Fixes were made to address the following CVEs:

• CVE-2026-0331
• CVE-2026-0330
• CVE-2026-0329
• CVE-2026-0328
• CVE-2026-0327
• CVE-2026-0326
• CVE-2026-0325

Fixed an issue where NAT64 client-to-server (c2s) packet IP addresses were corrupted during 6-to-4 translation after hardware offload.

Fixed an issue where selectively disabling offload for filtered traffic did not function as expected, and sessions continued to be offloaded. With this fix, offload is correctly disabled for filtered traffic.

(PA-7500 firewalls only) Fixed an issue where NAT64 server-to-client traffic failed on sessions using hardware session offload, causing the firewall to translate the destination port incorrectly after a session was offloaded and resetting the connection. With this fix, NAT64 translates server-to-client traffic correctly on sessions using hardware session offload.

Fixed an issue where Anti-virus content packages do not appear under Device > Dynamic Updates when you select Check Now on firewalls licensed exclusively with an Advanced Threat Prevention Plus add-on. The web interface does not check for or display available Anti-virus updates because it does not recognize the Advanced Threat Prevention Plus license as a valid entitlement for Anti-virus content.

Fixed an issue where Management Plane memory utilization increased rapidly, which led to out-of-memory events, high availability failovers, and restarts of Management Plane processes. With this fix, Management Plane memory utilization remains stable

(PA-5420 firewalls only) Fixed an issue where OSPFv3 routes were not established on a peer device because the firewall incorrectly handled route tags during advertisement. With this fix, route tags are handled correctly.

(HA active/passive PA-3430 firewalls using the Advanced Routing Engine (ARE)) Fixed an issue where IPv6 prefixes were not advertised between OSPFv3 areas, which occurred because an OSPFv3 Area Range configuration overlapped with ASBR loopback addresses, preventing the generation of necessary Link-State Advertisements (LSAs), and because attempts to configure route redistribution in Strata Cloud Manager (SCM) failed due to a schema validation error. With this fix, IPv6 prefixes are correctly advertised between OSPFv3 areas, and route redistribution can be configured successfully in SCM.

(PA-5540 firewalls only) Fixed an issue where BGP, BFD, and OSPF peering sessions became unavailable on the firewall and later restored. With this fix, peering sessions no longer experienced unexpected interruptions.

(PA-5420 firewalls in active/passive High Availability (HA) configuration only) Fixed an issue where the Forwarding Information Base (FIB) would become stale after HA failover events, routine configuration commits, or Equal-Cost Multi-Path (ECMP) toggles, which led to traffic blackholing. This occurred due to connection refusals between the routing control plane and the forwarding plane. With this fix, routing entries are reliably synchronized to the forwarding plane.

(Panorama appliances only) Fixed an issue where tracebacks appeared in the raid.log file, accompanied by messages indicating that a redundant array of independent disks (RAID) pair had disappeared. This occurred due to an internal processing error when handling RAID device paths during system boot, which could lead to incorrect reporting of RAID status. With this fix, the system correctly processes RAID device paths, preventing these log errors and ensuring accurate RAID status.

(All firewalls and panorama deployments that include syslog clients in logrcvr/logd) Fixed an issue where traffic logs were not forwarded to CloudWatch. With this fix, traffic logs are forwarded as expected.

(RN-HP firewalls only) Fixed an issue where packet buffer resources would leak during a temporary surge in packet buffer usage, which caused tunnels to become unavailable. With this fix, packet buffer resources are managed correctly during periods of high usage.

(Panorama appliances only) Fixed an issue where the system was unable to add new RAID disks to existing arrays, which resulted in disk pairs remaining in a degraded state. The system would detect the drives but would not properly initialize them for inclusion in the RAID array. With this fix, the system now correctly initializes and adds new RAID disks, allowing for proper array rebuilds.

Few configs which pushed from SCM to firewall were causing the firewall to loose its internet connectivity and the firewall wasn't able to connect to cloud and was getting stuck at discovery stage retrying indefinitely without returning failure. And now ACR performs the the config rollback once the 5 cloud connectivity check attempts failed.

Fixed an issue where a RAID array could not be rebuilt after a disk replacement because the data copy operation timed out. With this fix, RAID array rebuild operations complete successfully.

Fixed an issue where traffic for certain websites was incorrectly matched to a security policy, preventing access for users when using specific web browsers, which occurred because the firewall used a generic session category for policy matching. With this fix, traffic correctly matches the intended security policy.

Fixed an issue where IPsec tunnels frequently went down due to high process memory utilization. With this fix, the system process now manages memory correctly, preventing tunnel instability.

Fixed an issue where auto-commit operations would fail during boot-up or after a reboot. With this fix, auto-commit operations complete as expected.

Fixed an issue where the firewall unexpectedly terminated operations and rebooted due to an internal software error.

Fixed an issue where AWF was not honoring the Maximum Latency settings.

Fixed an issue where Real-time Transport Protocol (RTP) packets were dropped after an upgrade, which occurred due to a predict session conversion failure and resulted in delayed or absent video streams. With this fix, RTP packets are processed correctly, and video streams display without delay.

Fixed an issue where the system unexpectedly shut down and restarted multiple times due to an internal process repeatedly restarting. With this fix, the system no longer experiences unexpected shutdowns.

Fixed an issue where a TLSv1.3 handshake did not complete when SSL Forward Proxy was enabled. This occurred when a large ClientHello message was split across multiple TCP segments and the final segment contained only one byte.