Fixes were made to address the following CVEs:

• CVE-2026-0331
• CVE-2026-0330 (Panorama)
• CVE-2026-0329
• CVE-2026-0328

Fixed an issue where Anti-virus content packages do not appear under Device > Dynamic Updates when you select Check Now on firewalls licensed exclusively with an Advanced Threat Prevention Plus add-on. The web interface does not check for or display available Anti-virus updates because it does not recognize the Advanced Threat Prevention Plus license as a valid entitlement for Anti-virus content.

Fixed an issue where the Inline Cloud Analysis tab does not appear in the Vulnerability Protection profile in the web interface on firewalls licensed exclusively with the Advanced Threat Prevention Plus add-on. The Advanced Threat Prevention Plus license is a unified license that enables Threat Prevention and Advanced Threat Prevention features, as well as Frontier Virtual Patching, but the web interface does not recognize it as a valid entitlement for the Inline Cloud Analysis configuration. The underlying Inline Cloud Analysis functionality is not affected, however, the web interface tab is unavailable for configuration.

Fixed an issue where the licensing message on the Security Profiles page does not list Advanced Threat Prevention Plus as a valid license option firewalls without a Threat Prevention or Advanced Threat Prevention license. The message references only Threat Prevention and Advanced Threat Prevention, which may cause confusion for customers who have an Advanced Threat Prevention Plus add-on.

Fixed an issue where sessions were prematurely terminated due to resource unavailability, which occurred even when the platform had not reached its capacity limits. This issue was observed when decryption was enabled for traffic from multiple remote network sites. With this fix, sessions now utilize available resources correctly and are not prematurely terminated.

(PA-5440 firewalls only) Fixed an issue where SaaS applications were incorrectly blocked even when a higher-order security rule should have allowed the traffic, which occurred due to an unexpected policy rematch behavior. With this fix, security policy rules are correctly applied during policy rematch, ensuring expected traffic flow.

Fixed an issue where the system encountered a parsing error for the Authority Key Identifier (AKID) extension in certificates, which prevented the AKID from being correctly processed when it began with a specific value. With this fix, the AKID extension is now correctly parsed and processed.

Fixed an issue where firewalls intermittently lost their connection to the Strata Logging Service, which caused logging to stop until the connection was re-established. With this fix, firewalls maintain a stable connection to the Strata Logging Service.

(PA-VM firewalls only) Fixed an issue where the firewall unexpectedly rebooted, which occurred during Geneve protocol traffic processing. With this fix, the firewall operates stably.

Fixed an issue where the dataplane silently dropped HTTP POST payloads, which disrupted application integrations. This occurred due to an internal error when processing XFF headers within the CTD engine.

(Firewalls in active/passive HA configurations only) Fixed an issue where Genetec camera streaming experienced lag and dropped video feeds due to the exhaustion of private RTP ports, which led to their accumulation over time. With this fix, the firewall now properly releases private RTP ports, preventing their exhaustion.

Fixed an issue where firewalls would intermittently disconnect from SLS. With this fix, connections to SLS remain stable.

Fixed an issue where high memory utilization occurred in the escd process. With this fix, memory utilization for the process remained stable.

Fixed an issue where Real-time Transport Protocol (RTP) packets were dropped after an upgrade, which occurred due to a predict session conversion failure and resulted in delayed or absent video streams. With this fix, RTP packets are processed correctly, and video streams display without delay.

Fixed an issue where processes restarted and the firewall unexpectedly rebooted when you configured a Security policy rule with Source Device > quarantine.

Fixed an issue BGP sessions experienced short disruptions across all peers, interfaces, and slots when a multicast event persisted longer than the NGP negotiated hold timers.

Fixed an issue where a race condition between the session ager and packet processing resulted in memory corruption and caused the pan_task process to stop responding, which resulted in the firewall becoming unresponsive

Fixed an issue where the configd process stopped responding after pushing configuration changes from Panorama to the firewall.

Fixed an issue where the logrcvr process stopped responding for traffic containing multiple XFF headers when URL XFF header logging was enabled along with additional XFF header logging, which caused subsequent commits to fail.

Fixed an issue where the firewall dataplane continuously accumulated packets in the ctd_pkt_queue and packet buffers, which caused resource exhaustion and prematurely terminated sessions.

Fixed an issue where the Advanced WildFire cloud status would show as disconnected after a software upgrade, which prevented the firewall from maintaining a connection to the service. With this fix, the firewall properly maintained its connection to the Advanced WildFire cloud.

Fixed an issue where the firewall stripped the Authentication Key Identifier (AKID) from certificates using SSL decryption, which prevented clients from authenticating server certificates and resulted in decryption failures.

Fixed an issue where the CLI command request system software download to-version <version> failed to download multiple software images due with a Download terminated due to timeout error message.

Fixed an issue on the firewall where the sslmgr process memory utilization continually increased due to memory fragmentation.

Fixed an issue where scheduled software upgrades from the Software Change Management (SCM) server to the firewall failed with a timeout error during download.

(PA-3420 firewalls only) Fixed an issue where the explicit proxy service would unexpectedly terminate when processing Kerberos authentication bypass traffic over extended periods. With this fix, the explicit proxy service maintains stability under these conditions.

Fixed an issue where the firewall was unable to send device telemetry files to Cortex Data Lake due to the firewall receiving an invalid upload token.

Fixed an issue where packets that had completed processing would not be sent out, which occurred because an internal optimization mechanism did not properly flush the transmit queue under certain traffic conditions. With this fix, packets are consistently transmitted.

Fixed an issue on the firewall where the useridd process continuously increased its memory consumption, which resulted in an OOM condition that caused the firewall to restart.

Fixed an issue where the DNS proxy would intermittently stop resolving DNS queries, which prevented users from accessing the internet, and which was observed during periods of high CPU utilization for the dnsproxy process. With this fix, the DNS proxy consistently resolves queries, ensuring reliable internet access.