Fixes were made to address the following CVEs:

• CVE-2026-0331
• CVE-2026-0330 (Panorama)
• CVE-2026-0329
• CVE-2026-0328

Fixed an issue where Anti-virus content packages do not appear under Device > Dynamic Updates when you select Check Now on firewalls licensed exclusively with an Advanced Threat Prevention Plus add-on. The web interface does not check for or display available Anti-virus updates because it does not recognize the Advanced Threat Prevention Plus license as a valid entitlement for Anti-virus content.

Fixed an issue where the Inline Cloud Analysis tab does not appear in the Vulnerability Protection profile in the web interface on firewalls licensed exclusively with the Advanced Threat Prevention Plus add-on. The Advanced Threat Prevention Plus license is a unified license that enables Threat Prevention and Advanced Threat Prevention features, as well as Frontier Virtual Patching, but the web interface does not recognize it as a valid entitlement for the Inline Cloud Analysis configuration. The underlying Inline Cloud Analysis functionality is not affected, however, the web interface tab is unavailable for configuration.

Fixed an issue where the licensing message on the Security Profiles page does not list Advanced Threat Prevention Plus as a valid license option firewalls without a Threat Prevention or Advanced Threat Prevention license. The message references only Threat Prevention and Advanced Threat Prevention, which may cause confusion for customers who have an Advanced Threat Prevention Plus add-on.

Fixed an issue where sessions were prematurely terminated due to resource unavailability, which occurred even when the platform had not reached its capacity limits. This issue was observed when decryption was enabled for traffic from multiple remote network sites. With this fix, sessions now utilize available resources correctly and are not prematurely terminated.

Fixed an issue where the system encountered a parsing error for the Authority Key Identifier (AKID) extension in certificates, which prevented the AKID from being correctly processed when it began with a specific value. With this fix, the AKID extension is now correctly parsed and processed.

Fixed an issue where firewalls intermittently lost their connection to the Strata Logging Service, which caused logging to stop until the connection was re-established. With this fix, firewalls maintain a stable connection to the Strata Logging Service.

Fixed an issue where firewalls would intermittently disconnect from SLS. With this fix, connections to SLS remain stable.

Fixed an issue where commits intermittently failed on some Prisma Access nodes with the error message client pppoed phase 1 failure.

Fixed an issue where processes restarted and the firewall unexpectedly rebooted when you configured a Security policy rule with Source Device > quarantine.

Fixed an issue where firewalls acting as an accumulation proxy sent a server hello with an earlier TCP timestamp value than a preceding ACK packet, which prevented successful session establishment. This occurred when the client hello messages were split across multiple network segments.

To use this fix, run the CLI command debug dataplane set ssl-decrypt accumulate-client-hello ts-relay yes.

Fixed an issue where system processes would unexpectedly terminate on Prisma Access instances during a configuration commit operation when TLS 1.3 proxy settings were configured. With this fix, system processes remain stable during configuration commits.

Fixed an issue where the firewall stripped the Authentication Key Identifier (AKID) from certificates using SSL decryption, which prevented clients from authenticating server certificates and resulted in decryption failures.

Fixed an issue where the DNS proxy would intermittently stop resolving DNS queries, which prevented users from accessing the internet, and which was observed during periods of high CPU utilization for the dnsproxy process. With this fix, the DNS proxy consistently resolves queries, ensuring reliable internet access.

Fixed an issue where Domain Name System (DNS) Security did not utilize user-configured fully qualified domain names (FQDNs) for cloud connections, which occurred because it used hard-coded FQDNs instead. With this fix, DNS Security now properly reads and translates user-configured FQDNs for cloud connections.