + +## PAN-224365 + +Fixed an issue where excessive network path monitoring messages were generated in the system logs. + +## PAN-224354 + +Fixed an issue where a memory leak related to the distributord process occurred when connections flapped for IP address-to-username mapping redistribution. + +## PAN-224067 + +Fixed an issue where cookie authentication did not work for GlobalProtect when an authentication override domain was configured in the SAML authentication profile. + +## PAN-223914 + +Fixed an issue on Panorama where the reportd process unexpectedly stopped responding. + +## PAN-223856 + +```caveat +PA-800 Series firewalls only +``` + +( Fixed an issue where the GlobalProtect SSL tunnel failed. + +## PAN-223855 + +Fixed an issue where the show running ippool CLI command output +displayed incorrect used and available NAT IP address pools on DIPP +NAT policy rules in multidataplane firewalls. + +## PAN-223798 + +Fixed an issue on the firewall where, when Advanced Routing was enabled, PIM join messages were not sent to the RN due to a missing OIF. + +## PAN-223559 + +Fixed an issue where unexpected characters appeared in the text of +GlobalProtect application authentication prompts when the +GlobalProtect portal or gateway had a RADIUS authentication +profile. + +## PAN-223796 + +```caveat +PA-7000 Series firewalls with Log Forwarding Cards (LFC) only +``` + +Fixed an issue where multiple OOM conditions occurred which caused a system restart. + +## PAN-223559 + +Fixed an issue where unexpected characters appeared in the text of +GlobalProtect application authentication prompts when the +GlobalProtect portal or gateway had a RADIUS authentication +profile. + +## PAN-223481 + +```caveat +PA-5450 firewalls only +``` + +Fixed an issue where the all_pktproc process stopped responding when the firewall was on PAN-OS 10.1.9-h3 or a later release. + +## PAN-223432 + +Fixed an issue where SSL decryption for HTTP/2 sessions failed when enabling Send handshake messages to CTD for inspection (Device > Setup > Session > Decryption Settings > SSL Decryption Settings). + +## PAN-223365 + +Fixed an issue where Panorama was unbale to query any logs if the Elasticsearch health status for any log collector was degraded. + +## PAN-223271 + +Fixed an issue where the file transfer of large zipped and compressed files had the App-ID unknown-tcp. + +## PAN-223263 + +Fixed an issue on the web interface where the system clock for Mexico_city was displayed in CDT instead of CST on the management dashboard. + +## PAN-223259 + +Fixed an issue where selective pushes failed with the error message Failed to generate selective push configuration. Unable to retrieve last in-sync configuration for the device, either a push was never done or version is too old. Please try a full push. + +## PAN-223172 + +Fixed an issue on Panorama where host IDs manually added to the device quarantine list were unexpectedly removed. + +## PAN-223094 + +Fixed an issue where fragmented TCP traffic was dropped due to an IP address ID conflict over the SD-WAN tunnel. + +## PAN-222662 + +Fixed an issue where the CLI command debug log-card-interface pint slot host + did not return any information when +attempting to ping the Log Forwarding Card (LFC). + +## PAN-222586 + +```caveat +PA-5410, PA-5420, and PA-5430 firewalls only +``` + +Fixed an issue where +Filter drop-downs, Forward +Method, and Correlation log +settings (Device > Log Settings > +Correlation) were not displayed. + +## PAN-222188 + +A CLI command was introduced to address an issue where SNMP monitoring performance was slower +than expected, which resulted in +snmpwalk timeouts. + +## PAN-222089 + +Fixed an issue where you were unable to context switch from Panorama to the managed device. + +## PAN-221973 + +Fixed an issue where the same user connected to multiple SSL VPN connections and one of the sessions stopped working. + +## PAN-221938 + +Fixed an issue with network packet broker sessions where the broker session and primary session +timeouts were out of sync, which caused traffic drops if the broker +session timed out when the primary session was still active. + +## PAN-221897 + +Fixed an issue where duplicate entries were not detected during commits, which caused routing engine failure. + +## PAN-221881 + +Fixed an issue where log ingestion to Panorama failed, which resulted in missing logs under the Monitor tab. + +## PAN-221857 + +Fixed an issue where users were unable to log in to the GlobalProtect app using SAML authentication after upgrading to PAN-OS 10.2.3-h4, and the GlobalProtect logs displayed the following error message: Username from SAML SSO response is different from the input. + +## PAN-221728 + +Fixed an issue where selective pushes did not work after upgrading to PAN-OS 10.2.4. + +## PAN-221428 + +Fixed a memory leak issue where the packet buffer count continuously increased and the firewall required a restart to clear the buffers. + +## PAN-221190 + +```caveat +PA-800 Series firewalls only +``` + +Fixed an issue where the firewall rebooted due to I2C errors when unsupported optics were inserted in ports 5-8. + +## PAN-221186 + +Fixed an issue where BGP aggregate routes were not created and discard routes were not installed in the routing table. + +## PAN-221162 + +Fixed an issue where previewing changes before pushing to devices displayed a pop-up with the +message: Command succeeded with no +output. + +## PAN-221015 + +```caveat +M-600 Appliances only +``` + +Fixed an issue where ElasticSearch processes did not restart +when the appliance was rebooted, which caused the managed collector +ES health status to be downgraded. + +## PAN-220931 + +```caveat +Panorama appliances in FIPS-CC mode only +``` + +Fixed an issue where scheduled email reports did not contain PDF attachments. + +## PAN-220907 + +```caveat +VM-Series firewalls only +``` + +Fixed an issue where large packets were dropped from the dataplane to the management plane, which caused OSPF neighborship to fail. + +## PAN-220881 + +Fixed an issue where the CLI command show logging-status did not correctly display the last log created and forwarded timestamps. + +## PAN-220659 + +Fixed an issue on the firewall where scheduled antivirus updates failed when external dynamic +lists were configured on the firewall. + +## PAN-220619 + +Fixed an issue where the correct device filter did not apply when filtering Targets and Target/Tags (Device Group > Policies). + +## PAN-220553 + +Fixed an issue where, after enabling Advanced Routing Engine, the backup default route was not installed in the FIB table if static path monitoring went down. + +## PAN-220500 + +```caveat +PA-5450 and PA-400 firewalls only +``` + +Fixed an issue where the request shutdown system CLI command did not completely shut down the system. + +## PAN-220239 + +Fixed an issue where certificate-based logins to Panorama via the web interface failed. + +## PAN-219851 + +Fixed an issue where you were unable to export SAML metadata when configuring SAML authentication. + +## PAN-219768 + +Fixed an issue where you were unable to filter data filtering logs with Threat +ID/NAME for custom data patterns created over +Panorama. + +## PAN-219585 + +Fixed an issue where enabling syslog-ng debugs from the root caused 100% disk utilization. + +## PAN-219494 + +Fixed an issue with the firewall where adding Parent-App under Application Filter for Security policy rules did not add dependent applications. + +## PAN-219415 + +Fixed an issue where BGP routes were installed in the routing table even when the option to install routes was disabled in the configuration. + +## PAN-219351 + +Fixed an issue where the all_pktproc process stopped responding during Layer 7 +processing. + +## PAN-219260 + +```caveat +M-Series appliances only +``` + +Fixed an issue where the management interface flapped due to low memory reserved for kernel space. + +## PAN-219251 + +Fixed an issue where the ctd_dns_wait_pkt_drop counter increase was greater than expected. + +## PAN-219222 + +Fixed an issue where spaces in a certificate name caused imports to fail. + +## PAN-219113 + +Fixed an issue where, when a port on the NPC was configured for log forwarding, the ingress traffic on the card was sent for processing to the LPC, and the LPC card was reloaded when the ingress volume of traffic was high. + +## PAN-218873 + +Fixed an issue where a HIP mask was reused when an existing IP address user mapping was updated by a new IP address user mapping that had a different username but the same IP address. + +## PAN-218694 + +Fixed an issue where SaaS PR was reimported to the shared location and policy objects were not +updated with new updates coming from the SaaS cloud. + +## PAN-218659 + +Fixed an issue where Security zones under Interfaces displayed as none for dynamic group and template admin users in a read-only admin role. + +## PAN-218652 + +Fixed an issue on Panorama where the HA virtual address was not created for firewalls in active/active HA configurations. + +## PAN-218620 + +Fixed an issue where scheduled configuration exports and SCP server connection testing failed. + +## PAN-218611 + +Fixed an issue where the device telemetry region was not updated on the firewall when pushed from the Panorama template stack. + +## PAN-218555 + +Fixed an issue where the firewall did not receive dynamic address updates pushed from Panorama during initial registration to Panorama. + +## PAN-218352 + +Fixed an issue where Panorama was slower than expected when WildFire deployment was scheduled every minute to a large number of devices. + +## PAN-218119 + +Fixed an issue where the firewall transmitted packets with an incorrect source MAC address during commit operations. + +## PAN-218057 + +```caveat +PA-7000 Series firewalls only +``` + +Fixed an issue where internal path monitoring failed due to a heartbeat miss. + +## PAN-217728 + +Fixed an issue where uploading a certificate in a manual configuration option for SafenetHSM failed. + +## PAN-217652 + +Fixed an issue on Panorama where certificates created on Panorama were not pushed to the firewall with a selective push. + +## PAN-217619 + +Fixed an issue where supported Bi-DI transceivers were not recognized which caused ports to not +come up. + +## PAN-217541 + +Fixed an issue where the useridd process stopped responding after a restart when HIP redistribution was enabled. + +## PAN-217510 + +Fixed an issue where inbound DHCP packets received by a DHCP client interface that were not addressed to itself were silently dropped instead of forwarded. + +## PAN-217293 + +Fixed a rare issue where URLs were not accessible when the header length was greater than 16,000 over HTTP/2. + +## PAN-217289 + +Fixed an intermittent issue where HTTP/2 traffic caused buffer depletion. + +## PAN-217272 + +Fixed an issue where the DNS proxy log included an excessive number of the following error +message: Warning: pan_dnsproxy_log_resolve_fail: +Failed to resolve domain name ** AAAA after trying all attempts +to name servers + +## PAN-217241 + +Fixed an issue where predict session conversion failed for RTP and RTCP traffic. + +## PAN-217205 + +Fixed an issue where the firewall did not clear port reused sessions for GlobalProtect traffic with proxy fast-session-delete enabled. + +## PAN-217155 + +Fixed an issue where syncs between Panorama and the Cloud Identity Engine (CIE) caused intermittent slowness when using the web interface due to a large number of groups in the CIE directory. + +## PAN-217123 + +Fixed an issue where, when log queries in the yyyy/mm/dd format displayed extra digits for the day and an error was not generated. + +## PAN-217064 + +Fixed an issue where commits took longer than expected when the DLP plugin was configured. + +## PAN-217024 + +Fixed an issue where fetching device certificates failed for internal DNS servers with the error message ERROR Error: Could not resolve host: certificate.paloaltonetworks.com. + +## PAN-216647 + +Fixed an issue where the sysd node was updated at incorrect times. + +## PAN-216230 + +Fixed an issue where the shard count reached up to 10% over the limit rather than staying under the limit. + +## PAN-216077 + +A CLI command was added to configure the FEC for PA-5450 breakout ports. + +## PAN-215583 + +Fixed an issue on firewalls in HA configurations where the primary firewall went into a +nonfunctional state due to a timeout in the +pan_comm logs during the +policy-based forwarding (PBF) parse, which caused an HA +failover. + +## PAN-215576 + +Fixed an issue where the userID-Agent and TS-Agent certificates were set to expire on November 18, 2024. With this fix, the expiration date has been extended to January 2032. + +## PAN-215436 + +Fixed an issue with the web interface where the latest logs took longer than expected to display under Monitor. + +## PAN-214773 + +Fixed an issue where RTP packets traversing intervsys were dropped on the outgoing vsys. + +## PAN-214760 + +Fixed an issue where, when a firewall had more than 1,200 logical interfaces, commits failed with the error message: Error pre-installing config failed to handle CONFIG_COMMIT. + +## PAN-214311 + +Fixed an issue where users were able to add configurations via XML API even when a config lock was in place. + +## PAN-214177 + +Fixed an issue where template configurations were not properly pushed to the firewall during an export or push of the device configuration bundle. + +## PAN-213949 + +Fixed an issue where the VPN responder stopped responding when it received a CREATE_CHILD message with no security association (SA) payload. + +## PAN-213918 + +Fixed an issue where mlav-test-pe-file.exe was not detected by WildFire Inline ML. + +## PAN-213591 + +Fixed an issue where Request Categorization Change was not displayed under URL filtering logs when the Advanced URL Filtering license was applied. + +## PAN-213011 + +Fixed an issue where, when using multi-factor authentication (MFA) with RADIUS OTP, the challenge message Enter Your Microsoft verification code did not appear when accessing the GlobalProtect portal via browser. + +## PAN-212932 + +Fixed an issue where the firewall went into a restart loop with the following error message: failed to get mgt settings candidate: configured traffic quota of 0 MB is less than the minimum 32 MB. + +## PAN-212770 + +Fixed an issue on the firewall where the WildFire file size limit value did not match on the web interface and the CLI. + +## PAN-212580 + +```caveat +PA-7050 firewalls only +``` + +Fixed an issue where disk space filled up due to files under /opt/var/s8/lp/log/pan/ not being properly deleted. + +## PAN-212576 + +Fixed an issue where firewall HA clusters in active/active configurations with Advanced Routing enabled did not relay to ping requests sent to a virtual IP address. + +## PAN-211945 + +Fixed an issue where URL Filtering system logs showed the error message CURL ERROR: bind failed with errno 124: Address family not supported by protocol even though the PAN-DB cloud was connected. + +## PAN-211827 + +Fixed an issue where Dynamic Updates failed with the following error message: +CONFIG_UPDATE_INC: Incremental update to DP failed +please try to commit force the latest config. + +## PAN-211821 + +Fixed an issue on firewalls in HA configurations where committing changes after disabling the QoS feature on multiple Aggregate Ethernet (AE) interfaces caused the dataplane to go down. + +## PAN-211255 + +Fixed an issue third-party VPNC IPSec clients were disconnected after a few seconds for firewalls in active/active HA configurations. + +## PAN-210354 + +Fixed an issue where the routedd process stopped responding when executing the show static-route path-monitoring CLI command or when accessing the path monitoring records from the web interface (Network > Virtual Router > More Runtime Stats > Static Routing). + +## PAN-208085 + +Fixed an issue where the BFD peers were deleted during a commit from Panorama. This occurred because the pan_comm thread became deadlocked due to the same sysd object was handled during the commit. + +## PAN-207616 + +Fixed an issue on Panorama where, after selecting managed firewalls +and creating a new tag, the managed firewalls were automatically +unselected and any new tag that was created was applied to the +managed firewalls for which you initially created the tag. + +## PAN-207092 + +Fixed an issue where logging in using default credentials after changing to FIPS-CC for NSX-T firewalls did not work. + +## PAN-207003 + +Fixed an issue where the logrcvr process NetFlow buffer was not reset which resulted +in duplicate NetFlow records. + +## PAN-206639 + +Fixed an issue where the LFC and NPC remained stuck during bootup. + +## PAN-206041 + +```caveat +PA-7050 firewalls only +``` + +Fixed an issue where the ikemgr process stopped responding. + +## PAN-205041 + +Fixed an issue where DNS Security cloud service unavailable logs did not indicate the service name, status code, or error message in the DNS proxy log. + +## PAN-202361 + +Fixed an issue where packets queued to the pan_task process were still transmitted when the process was not responding. + +## PAN-202095 + +Fixed an issue on the web interface where the language setting is not retained. + +## PAN-202008 + +Fixed an issue where Traffic logs exported to CSV files contained inaccuracies and were not +complete. + +## PAN-198043 + +Fixed a rare issue where aBuildXmlCache job failed on the firewall. + +## PAN-196954 + +Fixed a memory leak issue related to the distributord process. + +## PAN-196840 + +Fixed an issue where exporting a Security policy rule that contained Korean language characters +to CSV format resulted in the policy description being in a +nonreadable format. + +## PAN-196395 + +```caveat +PA-5450 firewalls only +``` + +Fixed an issue where the firewall accepted 12 Aggregate +Ethernet interfaces, but you were unable to configure interfaces +9-12 via the web interface. + +## PAN-194912 + +Fixed an issue where the CLI command show applications list did not return any outputs. + +## PAN-194006 + +Fixed an issue on Panorama where *Commit Push** and Validate Push operations during a Push to Devices did not handle the configuration for shared objects, which resulted in an invalid configuration being pushed. + +## PAN-193004 + +Fixed an issue where /opt/pancfg partition utilization reached 100%, which caused access to the Panorama web interface to fail. + +## PAN-192188 + +```caveat +PA-5450 firewalls only +``` + +Fixed an issue where the show running resource-monitor ingress-backlogs CLI command failed with the following error message: Server error : Failed to intepret the DP response. + +## PAN-185249 + +Fixed an issue where Template Stack overrides (Dynamic Updates > App & Threats > Schedule) were not able to be reverted via the web interface. + +## PAN-182960 + +Additional error logs were added for an issue where, when multiple Panorama web interface sessions were opened, active lock did not show up on the web interface for any session. + +## PAN-172600 + +Fixed an issue where the CLI command show rule-hit-count did not provide all details of the rule from the device group. + +## PAN-171569 + +Fixed an issue where HIP matches were not recognized in an SSL decryption policy rule. diff --git a/web/data/issues/PAN-OS/addressed/11.0.5-h1_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.5-h1_2026-03-16.md new file mode 100644 index 0000000..4bf4af6 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.5-h1_2026-03-16.md @@ -0,0 +1,14 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.5-h1 +--- + +## PAN-261540 + +```caveat +PA-3400 Series firewalls only +``` + +Fixed an issue where the +firewall did not fully reboot after upgrading to PAN-OS 11.0.5. diff --git a/web/data/issues/PAN-OS/addressed/11.0.5-h2_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.5-h2_2026-03-16.md new file mode 100644 index 0000000..e1d79f6 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.5-h2_2026-03-16.md @@ -0,0 +1,10 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.5-h2 +--- + +## PAN-272809 + +A fix was made to address CVE-2024-0012 (PAN-SA-2024-0015) and +CVE-2024-9474. diff --git a/web/data/issues/PAN-OS/addressed/11.0.5_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.5_2026-03-16.md new file mode 100644 index 0000000..c47c55b --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.5_2026-03-16.md @@ -0,0 +1,399 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.5 +--- + +## PAN-255868 + +```caveat +PA-3400 Series firewalls only +``` + +Fixed an issue where the firewall entered maintenance mode after enabling kernel data collection during the silent reboot. + +## PAN-255577 + +Fixed an issue where push scope changes remained empty and Edit selections > +OK did not work for admin-based users after +upgrading Panorama. + +## PAN-253317 + +```caveat +VM-Series firewalls on Microsoft Azure environments only +``` + +Fixed an issue where you were unable to log in to the firewall after a private data reset. + +## PAN-251563 + +Added CPLD enhancement to capture external power issues. + +## PAN-251013 + +Fixed an issue on the web interface where the Virtual Router and Virtual System configurations for the template incorrectly showed as none. + +## PAN-249019 + +Fixed an issue where the all_pktproc process stopped responding, which caused the firewall to become unresponsive. + +## PAN-248427 + +Fixed an issue where push operations took longer than expected to complete. + +## PAN-248105 + +Fixed an issue where the GlobalProtect SSL VPN tunnel immediately disconnected due to a keep-alive timeout. + +## PAN-247403 + +```caveat +Panorama virtual appliances only +``` + +Fixed an issue where the push scope CLI command took longer than expected, which caused the web interface to be slow. + +## PAN-246772 + +Fixed an issue on the firewall where the dataplane went down due to a path monitor failure caused by an OOM condition related to the pan_task process. + +## PAN-246431 + +Fixed an issue where a Push to Device operation remained at the state None when performing a selective push to device groups and templates that included both connected and disconnected firewalls. + +## PAN-246215 + +Fixed an issue where the sleep time for a suspended pan_task process caused configuration and policy updates to be blocked. + +## PAN-245850 + +Fixed an issue on Panorama appliances in active/passive HA configurations where the firewalls entered an HA out-of-sync status and jobs failed on the passive appliance with the error message Could not merged running config from file. + +## PAN-245125 + +```caveat +VM-Series firewalls in Microsoft Azure environments only +``` + +Fixed an issue where file descriptors were not closed due to invalid configurations. + +## PAN-245041 + +Fixed an issue where the WF-500 appliance returned an error verdict for every sample in FIPS mode. + +## PAN-244907 + +Fixed an issue where ports did not go down when moving from an active state to a suspended state. + +## PAN-244894 + +Fixed an issue where turning off mprelay logging caused mprelay heartbeat failure. + +## PAN-244836 + +A knob was introduced to toggle the default behavior of BGP in the Advanced Routing stack to not suppress duplicate updates. By default, the prefix updates are suppressed for optimization. + +## PAN-244746 + +Fixed an issue where changes committed on Panorama were not reflected on the firewall after a successful push. + +## PAN-244622 + +Fixed an issue where FIB repush did not work with Advanced Routing enabled. + +## PAN-244548 + +Fixed an issue where ECMP sessions changed destination MAC addresses mid-session, which caused connections to be reset. + +## PAN-244227 + +Fixed an issue where inconsistent FIB entries across the dataplane were not detected. + +## PAN-243463 + +Fixed an issue where high Enhanced Application log traffic used excess system resources and +caused processes to not work. + +## PAN-242309 + +Fixed an issue where a higher byte count (s2c) was observed for DNS-Base application. + +## PAN-241018 + +```caveat +VM-Series firewalls in Microsoft Azure environments only +``` + +Fixed a Data Plane +Development Kit (DPDK) issue where interfaces remained in a +link-down stage after an Azure hot plug event. + +## PAN-240596 + +Fixed an issue where all_task stopped responding due to an invalid memory address. + +## PAN-240477 + +Fixed a temporary hardware issue that caused PAN-SFP-PLUS-CU-5M to not be able to link up on PA-3400 and PA-1400 Series firewalls. + +## PAN-240174 + +Fixed an issue where, when LSVPN serial numbers and IP address authentication were enabled, IPv6 address ranges and complete IPv6 addresses that were manually added to the IP address allow or exclude list were not usable after a restart of the gp_broker process or the firewall. + +## PAN-239662 + +Fixed an issue where the NSSA default route from the firewall was not generated to advertise even though the backbone area default route was advertised during a graceful restart. + +## PAN-239337 + +Fixed an issue where the log_index was suspended and corrupted BDX files flooded the +index_log. + +## PAN-238625 + +Fixed an issue where, when the physical interface went down, the SD-WAN Ethernet connection state +still showed UP/path-monitor due to the +Active URL SaaS monitor connection state remaining +UP/path-monitor. + +## PAN-238610 + +Fixed an issue with the Panorama virtual appliance where, after the mgmtsrvr +restarted on the passive appliance, stale IP address tags were +pushed to the connected firewalls with the message +clear all registered ip +addresses. + +## PAN-238592 + +```caveat +PA-3410 firewalls only +``` + +Fixed an issue where the firewall did not boot up after upgrading due to a TPM lockout condition that persisted for over 24 hours. + +## PAN-237991 + +Fixed an issue where the log collector sent fewer logs than expected to the syslog server. + +## PAN-237657 + +Fixed an issue with 100% CPU utilization in the varrcvr process that occurred during an incremental WildFire update. + +## PAN-237614 + +Fixed an issue on Panorama where the API command request system disk add failed. + +## PAN-237208 + +Fixed an issue where the reportd process stopped and the firewall rebooted. + +## PAN-236261 + +Fixed an issue where a proxy server was used for external dynamic list communication even when +the dataplane interface was configured through service routes. + +## PAN-236244 + +Fixed an issue where you were unable to select authentication profiles via the web interface. + +## PAN-235807 + +Fixed an issue where static ND entries were not reachable after a reboot. + +## PAN-235585 + +Fixed an issue where, when custom signatures and predefined signatures shared the same literal pattern part, the custom signature caused an incorrect calculation for the length of the predefined signature, which resulted in App-ID not detecting correctly. + +## PAN-234489 + +Fixed an issue where a User Principle Name (UPN) was incorrectly required in the pre-logon machine certificate. + +## PAN-234169 + +Fixed an issue where downloading files failed or was slower than expected due to malware scanning +even when the session was matched to a Security policy rule with no +Anti-Virus profile attached. + +## PAN-233684 + +Fixed an issue on Panorama where Push to Devices or Commit and Push operations took longer than expected on the web interface. + +## PAN-233207 + +Fixed an issue where the configd process stopped responding when a partial configuration revert operation was performed. + +## PAN-231439 + +Fixed an issue where, when a VoIP call using dynamic IP and NAT was put on hold, the audio became one-way due to early termination of NAT ports. + +## PAN-229832 + +Fixed an intermittent issue where MLAV and URL cloud connectivity were lost. + +## PAN-228624 + +Fixed an issue where FIB entries were deleted due to a sysd process connection error. + +## PAN-228386 + +Fixed an issue with session caching where the reportd process stopped responding due to null values. + +## PAN-228043 + +Fixed an issue on firewalls on active/active HA configurations where packets dropped during +commit operations when forwarding traffic via an HA3 link when an +Aggregate Ethernet interface or data interface was used as an HA3 +link. + +## PAN-227641 + +Fixed an issue where Preview Changes and Change Summary when saving changes did not open a new window when clicked. + +## PAN-227233 + +Fixed an issue where the combination signature aggregation criteria in a Vulnerability Protection +profile was incorrectly blank even though a value was set. + +## PAN-226489 + +Fixed an issue where Panorama was unable to push scheduled Dynamic Updates to firewalls with the +error message Failed to add deploy job. Too many (30) +deploy jobs pending for device. + +## PAN-226260 + +Fixed an issue where support for CBC ciphers with some authentication algorithms was only available in FIPS mode. + +## PAN-226108 + +Fixed an issue where the masterd process was unable to start or stop the sysd process. + +## PAN-225963 + +Fixed an issue where the IP address-to-user mapping was not correct. + +## PAN-225228 + +Fixed an issue where filtering Threat logs using any value under THREAT +ID/NAME displayed the error Invalid +term. + +## PAN-223418 + +Fixed an issue where heartbeats to the brdagent process were lost, resulting in the +process not responding, which caused the firewall to reboot. + +## PAN-222253 + +Fixed an issue on Panorama where policy rulebase reordering under View Rulebase by Groups (Policy > ) did not persist if you reordered the policy rulebase by dragging and dropping individual policy rules and then moved the entire tag group. + +## PAN-221571 + +Fixed an issue on the web interface where the Security policy rule hit count remained at 0 for +some rules even though the Traffic logs showed live hits. + +## PAN-221041 + +Fixed an issue where the following error message was seen frequently in the system logs: Clearing snmpd.log due to log overflow. + +## PAN-221003 + +Fixed an issue where you were unable to uncheck firewalls in HA configurations from the device group when Group HA Peers was enabled. + +## PAN-220640 + +```caveat +PA-220 firewalls only +``` + +Fixed an issue where the firewall CPU percentage was miscalculated, and the values that were displayed were incorrect. + +## PAN-220601 + +Fixed an issue with missing logs when one log collector in a log Collector Group became +unreachable. + +## PAN-219690 + +Fixed an issue where GlobalProtect authentication failed when authentication was SAML with CAS and the portal was resolved with IPv6. + +## PAN-218521 + +```caveat +M-600 Appliances in Log Collector mode only +``` + +) Fixed an issue where Panorama continuously rebooted and became unresponsive, which consumed excessive logging disk space and prevented new log ingestion. + +## PAN-218331 + +Fixed an issue where you were unable to export or download packet captures from the firewall when context switching from Panorama. + +## PAN-217674 + +Fixed an issue where RADIUS authentication failed when the destination route of the service route was configured with an IPv4 address with more than 14 characters. + +## PAN-217489 + +Fixed an issue with firewalls in active/passive HA configurations where the passive firewall MAC flapping occurred when the passive firewall was rebooted. + +## PAN-215905 + +```caveat +PA-3400 Series firewalls only +``` + +Fixed an issue where silent packet drops were observed on interfaces. + +## PAN-215430 + +Fixed an issue where dynamic IP address NAT with SIP intermittently failed to convert RTP Predict +sessions. + +## PAN-214682 + +Fixed an issue where the firewall sent incorrectly encoded the supported_groups extension in the Client Hello when acting as a forward proxy with decryption profile max version TLSv1.2. + +## PAN-213173 + +Fixed an issue where Preview Changes under Scheduled Pushes did not launch the Change Preview window. + +## PAN-212553 + +Fixed an issue where the ikemgr process stopped responding due to memory corruption, which caused VPN tunnels to go down. + +## PAN-209574 + +Fixed an issue with HTTP2 traffic where downloading large files did not work when decryption was enabled. + +## PAN-207972 + +Fixed an issue on the web interface where the BGP routing table did not display advertised routes. + +## PAN-205482 + +Fixed an issue related to the configd process where Panorama displayed the error +Server not responding when editing policy +rules. + +## PAN-200946 + +Fixed an issue with firewalls in active/passive HA configurations where GRE tunnels went down due to recursive routing when the passive firewall was booting up. When the passive firewall became active and no recursive routing was configured, the GRE tunnel remained down. + +## PAN-196146 + +```caveat +VM-Series firewalls only +``` + +Fixed an issue where hostname validation failed due to the firewall not taking the hostname provided in init.cfg. + +## PAN-194968 + +Fixed an issue on the web interface where Antivirus updates were not able to be downloaded and installed unless Apps and Threads updates were downloaded and installed first, and the Antivirus content list displayed as blank. The resulting error message from the update server was also not reflected in the web interface. + +## PAN-174454 + +Fixed an issue where the firewall did not fetch group and user membership due to the Okta sync domain not matching the active directory sync domain. diff --git a/web/data/issues/PAN-OS/addressed/11.0.6-h1_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.6-h1_2026-03-16.md new file mode 100644 index 0000000..f9c778f --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.6-h1_2026-03-16.md @@ -0,0 +1,10 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.6-h1 +--- + +## PAN-272809 + +A fix was made to address CVE-2024-0012 (PAN-SA-2024-0015) and +CVE-2024-9474. diff --git a/web/data/issues/PAN-OS/addressed/11.0.6_2026-03-16.md b/web/data/issues/PAN-OS/addressed/11.0.6_2026-03-16.md new file mode 100644 index 0000000..04a7567 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.0.6_2026-03-16.md @@ -0,0 +1,17 @@ +--- +type: Addressed +product: PAN-OS +version: 11.0.6 +--- + +## PAN-254181 + +```caveat +CN-Series firewalls only +``` + +Fixed an issue where firewall pods and application pods repeatedly restarted. + +## PAN-253400 + +Fixed an issue where the logrcvr process stopped responding. diff --git a/web/data/products.json b/web/data/products.json index 9e8ade8..7d4fc49 100644 --- a/web/data/products.json +++ b/web/data/products.json @@ -174,6 +174,44 @@ "11.1.12_2026-03-16.md", "11.1.13_2026-03-16.md" ] + }, + "11.0": { + "addressed": [ + "11.0.0_2026-03-16.md", + "11.0.0-h1_2026-03-16.md", + "11.0.0-h2_2026-03-16.md", + "11.0.0-h3_2026-03-16.md", + "11.0.0-h4_2026-03-16.md", + "11.0.1_2026-03-16.md", + "11.0.1-h2_2026-03-16.md", + "11.0.1-h3_2026-03-16.md", + "11.0.1-h4_2026-03-16.md", + "11.0.1-h5_2026-03-16.md", + "11.0.2_2026-03-16.md", + "11.0.2-h1_2026-03-16.md", + "11.0.2-h2_2026-03-16.md", + "11.0.2-h3_2026-03-16.md", + "11.0.2-h4_2026-03-16.md", + "11.0.2-h5_2026-03-16.md", + "11.0.3_2026-03-16.md", + "11.0.3-h1_2026-03-16.md", + "11.0.3-h3_2026-03-16.md", + "11.0.3-h5_2026-03-16.md", + "11.0.3-h10_2026-03-16.md", + "11.0.3-h12_2026-03-16.md", + "11.0.3-h13_2026-03-16.md", + "11.0.4_2026-03-16.md", + "11.0.4-h1_2026-03-16.md", + "11.0.4-h2_2026-03-16.md", + "11.0.4-h5_2026-03-16.md", + "11.0.4-h6_2026-03-16.md", + "11.0.5_2026-03-16.md", + "11.0.5-h1_2026-03-16.md", + "11.0.5-h2_2026-03-16.md", + "11.0.6_2026-03-16.md", + "11.0.6-h1_2026-03-16.md" + ], + "known": [] } }, "10": {