Fixes were made to address the following CVEs:

• CVE-2026-0283
• CVE-2026-0287
• CVE-2026-0279
• CVE-2026-0282
• CVE-2026-0288
• CVE-2026-0286
• CVE-2026-0285
• CVE-2026-0280
• CVE-2026-0284
• CVE-2026-0281

Fixed an issue where the all_task process stopped responding.

Fixed an issue where a selective push from Panorama to the firewall was successful even when applying rename operation failed in selective push, which resulted in configurations on the firewall being deleted. With this fix, the selective push will fail when applying rename operation fails.

Fixed an issue where the sslmgr process stopped responding when attempting to display the OSCP host cache.

Fixed an issue where IDE traffic did not function as expected when both HTTP head insertion and DLP inspection were enabled.

Fixed an issue where multicast radio RTP based traffic was dropped after an upgrade when the firewall performed Cloud Inline inspection, which led to an exceeded session queue for Cloud Threat Detection.

Fixed an issue where processes stopped responding unexpectedly.

Fixed an issue where device telemetry intermittently failed to send files, which resulted in critical alerts in system files.

(PA-7500 firewalls in HA cluster configurations only) Fixed an issue where, when one firewall suspended operations, the other firewall also suspended operations instead of initiating a failover, which resulted in a complete traffic outage.

Fixed an issue where the dataplane restarted due to a race condition in the dataplane cache infrastructure.

(Firewalls in FIPS mode only) Fixed an issue where GlobalProtect unexpectedly prompted for RADIUS authentication instead of client certificate authentication due to an OSCP validation error and subsequent CRL verification failure, which led to certificates being marked as invalid.

Fixed an issue where an ethernet interface remained in a down state after repeated automated enable/disable cycles and required manual intervention, which resulted in backup outages.

Fixed an issue where internal and external DNS names did not resolve when connected to a GlobalProtect gateway.

(PA-7500 Series firewalls in vwire mode only) Fixed an issue where Oracle application traffic was intermittently not processed even though connected devices sent the traffic, which led to service distruptions.

Fixed an issue where, after upgrading to PAN-OS 12.1.5, GlobalProtect Clientless VPN failed to access JavaScripts.

Fixed an issue where telemetry data was not sent to the cloud due to the firewall being unable to resolve the destination server's FQDN even when a proxy server was configured. With this fix, the firewall properly sends telemetry data through the configured proxy server without requiring direct public DNS resolution for the telemetry server's FQDN.

(Firewalls in active/passive HA configurations only) Fixed an issue where active firewalls were unable to send device telemetry data to CDL.

Fixed an issue where the firewall rebooted unexpectedly without any configuration or power changes.

(Prisma Access Gateways only) Fixed an issue where the global management plane stopped responding, which caused SSH and HTML disconnections, HIP database lookup failures, and significantly slower SCM commits. This occurred when egress IP allow listing was enabled in SCM and changes were made to EDLs.

Fixed an issue where a DPC in Slot 4 restarted repeatedly, which caused internal path monitoring failures and a failover event.

Fixed an issue where External Dynamic List (EDL) refresh and commit operations remained in a pending state, which prevented any subsequent operations from completing.

Fixed an issue where processes restarted and the firewall unexpectedly rebooted when you configured a Security policy rule with Source Device > quarantine.

(Firewalls in HA configurations only) Fixed an issue where the secondary firewall remained at an Initial state after an upgrade.

Fixed an issue where SSL traffic was silently dropped when traffic was processed by a Security policy with an Anti-Spyware profile that had Inline cloud Analysis enabled for SSL C2 Detector with an action other than allow or alert.

Fixed an issue where SCM did not update device telemetry for the firewall after upgrading to an affected release.

Fixed an issue on Panorama where selective push operations failed when plugin configurations included access-domain or log-collector references.

(PA-5450 firewalls and PA-7000 Series firewalls with 100G NPCs only) Fixed an issue where intermittent packet loss occurred when traversing the dataplane after upgrading the firewall. This occurred when a dataplane HA interface was configured in an environment where Slot 1 was unpopulated , which resulted in a wildcard entry being created within the QMAP table.

Fixed an issue where high throughput and increased packet rates caused high dataplane CPU usage.

Fixed an issue where the firewall restarted unexpectedly due to an OOM condition after upgrading to an affected release.

Fixed an issue where, after Advanced Routing was enabled, the firewall advertised routes to internal BGP neighbors with the original external BGP next-hop address.

Fixed an issue where GlobalProtect throughput was reduced after an upgrade.

(PA-7500 firewalls only) Fixed an issue where zone protection threshold values per dataplane were unexpectedly low.

Fixed an issue where, when a push operation from Panorama to the firewall failed, accounting logs stopped forwarding.

(PA-7500 firewalls only) Fixed an issue where internal path monitoring logs incorrectly reported internal path monitoring failures when they did not occur.

Fixed an issue where the configd process stopped responding after pushing configuration changes from Panorama to the firewall.

(Firewalls in active/passive HA configurations only) Fixed an issue where, after a failover, routing information within OSPF protocol was not correctly translated or propagated, which affected network path convergence and FRR capabilities.

Fixed an issue where the GlobalProtect portal became inaccessible when the dataplane was configured with a DHCP assigned IP address.

Fixed an issue where running BCM counter commands from the administrative shell did not consistently return output, and commands to modify queue sizes did not take effect.

Fixed an issue where some system log filters with the eventid operator for a BGP event did not work.

Fixed an issue where Panorama pushed commits took longer than expected to complete without displaying an error message when committing due to slow cloud-app compilation.

Fixed an issue where 10G connections on built-in RJ45 interfaces (ethernet1/1 through ethernet1/5) intermittently experienced interface flapping when connected to Cisco switchports.

Fixed an issue where generating a tech support file caused GlobalProtect users to be forcibly logged out.

Fixed an issue where firewalls acting as an accumulation proxy sent a server hello with an earlier TCP timestamp value than a preceding ACK packet, which prevented successful session establishment. This occurred when the client hello messages were split across multiple network segments.

To use this fix, run the CLI command debug dataplane set ssl-decrypt accumulate-client-hello ts-relay yes.

Added the following CLI commands to address QoS packet drops due to bursty traffic:

To utilize this fix, change the parameters, disable QoS, commit changes, enable QOS, and then re-commit changes.

Fixed an issue where the firewall dataplane continuously accumulated packets in the ctd_pkt_queue and packet buffers, which caused resource exhaustion and prematurely terminated sessions.

Fixed an issue where 403 errors occurred when performing "show config effective-running" API query after downgrading to an affected PAN-OS release.

(Firewalls in active/passive HA configurations only) Fixed an issue where the Clientless VPN applications failed to load due to the firewall dataplane incorrectly processing session information.

Fixed an issue where, during a commit, the firewall intermittently stopped sending SNMP messages, which caused interface counters to stop updating for brief periods of time.

Fixed an issue where the reportd process stopped responding, which caused the firewall to reboot.

Fixed an issue where the recommended filter for identifying traffic from unidentified users in traffic logs reported an incorrectly low number of results.

Fixed an issue where software packet buffers were completely utilized when performing a Data Loss Prevention longevity test.

Fixed an issue where upgrades to managed firewalls from Panorama failed.

(Firewalls in active/passive configurations only) Fixed an issue where NTP status intermittently showed as rejected on the active firewall, which prevented the firewalls from synchronizing time.

Fixed an issue where pushing multiple policy rules failed when the policy rules contained a large number of dynamic address object groups or user groups.

Fixed an issue where LED indicators on combo ports remained off even when the network link was active.

Fixed an issue where the firewall did not redistribute its application routes to BGP peers. This occurred in multi-mesh deployments with the multi-cloud networking feature enabled.

Fixed an issue on the Panorama web interface where you were unable to delete or change a logical router for tunnel, SD-WAN, VLAN, or loopback interfaces under a template.

Fixed an issue where the timestamp value in SNMPv3 trap headers was incorrect.

To use this fix, run the CLI command debug log-receiver enginetime-from-snmptime yes.

Fixed an issue where GlobalProtect users were unable to connect

Fixed an issue where a memory leak occurred when processing device and vsys tags.

Fixed an issue where VXLAN traffic failed and packet loss occurred in networks sensors after upgrading to an affected release.

Fixed a duplicate MAC address issue where an ethernet interface sent out Gratuitous ARP (GARP) messages for an IP address that was not configured on it.