--- type: Addressed product: PAN-OS version: 8.1.20 source: common-crawl crawl: CC-MAIN-2026-12 --- ## WF500-5568 Fixed an issue where a firewall in FIPS mode running PAN-OS 8.1.18 or a later version failed to connect with a WildFire appliance in normal mode. ## PAN-168921 Fixed an issue in active/active high availability (HA) configuration where traffic with complete packets was showing up as incomplete and being disconnected due to a non-session owner device closing the session prematurely. ## PAN-167989 Fixed a timing issue between downloading and installing threads that occurred when Panorama pushed content updates and the firewall fetched content updates simultaneously. ## PAN-166836 Fixed an issue where session failed due to resource unavailability. ## PAN-166299 ```caveat PA-3000 Series firewalls only ``` Fixed an issue where Server Message Block (SMB) sessions failed due to resource unavailability. ## PAN-166241 A fix was made to address an improper restriction of XML external identity (XXE) reference in the PAN-OS web interface that enabled an authenticated administrator to read any arbitrary file from the file system and send a specifically crafted request to the firewall that caused the service to crash ([CVE-2021-3055](https://security.paloaltonetworks.com/CVE-2021-3055)). ## PAN-164922 Fixed an issue on Panorama where a context switch to a managed firewall running PAN-OS 8.1.0 to PAN-OS 8.1.19 failed. ## PAN-164846 Fixed an issue where packet buffers were depleted. ## PAN-164422 ```caveat VM-Series firewalls only ``` A fix was made to address improper access control that enabled an attacker with authenticated access to GlobalProtect portals and GlobalProtect gateways to connect to the EC2 instance metadata endpoint for VM-Series firewalls hosted on Amazon Web Services (AWS) ([CVE-2021-3062](https://security.paloaltonetworks.com/CVE-2021-3062)). ## PAN-160744 Fixed an issue where the negative time difference between the dataplane and the management plane during the client certificate info check prevented the GlobalProtect client from connecting to the GlobalProtect gateway with the following error message: Required client certificate not found. ## PAN-160708 Fixed an issue where the dataplane restarted after configuring a a **deny_all** policy. ## PAN-158723 A fix was made to address an improper handling of exception conditions in the PAN-OS dataplane that enabled an unauthenticated network-based attacker to send specifically crafted traffic through the firewall that caused the service to crash ([CVE-2021-3053](https://security.paloaltonetworks.com/CVE-2021-3053)). ## PAN-158262 A buffer overflow vulnerability in the Telnet-based administrative management service included with PAN-OS software allows remote attackers to execute arbitrary code. A fix was made to address a buffer overflow vulnerability in the Telnet-based administrative management service included with PAN-OS that allowed a remote attacker to execute arbitrary code ([CVE-2020-10188](https://security.paloaltonetworks.com/CVE-2020-10188)). ## PAN-157834 Fixed an issue with missing zone entries in CSV or PDF export files. ## PAN-157730 Fixed an issue where, after a firewall reboot, a commit or auto-commit operation failed with the following error message: ID population failed. This issue occurred because the Phase1 ID assignment failure did not trigger an idmgr reset. ## PAN-157632 Fixed an intermittent issue where the firewall dropped GPRS Tunneling Protocol (GTP-U) traffic with the message TEID=0x00000000. ## PAN-157346 Fixed an issue where HIP custom checks for plist failed when the HIP exclusion category were configured under (**Mobile User Template > Network > GlobalProtect > Portal > Agent > HIP Data Collection**). ## PAN-156225 ```caveat PA-3200 Series firewalls only ``` Fixed an issue where the HA1-B port remained down after an upgrade from PAN-OS 9.1.4 to later 9.1 releases and from PAN-OS 10.0.0 to PAN-OS 10.0.4. ## PAN-155532 Fixed an issue where the mgmtsrv process restarted due to a missing protective check around access to potentially NULL pointers. ## PAN-154526 Fixed an issue where a process (genindex.sh) caused high memory usage on the management plane. Due to the resulting out-of-memory (OOM) condition, multiple processes stopped responding. ## PAN-154376 Fixed an issue where a process (mgmtsrvr) stopped responding and was inaccessible through SSH or HTTPS until the firewall was power cycled. ## PAN-153908 ```caveat PA-5000 Series firewalls only ``` Fixed an issue where the show vpn flow CLI command displayed incorrect details. ## PAN-153382 Fixed an issue where the per-minute resource monitor was three minutes behind. ## PAN-153261 Fixed an issue where not all fragmented packets were transmitted, which caused increased packet buffer usage. ## PAN-153107 Fixed an issue where a dataplane process stopped responding while processing fragmented traffic on GTP-U tunnels. ## PAN-151120 Fixed an issue where the SYN-ACK packet matched stale entries in the session flow table and was dropped on the firewall with the following error message: Inactive flow state 0. ## PAN-150337 A fix was made to address a reflect cross-site scripting (XSS) vulnerability in the PAN-OS web interface that enabled an authenticated network-based attacker to mislead another authenticated PAN-OS administrator to click on a specially crafted link that performed arbitrary actions in the web interface as the targeted authenticated administrator ([CVE-2021-3052](https://security.paloaltonetworks.com/CVE-2021-3052)). ## PAN-149501 A fix was made to address a memory corruption vulnerability in the GlobalProtect Clientless VPN that enabled an authenticated attacker to execute arbitrary code with root user privileges during SAML authentication ([CVE-2021-3056](https://security.paloaltonetworks.com/CVE-2021-3056)). ## PAN-147221 Improved QoS scheduling for Bidirectional Forwarding Detection (BFD) and BGP to address the internal handling of BGP and BFD packets under high resource constraints ## PAN-146250 Fixed an issue where, in two separate but simultaneous sessions, the same software packet buffer was owned and processed. ## PAN-146107 Fixed an issue where memory allocation failure caused a process (pan_comm) to restart several times, which caused the firewall to restart. ## PAN-143426 Fixed a memory leak issue where a process (devsrvr) restarted due to the memory limit being exceeded. ## PAN-138727 A fix was made to address a time-of-check to time-of-use (TOCTOU) race condition in the PAN-OS web interface that enabled an authenticated administrator with permission to upload plugins to execute arbitrary code with root user privileges ([CVE-2021-3054](https://security.paloaltonetworks.com/CVE-2021-3054)). ## PAN-128634 A debug command was added to provide more verbose output when troubleshooting packet processing on the firewall. ## PAN-120013 Fixed an issue where secure communication settings were incorrectly synchronized between Panorama appliances in an HA configuration. ## PAN-119922 Fixed an issue in Panorama where the show config diff command was not working correctly and produced unexpected output. ## PAN-118667 Fixed an issue where firewall policy configurations displayed **[object Object]** instead of the object names. ## PAN-115541 Fixed an issue where removing a cipher from an SSL/TLS profile did not take effect if it was attached to the management interface. ## PAN-110429 Fixed an issue with firewalls in an HA configuration where multiple all_pktproc processes stopped responding due to missing heartbeats, which caused service outages.