--- type: Addressed product: PAN-OS version: 10.1.5 source: common-crawl crawl: CC-MAIN-2026-12 --- ## PAN-189769 Fixed an issue on Amazon Web Services (AWS) Gateway Load Balancer (GWLB) deployments with overlay routing enabled where, when a single firewall was the backend of multiple GWLBs, packets were re-encapsulated with an incorrect source IP address. ## PAN-189665 ```caveat FIPS-CC enabled firewalls only ``` Fixed an issue where the firewall was unable to connect to log collectors after an upgrade due to missing cipher suites. ## PAN-189468 Fixed an issue where the firewall onboard packet processor used by the PAN-OS content-inspection (CTD) engine can generate high dataplane resource usage when overwhelmed by a session with an unusually high number of packets. This can result in resource-unavailable messages due to the content inspection queue filling up. Factors related to the likelihood of an occurrence include enablement of content-inspection based features that are configured in such a way that might process thousands of packets in rapid succession (such as SMB file transfers). This can cause poor performance for the affected session and other sessions using the same packet processor. PA-3000 series and VM-Series firewalls are not impacted. ## PAN-189230 ```caveat VM-Series firewalls only ``` Fixed an issue that caused the pan_task process to stop responding with floating point exception (FPE) when there was a module of 0 on the queue number. ## PAN-188883 Fixed an issue where, when pre-generated license key files were manually uploaded via the web interface, they weren't properly recognized by PAN-OS and didn't display a serial number or initiate a reboot. ## PAN-187894 ```caveat VM-Series firewalls only ``` Fixed an issue with vm_license_response.log that consumed a large portion of the root partition. ## PAN-187769 ```caveat VM-Series firewalls in Microsoft Azure environments only ``` Fixed a Data Plane Development Kit (DPDK) issue where interfaces remained in a link-down state after an Azure hot plug event. This issue occurred due to a hot plug of Accelerated Networking interfaces on the Azure backend caused by host updates, which led to Virtual Function unregister/Register messages on the VM side. ## PAN-187438 ```caveat PA-5400 Series firewalls only ``` Fixed an issue where HSCI interfaces didn’t come up when using BiDi transceivers. ## PAN-186785 Fixed an issue where, after logging in, Panorama displayed a 500 error page after five minutes of logging for dynamic group template admin types with access to approximately 115 managed devices or 120 dynamic groups. ## PAN-186725 Fixed an issue where index creation failed when Elasticsearch attempted to create a new index with a duplicate index name. ## PAN-186646 ```caveat PA-5400 Series firewalls only ``` Fixed an issue where traffic flow through IKE NATT IPSec S2S tunnels broke on tunnel rekey with multiple data processing cards (DPC). ## PAN-186516 Fixed an issue where log queries that included WildFire submission logs returned more slowly than expected. ## PAN-186402 ```caveat PA-440 Series firewalls only ``` Fixed an issue where the firewall's maximum tunnel limit was incorrect. ## PAN-185750 Updated an issue to eliminate failed pan_comm software issues that caused the dataplane to restart unexpectedly ## PAN-185726 Fixed an issue where the dataplane exited during IPSec encapsulation and decapsulation offload operations. ## PAN-185695 ```caveat PA-5400 Series firewalls only ``` Fixed an issue where up to 75% traffic loss occurred on GlobalProtect tunnels with multiple DPCs. ## PAN-185359 Fixed an issue where you were unable to reference shared address objects as a BGP peer address (**Virtual Router > BGP > Peer Group > Peer Address**). ## PAN-185164 Fixed an issue where processing corrupted IoT messages caused the wificlient process to restart. ## PAN-185163 Fixed an issue where the distributord process hit the FD limit, which caused User-ID redistribution to not function properly. ## PAN-184761 Fixed an issue where Security policies were deleted on managed devices upon a successful push from Panorama to multiple device groups. This occurred when the Security policies had **device_tags** selected in the target section. ## PAN-184445 Fixed an issue where, after upgrading the Panorama, tagged address objects used in dynamic address groups were removed after a full commit and push. This issue occurred when the setting **Share Unused Address and Service Objects with Devices** was left unchecked. ## PAN-184432 Fixed an issue where the logrcvr process stopped responding due to a heartbeat failure that was caused by sysd nodes being stuck on logdb_writers for system, configuration, and alarm logs. ## PAN-184224 Fixed an issue on Panorama where you were unable to select a template variable in **Templates > Device > Log Forwarding Card > Log Forwarding Card Interface > Network > IP address location**. ## PAN-184076 Fixed an issue on the firewall web interface where logs were delayed when querying for logs. ## PAN-184047 Fixed an issue where Terminal Service agent (TS agent) connections with a certificate profile and the certificate chain on the TS agent failed. This occurred because common name validation and key usage checks were being performed in the root or intermediate certificate. ## PAN-183774 Fixed an memory leak issue in the mgmtsrvr process, which resulted in an out-of-memory (OOM) condition and high availability (HA) failover. ## PAN-183428 Fixed an issue where, when exporting or pushing a device configuration bundle from Panorama, a validation error occurred with GlobalProtect gateway inactivity logout time. ## PAN-183239 Fixed an issue where the firewall randomly disconnected from the WildFire URL cloud. ## PAN-183112 Fixed an issue where the threat log type ml-virus wasn't forwarded to Panorama or to external servers. ## PAN-182954 ```caveat PA-7000 Series firewalls with Log Processing Cards (LPC) only ``` Fixed an issue where excessive threat ID lookups caused logs to be lost. ## PAN-182903 Fixed an issue where SD-WAN failover on a hub or branch in full mesh took longer than expected. ## PAN-182732 Fixed an issue where the GlobalProtect gateway inactivity timer wasn't refreshed even though traffic was passing through the tunnel. ## PAN-182634 ```caveat PA-400 Series firewalls only ``` Fixed an issue where the firewall detected a Power Supply Unit (PSU) failure for the opposite side when disconnecting a PSU from the device. This issue occurred when redundant PSUs were connected. ## PAN-181839 Fixed an issue where Panorama Global Search reported **No Matches found** while still returning results for matching entries on large configurations. ## PAN-181802 Fixed an issue where a memory utilization condition resulted in the web interface responding more slowly than expected and management server restarting. ## PAN-181706 Fixed an issue where the logrcvr process stopped responding after upgrading to PAN-OS 10.1. ## PAN-181579 Fixed an issue with the GlobalProtect gateway where the time-to-live (TTL) limit expired faster than real-time limit. As a result, a reconnection was required before the expected lifetime expiration. ## PAN-181558 Fixed an issue where the stats dump file was not generated properly. ## PAN-181360 Fixed an issue where staggering scheduled dynamic updates from Panorama to firewalls only worked for the first scheduled group and failed for the remaining groups of the same type. ## PAN-181116 Fixed memory corruption issues in PAN-OS 10.1.3 and 10.1.4 that caused the pan_comm process to stop responding and the dataplane to restart. These issues also caused GlobalProtect tunnels to fall back to SSL instead of IPSec due to the inadvertent encapsulation of the ICMP keepalive response from the firewall. ## PAN-181039 Fixed an issue with DNS cache depletion that caused continuous DNS retries. ## PAN-180916 Fixed an issue where DNS security caused the TTL value of the pointer record (PTR) to be overwritten with a value of 30 seconds. ## PAN-180760 Fixed an issue where users were unable to SSH to the firewall and encountered the following error message: Could not chdir to home directory /opt/pancfg/home/user: Permission denied. ## PAN-180095 Fixed an issue where Panorama serial-number-based redistribution agents did not redistribute HIP reports. ## PAN-179982 Fixed an issue where an OOM condition occurred due to quarantine list redistribution. ## PAN-179976 Fixed an issue where the WildFire Inline Machine Learning (ML) did not detect mlav-test-pe-file.exe when traffic was decrypted. ## PAN-179899 Fixed an issue where updating the master key did not update the SD-WAN preshared key (PSK). ## PAN-179886 Fixed an issue where new tunnels were unable to be established for Elasticsearch due to faulty logic that prevented old tunnels to be removed when a node went down. ## PAN-179413 Fixed an issue where GRE tunnels flapped during commit jobs. ## PAN-179321 A validation error was added to inform an administrator when a policy field contained the value **any**. ## PAN-179274 Fixed an issue on high availability configurations where, after upgrading to PAN-OS 9.1.10, PAN-OS 10.0.6, or PAN-OS 10.1.0, the HA1 and HA1-Backup link stayed down. This issue occurred when the peer firewall IP address was in a different subnet. ## PAN-179260 Fixed an issue where admins and other Superusers were unable to remove a commit lock that was taken by another admin user with the format . As a result, deleting the commit lock failed. ## PAN-179164 Fixed an issue where a web-proxy port number was added to the destination URL when captive portal authentication was run. ## PAN-179059 Fixed an issue where you were unable to delete dynamic address groups one at a time using XML API. ## PAN-178947 Fixed an issue where the useridd process stopped responding when a NULL reference attempted to be dereferenced. This issue occurred to IP address users being added. ## PAN-178860 Fixed an issue where quarantined devices appeared in the CLI but not the web interface. ## PAN-178672 Fixed an issue where a process (useridd) stopped responding due to buffer overflow. ## PAN-178615 Fixed an issue where restarting the management server created an invalid reference in the device server, which caused subsequent commits to fail. ## PAN-177981 ```caveat PA-5450 firewalls only ``` Fixed an issue where **High Speed Log Forwarding** was enabled when attempting to view local logs. ## PAN-177956 Fixed an issue where the CLI output of show location ip returned unknown. ## PAN-177907 Fixed an issue where, after rebooting the firewall, FQDN address objects referred in rules in a virtual system (vsys) did not resolve when the vsys used a custom DNS proxy. ## PAN-177878 Fixed an issue where a role-based admin with **Operational Requests** enabled under the XML API section was unable to set the License Deactivation API key. ## PAN-177874 Fixed an issue where a process (devsrvr) stopped responding due to an unexpected returned value. ## PAN-177626 Fixed an issue where aggressive situations caused on-chip descriptor exhaustion. ## PAN-177551 A fix was made to address a vulnerability that enabled an authenticated network-based administrator to upload a specifically created configuration that disrupted system processes and was able to execute arbitrary code with root privileges when the configuration was committed ([CVE-2022-0024](https://security.paloaltonetworks.com/CVE-2022-0024)). ## PAN-177363 Fixed an issue where, when system logs and configuration logs on a dedicated log detector system were forwarded to a Panorama management server in Management Only mode, the logs were not ingested and were dropped. This caused the dedicated log detector system to not be viewable on a Panorama appliance in Management Only mode. ## PAN-177351 Fixed an issue where configurations failed when downgrading from PAN-OS 10.1.1 and later versions to PAN-OS 10.0.0 using the autosaveconfig.xml file. ## PAN-177187 Fixed an issue where reports using the decryption summary database and Panorama as data sources returned no results. ## PAN-177170 Fixed an issue on Panorama where a log collector group commit deleted the proxy settings configured on dedicated log collectors. ## PAN-177072 Fixed an intermittent issue where Panorama did not show new logs from firewalls. ## PAN-177060 Fixed an issue where, when the address object in the parent device group was renamed, and the address object was overridden in the child device group and called in a Security policy, the object in the Security policy was renamed as well. ## PAN-177054 Fixed an issue where, when you disabled a NAT rule, the **Destination Translation** value **none** displayed in blue and was still able to be modified to a different value. ## PAN-176997 Fixed an issue where log collectors generated **Failed to check IoT content upgrade** system logs even when no IoT license was installed. ## PAN-176889 Fixed an issue where the log collector continuously disconnected from Panorama due to high latency and a high number of packets in Send-Q. ## PAN-176746 Fixed an intermittent issue where traffic was lost when performing a failover in an HA active/passive setup. ## PAN-176376 Fixed an issue where importing a firewall configuration to Panorama failed if **Import device's shared objects into Panorama's shared context (device group specific objects will be created if unique)** was unchecked. ## PAN-176348 Fixed an issue where scheduled email alerts were not forwarded to all recipients in the override list. ## PAN-176280 Fixed an intermittent issue on Panorama where querying logs via the web interface or API did not return results. ## PAN-176262 Fixed an issue where the firewall didn't resolve specific domain names with multiple nested Canonical Name (CNAME) records when caching was enabled. ## PAN-176116 Fixed an issue where the header did not match the correct policy when IPv6 addresses were set in XFF header. ## PAN-176032 Fixed an issue where a process (authd) process stopped responding, which caused authentication to fail. ## PAN-176030 Fixed an issue where alerts related to syslog connections were not generated in the system logs. ## PAN-175717 Fixed an issue where firewalls managed by a Panorama management server entered maintenance mode if: - Panorama was running PAN-OS 10.2 and managed firewalls were downgraded from PAN-OS 10.2 to PAN-OS 10.1.4 or earlier PAN-OS release - Panorama was upgraded from PAN-OS 10.1 to PAN-OS 10.2 and managed firewalls were running PAN-OS 10.1.4 or earlier PAN-OS 10.1 release. ## PAN-175716 Fixed an issue where sorting address groups by name, address, or location did not work on a device group that was part of a nested device group. ## PAN-175628 ```caveat PA-5200 Series firewalls only ``` Fixed an issue where the firewall was unable to monitor AUX1 and AUX2 interfaces through SNMP. ## PAN-175570 Fixed an issue where log forwarding profiles did not show up in the dropdown under **Zones**. ## PAN-175509 Fixed an issue where a deadlock on CONFIG_LOCK caused both the web interface and CLI commands to time out until the mgmtsrvr process was restarted. ## PAN-175403 ```caveat VM-Series firewalls only ``` Fixed an issue where the firewall did not display any logs except for system logs. ## PAN-175399 Fixed an issue where enabling Use proxy to fetch logs from Strata Logging Service caused Panorama to not show logs when queried. ## PAN-175307 Fixed an issue where Panorama commits were slower than expected and the configd process stopped responding due to a memory leak. ## PAN-175259 Fixed an issue where a Security policy configured with App-ID and set to **web-browsing** and **application-default service** allowed clear-text web-browsing on tcp/443. ## PAN-175161 Fixed an issue where changing SSL connection validation settings for system logs caused the mgmtsrvr process to stop responding. ## PAN-175141 Fixed an intermittent issue where IP address-to-username mappings were not created on a redistribution client if a logout and login message shared the same timestamp. ## PAN-174998 ```caveat M-200 and M-500 appliances only ``` Fixed a capacity issue that was caused by high operational activity and large configurations. This fix increases the virtual memory limit on the configd process to 32GB. ## PAN-174894 Fixed an issue where, when the TTL value for symmetric MAC entries weren't updated to other dataplanes and HA peers, timeouts occurred for traffic using policy-based forwarding (PBF) with symmetric returns. ## PAN-174864 Fixed an issue on the Panorama interface where **Deploying Master Key** to low-end devices resulted in a **Failed to communicate** message, even when the new master key was updated on the end device. This issue occurred because a master key deployment had insufficient time to process due to a connection timeout. ## PAN-174709 Fixed an OOM condition that occurred due to multiple parallel jobs being created by the scheduled log export feature. ## PAN-174680 Fixed an issue where, when adding new configurations, Panorama didn't display a list of suggested template variables when typing in a relevant field. ## PAN-174607 Fixed an intermittent issue where, when Security profiles were attached to a policy, files that were downloaded across TLS sessions decrypted by the firewall were malformed. ## PAN-174604 Fixed an issue where the email subject of scheduled reports was enclosed in single quotation marks. ## PAN-174564 ```caveat VM-Series firewalls on a Kernel-based Virtual Machine (KVM) running on Proxmox Hypervisor only ``` Fixed an issue where SSH traffic was identified as unknown-TCP. ## PAN-174347 Fixed an issue where sequence numbers were calculated incorrectly for traffic that was subject to Session Initiation Protocol (SIP) application-level gateway (ALG) when SIP TCP Clear Text Proxy was disabled. ## PAN-174011 Fixed an issue where Panorama failed to update shared policies during partial commits when a new device group was created but not yet committed. ## PAN-173893 Fixed a memory leak issue related to the (useridd) process that occurred when group mapping was enabled. ## PAN-173753 Fixed an issue where a bar or point on a **Network Monitor** graph had to be clicked more than once to properly redirect to the corresponding ACC report. ## PAN-173689 Fixed an issue where the dataplane restarted due to running out of memory in the policy cache. ## PAN-173545 Fixed an issue where exporting a device summary to CSV failed and displayed the following error message: Error while exporting. ## PAN-173509 Fixed an issue where Superuser administrators with read-only privileges (**Device > Administrators and Panorama > Administrators**) were unable to view the hardware ACL blocking setting and duration in the CLI using the following commands: - show system setting hardware-acl-blocking-enable - show system setting hardware-acl-blocking-duration ## PAN-173267 Fixed an issue where log queries on Panorama appliances returned with no output and the error message Schema file does not exist displayed in the reported process log. ## PAN-173179 Fixed an issue where the rem_addr field in Terminal Access Controller Access-Control System (TACACS+) authentication displayed the management or service route IP address of the firewall instead of the source IP address of the user. ## PAN-172837 Fixed an intermittent issue where the firewall didn't generate block URL logs for URLs even though the websites were blocked in the client device. ## PAN-172748 ```caveat VM-Series firewalls only ``` Fixed an issue where a process (all_task) stopped responding. ## PAN-172404 Fixed an issue where the semi-colon (;) was not recognized as token separator while doing regex for URL category matching even though it is mentioned in the documentation. ## PAN-172396 Fixed a memory leak issue related to the useridd process. ## PAN-172316 Fixed an issue where the internal interface flow control that caused the monitoring process to incorrectly determine the interface to be malfunctioning. ## PAN-172295 Fixed an issue where a HIP database cache loop caused high CPU utilization on a process (useridd) and caused IP address-to-user mapping redistribution failure. ## PAN-172243 Fixed an issue where NetFlow traffic triggered a packet buffer leak. ## PAN-172056 ```caveat VM-Series firewalls only ``` The logging rate limit was improved to prevent log loss. ## PAN-171869 Fixed an issue where HIP profile objects in security policies and authentication policies were still visible in the CLI even after replacing them with source HIP and destination HIP objects. ## PAN-171367 Fixed an issue in active/active HA configurations where sessions disconnected during an upgrade from a PAN-OS 9.0 release to a PAN-OS 9.1 release. ## PAN-171345 Fixed an issue where firewalls experienced high packet descriptor usage due to internal communication associated with WildFire. ## PAN-171181 Fixed an issue where the IPSec tunnel configuration didn't load when a double quotation mark was added to the comment section of the IPSec tunnel **General** tab. ## PAN-170952 Fixed script issues that caused diagnostic data to not be collected after path monitor failure. ## PAN-170595 Fixed an issue with Content and Threat Detection where traffic patterns created a bus error, which caused the all_pktproc process to stop responding and the dataplane to restart. ## PAN-170297 Fixed an issue where **ACC > Threat** activity did not include the threat name after upgrading to a PAN-OS 10.0 release. ## PAN-169917 Fixed an issue on Panorama where AUX interface IP addresses did not populate when configuring service routes. ## PAN-169796 Fixed an issue where the high availability path group destination IP address was removed after pushing a PAN-OS 10 release template from Panorama to a firewall running a PAN-OS 9 release. ## PAN-169433 Fixed an issue on Panorama where clicking **Run Now** for a custom report with 32 or more filters in the Query Builder returned the following message: No matching records. ## PAN-168921 Fixed an issue on firewalls in HA active/active configurations where traffic with complete packets showed up as incomplete and was disconnected due to a non-session owner closing the session prematurely. ## PAN-168890 A CLI command was added to address an issue where a configured proxy server for a service route was automatically applied to the email server service route. ## PAN-168662 Fixed an issue on Panorama where multiple copies of logs were displayed for a single session. ## PAN-168635 Fixed an issue on the firewall where, when attempting to change the master key, the existing master key was not validated first. As a result, all firewall keys were corrupted. ## PAN-168286 Fixed a memory leak issue in the mgmtsrvr process that was caused by failed commit all operations. ## PAN-168189 Fixed an issue where, even when there was active multicast traffic, the firewall sent Protocol Independent Multicast (PIM) prune messages. ## PAN-167858 Fixed an issue where a DNS Security inspection identified a TCP DNS request that had two requests in one segment as a malformed packet and dropped the packet. ## PAN-167259 Fixed an issue where, after manually uploading WildFire images, the dropdown did not display any available files to choose from. ## PAN-166368 Fixed an issue on Panorama where long FQDN queries did not resolve due to the character limit being 64 characters. ## PAN-165147 Fixed an issue where, when there was a high volume of traffic for sessions with **Application Block Pages** enabled, other regular packets were dropped. ## PAN-164871 ```caveat VM-Series firewalls only ``` Fixed an intermittent issue where deactivating the firewall via XML API using manual mode failed. This occurred because the size of the license token file was incorrect. ## PAN-164631 Fixed an issue where the **stats dump** report was empty. ## PAN-163831 Fixed an issue where IPv6 addresses were displayed instead of IPv4 in custom reports. ## PAN-163245 Fixed an issue where a commit-all or push to the firewall from Panorama failed with the following error message: client routed requesting last config in the middle of a commit/validate. Aborting current commit/validate. ## PAN-162047 ```caveat Firewalls in HA active/passive configurations only ``` Fixed a routing table mis-sync issue where routes were missing on the passive firewall when GRE tunnels with keepalives were configured. ## PAN-161297 Fixed an interoperability issue with other vendors when IKEv2 used SHA2-based certificate authentication. ## PAN-161111 Fixed an issue where TLS 1.3 Forward Proxy Decryption failed with a malloc failure error. This issue was caused by the server certificate being very large. ## PAN-161031 Fixed an issue where authentication via LDAP server failed in FIPS-CC mode when the LDAP server profile was configured with the root certificate chain and **Verify server certificate for SSL sessions** options enabled. ## PAN-159835 Fixed an issue where, after an upgrade, the following error message was displayed: Not enough space to load content to SHM. ## PAN-158639 Fixed an issue on Panorama where logs that were forwarded to a collector group did not appear, and the log collector displayed the following error message: es.init-status not ready in logjobq. ## PAN-158541 Fixed an OOM condition on the dataplane on FIPS-mode firewall decryption that used DHE ciphers. ## PAN-158369 Fixed an issue where applications did not work via the Clientless VPN when they were configured on a vlan interface ## PAN-156289 Fixed an issue where the default severities for Content Update errors were inaccurate. ## PAN-151692 Fixed a permission issue where a Panorama administrator was unable to download or install dynamic updates (**Panorama > Device Deployment**). ## PAN-151302 ```caveat PA-7000 Series firewalls with LFCs only ``` Fixed an issue where the logging rate for the LFC was not displayed in **Panorama > Managed Devices > Health**. ## PAN-146734 Fixed an issue where, when a Panorama-pushed configuration was referenced in a local configuration, commits failed after updating the master key on the firewall, which resulted in the following error message: Invalid candidate configuration. Master key change aborted.... ## PAN-145833 ```caveat PA-3200 Series firewalls only ``` Fixed an issue where the firewall stopped recording dataplane diagnostic data in dp-monitor.log after a few hours of uptime. ## PAN-141454 Fixed an issue where the output of the CLI command show running resource-monitor ingress-backlogs displayed an incorrect total utilization value.