Fixed an issue where, when the firewall received an unexpected termination request for SSL sessions, the dataplane experienced a slow buffer resource leak.

Fixed an issue on Panorama where the web interface performance was slower than usual when retrieving read-only configurations from Panorama.

Fixed an issue where, when Restrict Certificate Extensions was enabled on decryption profiles, the basic constraints extension was overwritten incorrectly.

Fixed an issue where the firewall removed the Authentication Key Identifier (AKID) from the certificate during SSL decryption, which caused Python 3.13 to fail with a certificate verification error.

Fixed an memory leak issue related to TLS inbound decryption.

Fixed an issue where daily scheduled reports were not generated and emailed.

Fixed an issue where the firewall did not install a Pay-as-you-go (PAYG) license if the check failed.

Fixed an issue where Panorama became unresponsive while performing a dynamic address update without a lock.

(Firewalls in active/active high availability (HA) configurations only) Fixed an issue with SSL inbound decryption on firewalls on a vwire setup with asymmetric routing.

To use this fix, enter the CLI command set system setting ssl-decrypt ha-vwire-mac-learn global yes on both firewalls in an HA pair.

Fixed an issue where the all_pktproc process stopped responding, which caused internal path monitor failures.

Fixed an issue where commits to service connection firewalls from Panorama failed.

Fixed an issue where the firewall stopped responding when receiving a high number of logs.

Fixed an issue where the scheduled report generation script did not return debug information.

Fixed an issue where the config lock icon was not visible for a custom role-based admin when a Superuser admin had acquired the config lock.

(PA-5400 Series firewalls only) Fixed an issue where the firewall sent correlated event logs to the syslog server using the management interface instead of the log interface.

Fixed an issue where Microsoft Outlook did not work as expected when the GlobalProtect clientless VPN was configured.

Fixed an issue on the firewall where logging in via the CLI or web interface did not work due to increased memory usage.

Fixed an issue on firewalls in HA configurations where a network loop was detected by switches after suspending HA on the active firewall.

Fixed an issue on Panorama where the reportd process stopped responding, which caused a log query issue.

Fixed an issue where the configd process stopped responding when Commit and Push operations were performed on multiple device groups.

Fixed an issue where, after replacing a Panorama appliance or log collector, the secondary Panorama appliance or log collector displayed a disconnected status for the inter-log collector connection.

Fixed an issue on Panorama where, when the Commit and Push button was clicked during a selective Commit and Push operation, the window stopped responding, which caused the operation to be delayed.

A fix was made to address CVE-2025-0115.

Fixed an issue where inbound decryption did not work when FIPS self tests were turned on.

Fixed an issue where inconsistent FIB entries across the dataplane were not detected.

A fix was made to address CVE-2023-48795.

Fixed an issue where the firewall rebooted when a QSFP28 cable was removed from the port while the port was passing traffic.

Fixed an issue on Panorama where local commits took longer than expected after an upgrade.

Fixed an issue where the firewall took an incorrect action for overlapping custom and edl-url-categories in a policy rule.

Fixed an issue where the firewall dropped DHCPv6 relay packets if there were duplicate link-local addresses on different sub-interfaces.

Fixed an issue where template configurations were not properly pushed to the firewall during an export or push of the device configuration bundle.