Fixed an issue where the Maximum Segment Size (MSS) rewrite functionality for packets ingressing through SD-WAN interfaces on firewalls was not optimized.

Fixed an issue where SSL traffic was dropped on SD-WAN DIA interfaces with member having different MTU.

Fixed an issue where firewalls experienced snmpd log flooding with messages such as update_ifTable_utilization_rates(pan_interfacecache.c:1720): Last time is 0 for dedicated-ha2., which caused the snmpd log to overflow and be cleared every five minutes. This occurred because the snmpd process attempted to calculate interface utilization rates without first verifying if the interface had valid sysd configuration data, as the code incorrectly assumed all interfaces in the MIB would possess valid sysd data.

Fixed an issue on Panorama where, while configuring an an Application Filter with Generative AI tags, the web interface did not retain application exclusions that were added across multiple pages until you clicked OK.

Fixed an issue where SNMP returned an incorrect down status for HSCI and logging interfaces even when the interfaces were up, and counters for the interfaces displayed only zero values.

Fixed an issue on Panorama where the multi-clone XML API operation reported a successful configuration change even when the specific device group did not exist.

Fixed a rare issue on Octeon Dataplane platforms where the firewall experienced an unexpected dataplane restart due to a race condition that occurred during session teardown for traffic undergoing software-based Content Threat detection.

Fixed an issue where packets were dropped on SD-WAN interfaces when a proxy was enabled due to an MTU inconsistency where the firewall failed to rewrite the maximum segment size in SYN/ACK packets based on the SD-WAN virtual interface MTU.

Note: This fix does not apply when the traffic egress interface is SD-WAN Direct Internet Access (DIA) interface and proxy is enabled.

Fixed an issue where TLS connections failed to establish in asymmetric routing environments if the Client Hello was split into multiple segments and arrived out of order.

Fixed an issue where scheduled software upgrades from the Software Change Management (SCM) server to the firewall failed with a timeout error during download.

(Panorama virtual appliances only) Fixed an issue where Panorama was inaccessible with the error message Timed out while getting config lock.

Fixed an issue where on PA-7500 firewalls, SNMP incorrectly reported the administrative and operational status of High Speed Chassis Interconnect (HSCI) interfaces as down, even when the interfaces were physically up. Additionally, interface counters for these interfaces displayed all zeroes.

Fixed an issue where memory leaks occurred. These leaks were caused by two distinct scenarios: the failure to deallocate memory for a nodeset when a new nodeset was assigned to the same variable, and the failure to free a UUID hash table during error conditions.

(Firewalls in HA configurations only) Fixed an issue where the configd process stopped responding during an External Dynamic List (EDL) refresh.

Fixed an issue where, when a commit job ID was higher than 65535, the XML API truncated the ID to a 16-bit unsigned integer due to an incorrect type case during printing, which resulted in an incorrect job ID being reported compared to the CLI output for the same commit.

Fixed an issue where the Management Processor Card (MPC) on modular firewalls became unresponsive when a disk drive entered a low-power state and failed to wake up.

Fixed an issue where the Elasticsearch client certificate was not auto renewed, which caused it to enter a Red state, and logs were not displayed in Panorama.