Fixes were made to address the following CVEs:

• CVE-2026-0283
• CVE-2026-0287
• CVE-2026-0279
• CVE-2026-0282
• CVE-2026-0288
• CVE-2026-0286
• CVE-2026-0285
• CVE-2026-0280
• CVE-2026-0284
• CVE-2026-0281

(Firewalls in active/passive configurations only) Fixed an issue where NTP status intermittently showed as rejected on the active firewall, which prevented the firewalls from synchronizing time.

Fixed an issue where traffic was blocked due to a mismatch between the URL category specified in the Security policy rule and the URL filter profile when custom URL categories with the same FQDN were configured.

Fixed an issue where the firewall generated two URL logs for a single session.

Fixed an issue where the iotd process failed to install DPI Cloud server FQDN due to a configuration parsing failure, caused by the configuration XML memory buffer not being NULL terminated. This resulted in the accumulation of EAL logs and DLP forwarding being stopped.

Fixed an issue where, when SSL decryption was enabled, traffic matching a deny rule was incorrectly allowed until the SSL handshake was complete.