Fixes were made to address the following CVEs:

• CVE-2026-0331
• CVE-2026-0330 (Panorama)
• CVE-2026-0329
• CVE-2026-0328
• CVE-2026-0327
• CVE-2026-0326
• CVE-2026-0325

Fixed an issue where Anti-virus content packages do not appear under Device > Dynamic Updates when you select Check Now on firewalls licensed exclusively with an Advanced Threat Prevention Plus add-on. The web interface does not check for or display available Anti-virus updates because it does not recognize the Advanced Threat Prevention Plus license as a valid entitlement for Anti-virus content.

Fixed an issue where the Inline Cloud Analysis tab does not appear in the Vulnerability Protection profile in the web interface on firewalls licensed exclusively with the Advanced Threat Prevention Plus add-on. The Advanced Threat Prevention Plus license is a unified license that enables Threat Prevention and Advanced Threat Prevention features, as well as Frontier Virtual Patching, but the web interface does not recognize it as a valid entitlement for the Inline Cloud Analysis configuration. The underlying Inline Cloud Analysis functionality is not affected, however, the web interface tab is unavailable for configuration.

Fixed an issue where the licensing message on the Security Profiles page does not list Advanced Threat Prevention Plus as a valid license option firewalls without a Threat Prevention or Advanced Threat Prevention license. The message references only Threat Prevention and Advanced Threat Prevention, which may cause confusion for customers who have an Advanced Threat Prevention Plus add-on.

Fixed an issue where sessions were prematurely terminated due to resource unavailability, which occurred even when the platform had not reached its capacity limits. This issue was observed when decryption was enabled for traffic from multiple remote network sites. With this fix, sessions now utilize available resources correctly and are not prematurely terminated.

Fixed an issue where the system encountered a parsing error for the Authority Key Identifier (AKID) extension in certificates, which prevented the AKID from being correctly processed when it began with a specific value. With this fix, the AKID extension is now correctly parsed and processed.

(Palo Alto Networks virtual machine (VM) firewalls with Advanced Routing Engine enabled) Fixed an issue where Border Gateway Protocol (BGP) prefixes advertised to the firewall that contained Attribute 40 (SRv6 / Prefix-SID) were not installed in the routing table, which occurred because the Advanced Routing Engine incorrectly discarded these routes instead of processing the attribute transparently. With this fix, the firewall properly processes BGP Attribute 40 and installs the routes as expected.

(Panorama appliances only) Fixed an issue where tracebacks appeared in the raid.log file, accompanied by messages indicating that a redundant array of independent disks (RAID) pair had disappeared. This occurred due to an internal processing error when handling RAID device paths during system boot, which could lead to incorrect reporting of RAID status. With this fix, the system correctly processes RAID device paths, preventing these log errors and ensuring accurate RAID status.

(Panorama appliances only) Fixed an issue where the system was unable to add new RAID disks to existing arrays, which resulted in disk pairs remaining in a degraded state. The system would detect the drives but would not properly initialize them for inclusion in the RAID array. With this fix, the system now correctly initializes and adds new RAID disks, allowing for proper array rebuilds.

Fixed an issue where the Advanced WildFire cloud status would show as disconnected after a software upgrade, which prevented the firewall from maintaining a connection to the service. With this fix, the firewall properly maintained its connection to the Advanced WildFire cloud.

(PA-3420 firewalls only) Fixed an issue where the explicit proxy service would unexpectedly terminate when processing Kerberos authentication bypass traffic over extended periods. With this fix, the explicit proxy service maintains stability under these conditions.

Fixed an issue where the traffic log user interface displayed an error when accessed. With this fix, the traffic log user interface functions as expected.