657 lines
20 KiB
HTML
657 lines
20 KiB
HTML
<table class="table colsep rowsep table-striped">
|
|
<!--cq:include script="../../common/tablestack.jsp" /-->
|
|
|
|
<colgroup>
|
|
<col style="width: 25%" />
|
|
<col style="width: 75%" />
|
|
</colgroup>
|
|
<thead class="thead" data-sticky-top="61.2" style="top: 61.2px">
|
|
<tr class="row">
|
|
<th class="entry">
|
|
<div class="p">Issue ID</div>
|
|
</th>
|
|
<th class="entry">
|
|
<div class="p">Description</div>
|
|
</th>
|
|
</tr>
|
|
</thead>
|
|
|
|
<tbody class="tbody">
|
|
<tr class="row">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">—</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">Fixes were made to address the following CVEs:</div>
|
|
<ul id="pan_os_11_1_15_addressed_issues_ul-snk_4r1_gjc" class="ul">
|
|
<li class="li">
|
|
<a
|
|
class="xref"
|
|
href="https://security.paloaltonetworks.com/CVE-2026-0265"
|
|
title=""
|
|
data-scope="external"
|
|
data-format="html"
|
|
data-type=""
|
|
target="_blank"
|
|
>CVE-2026-0265</a
|
|
>
|
|
</li>
|
|
<li class="li">
|
|
<a
|
|
class="xref"
|
|
href="https://security.paloaltonetworks.com/CVE-2026-0264"
|
|
title=""
|
|
data-scope="external"
|
|
data-format="html"
|
|
data-type=""
|
|
target="_blank"
|
|
>CVE-2026-0264</a
|
|
>
|
|
</li>
|
|
<li class="li">
|
|
<a
|
|
class="xref"
|
|
href="https://security.paloaltonetworks.com/CVE-2026-0263"
|
|
title=""
|
|
data-scope="external"
|
|
data-format="html"
|
|
data-type=""
|
|
target="_blank"
|
|
>CVE-2026-0263</a
|
|
>
|
|
</li>
|
|
<li class="li">
|
|
<a
|
|
class="xref"
|
|
href="https://security.paloaltonetworks.com/CVE-2026-0262"
|
|
title=""
|
|
data-scope="external"
|
|
data-format="html"
|
|
data-type=""
|
|
target="_blank"
|
|
>CVE-2026-0262</a
|
|
>
|
|
</li>
|
|
<li class="li">
|
|
<a
|
|
class="xref"
|
|
href="https://security.paloaltonetworks.com/CVE-2026-0261"
|
|
title=""
|
|
data-scope="external"
|
|
data-format="html"
|
|
data-type=""
|
|
target="_blank"
|
|
>CVE-2026-0261</a
|
|
>
|
|
</li>
|
|
<li class="li">
|
|
<a
|
|
class="xref"
|
|
href="https://security.paloaltonetworks.com/CVE-2026-0258"
|
|
title=""
|
|
data-scope="external"
|
|
data-format="html"
|
|
data-type=""
|
|
target="_blank"
|
|
>CVE-2026-0258</a
|
|
>
|
|
</li>
|
|
<li class="li">
|
|
<a
|
|
class="xref"
|
|
href="https://security.paloaltonetworks.com/CVE-2026-0257"
|
|
title=""
|
|
data-scope="external"
|
|
data-format="html"
|
|
data-type=""
|
|
target="_blank"
|
|
>CVE-2026-0257</a
|
|
>
|
|
</li>
|
|
<li class="li">
|
|
<a
|
|
class="xref"
|
|
href="https://security.paloaltonetworks.com/CVE-2026-0256"
|
|
title=""
|
|
data-scope="external"
|
|
data-format="html"
|
|
data-type=""
|
|
target="_blank"
|
|
>CVE-2026-0256</a
|
|
>
|
|
</li>
|
|
<li class="li">
|
|
<a
|
|
class="xref"
|
|
href="https://security.paloaltonetworks.com/CVE-2026-0259"
|
|
title=""
|
|
data-scope="external"
|
|
data-format="html"
|
|
data-type=""
|
|
target="_blank"
|
|
>CVE-2026-0259</a
|
|
>
|
|
</li>
|
|
<li class="li">
|
|
<a
|
|
class="xref"
|
|
href="https://security.paloaltonetworks.com/CVE-2026-0300"
|
|
title=""
|
|
data-scope="external"
|
|
data-format="html"
|
|
data-type=""
|
|
target="_blank"
|
|
>CVE-2026-0300</a
|
|
>
|
|
</li>
|
|
</ul>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-325120</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on PA-415, PA-415-5G, PA-445, PA-455, and PA-455-5G
|
|
platforms where certain PAN-OS versions caused intermittent
|
|
connectivity failures on the Eth1/1 data port and loss of power on PoE
|
|
ports.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-323243</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where a
|
|
<span class="ph systemoutput">configd</span> crash occurred when the
|
|
<span class="ph uicontrol">Policies > Security</span> view was
|
|
updated or refreshed in the web interface.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-322815</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt"
|
|
>VM-Series firewalls on Microsoft Azure environments only</tt
|
|
>) Fixed an issue where the firewall entered maintenance mode after
|
|
enabling FIPS-CC mode and rebooted.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-319557</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where graphical counters did not display correctly in
|
|
the control plane or dataplane monitor logs.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-318784</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall stopped processing traffic and all
|
|
VPN tunnels went down even when the firewall remained in an active
|
|
state, and the CLI became unresponsive.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-318567</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the OpenConfig plugin stopped working after a
|
|
configuration update.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-317583</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue with intermittent ICMP ping drops and packet loss in
|
|
traffic flows between a hub and branch after upgrading to an affected
|
|
PAN-OS release due to incorrect SD-WAN path monitor state.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-317466</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where SIP sessions stopped progressing after the
|
|
firewall received fragmented packets, fragmented at header field.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-317372</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where custom administrators received an
|
|
<span class="ph uicontrol">access denied</span> error when attempting
|
|
to view specific policy rule details from the
|
|
<span class="ph uicontrol">Rule Shadow</span> tab after a push from
|
|
Panorama, even when the administrator had permissions to view Security
|
|
policy rules.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-316631</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue BGP sessions experienced short disruptions across all
|
|
peers, interfaces, and slots when a multicast event persisted longer
|
|
than the NGP negotiated hold timers.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-315820</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where User-ID XML API requests took longer than
|
|
expected to return a response, which caused the web interface and
|
|
captive portal pages to respond slowly or fail to load. this occurred
|
|
when sending XML API requests for IP address-to-user mapping.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-314875</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt">PA-7500 firewalls only</tt>) Fixed an issue where
|
|
firewall logs were not visible in the Strata Logging Service even
|
|
though cloud logging was enabled and the firewall was successfully
|
|
forwarding logs.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-314752</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on Panorama where, after removing a scheduled
|
|
configuration push, Panorama still initiated the push at its
|
|
previously scheduled time.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-314385</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt">Firewalls in active/passive HA clusters only</tt>)
|
|
Fixed an issue where high dataplane CPU usage occurred and traffic
|
|
offloading decreased when a failover occurred from the active firewall
|
|
to the passive firewall, and then back to the active firewall.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-314126</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where session rematch did not properly apply updated
|
|
Security policy rules to existing traffic flows after committing
|
|
changes, which caused traffic to still be allowed when a new Security
|
|
policy was set to <span class="ph uicontrol">Deny</span>.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-314020</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall did not decapsulate GENEVE packets
|
|
when DNS Security retransmitted a DNS query after receiving a verdict
|
|
from the cloud.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-313828</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall did not forward traffic due to
|
|
memory issues on a forwarding component.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-313827</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where a memory leak occurred related to the
|
|
<span class="ph systemoutput">reportd</span> process when custom
|
|
reports were run via API.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-313711</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the
|
|
<span class="ph systemoutput">show system environmentals power</span>
|
|
CLI command displayed duplicate slot names and associated voltage
|
|
values.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-313700</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where an unexpected reboot occurred when Inline Cloud
|
|
Analysis was enabled in an Anti-Spyware and Vulnerability profile.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-313193</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
<tt class="ph tt">Firewalls in Layer 2 mode only</tt>) Fixed an issue
|
|
where the new sessions were not able to be established due to the
|
|
firewall intermittently dropping valid MAC address entries for
|
|
specific VLANs when a manual switchover sent a high volume of traffic
|
|
to the firewall.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-311248</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the ABR failed to translate and advertise the
|
|
default route (0.0.0.0/0) from an OSPF NSSA area into the OSPF
|
|
backbone area as a Type-5 LSA.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-310472</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on the web interface where checkboxes for
|
|
<span class="ph uicontrol">default information originate</span> and
|
|
ABR in OSPF NSSA configurations were automatically enabled which
|
|
resulted in unexpected configuration changes.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-307470</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where an External Dynamic List (EDL) fetch with an
|
|
invalid certificate was skipped on newly provisioned GlobalProtect
|
|
gateway instances.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-298960</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall continuously rebooted when the
|
|
<a
|
|
class="term"
|
|
href="#"
|
|
title=""
|
|
data-scope=""
|
|
data-format="dita"
|
|
data-type=""
|
|
target="_self"
|
|
>useridd</a
|
|
>
|
|
process repeatedly restarted.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-295309</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where OSPF session using MD5 authentication experienced
|
|
intermittent flapping due to out-of-order packet processing.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-294001</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on Panorama managed firewalls generated
|
|
<span class="ph uicontrol">Failed in get_pwchange_required</span>
|
|
error messages in the
|
|
<a
|
|
class="term"
|
|
href="#"
|
|
title=""
|
|
data-scope=""
|
|
data-format="dita"
|
|
data-type=""
|
|
target="_self"
|
|
>authd</a
|
|
>
|
|
logs for local administators.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-293142</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where firewall components became unresponsive during
|
|
sustained operation.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-289706</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the
|
|
<a
|
|
class="term"
|
|
href="#"
|
|
title=""
|
|
data-scope=""
|
|
data-format="dita"
|
|
data-type=""
|
|
target="_self"
|
|
>authd</a
|
|
>
|
|
process crashed intermittently on VM-Series firewalls due to
|
|
authentication sequence failures. The crashes occurred during memory
|
|
management operations within a library while releasing memory to its
|
|
central cache.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-285213</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where proxy requests for certificate status (OCSP/CRL)
|
|
from
|
|
<a
|
|
class="term"
|
|
href="#"
|
|
title=""
|
|
data-scope=""
|
|
data-format="dita"
|
|
data-type=""
|
|
target="_self"
|
|
>sslmgr</a
|
|
>
|
|
contained incorrect values that caused unknown certificates to be
|
|
blocked.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-282335</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where firewalls in a cluster experienced approximately
|
|
50% packet loss on IPSec NATT tunnels when tunnel acceleration was
|
|
enabled.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-273805</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where SAML authentication for GlobalProtect failed when
|
|
the GlobalProtect portal was accessed externally on a non-standard
|
|
port.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-271412</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the character ( + ) in the authentication message
|
|
prompt displayed incorrectly as
|
|
<span class="ph uicontrol">#43;</span> on the GlobalProtect client
|
|
after upgrading to a PAN-OS 10.2 release.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-257879</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where, after a system event, selecting a configuration
|
|
file from maintenance mode loaded the incorrect configuration.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry">
|
|
<div class="p"><b class="ph b">PAN-236914</b></div>
|
|
</td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where TCP MSS adjustment did not function as expected
|
|
for GRE tunnels when TCP SYN or SYN-ACK packets that were received had
|
|
an MMS higher than 1460 bytes.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|