Palo Alto Networks Release Notes

Cortex XSOAR combines security orchestration, incident management, and interactive investigation into a seamless experience. The orchestration engine is designed to automate security product tasks and weave in human analyst tasks and workflows.

To install this version, see the following:

• Single Server Installation
• Multi-Tenant Installation

If upgrading from an earlier version, including how to install and download, see Upgrade Your Installation.

This Cortex XSOAR version introduces several new features and fixes existing issues. The release notes describe these changes, as well as any known issues.

• New Features
• Known Issues
• Minor Releases

Original source

Cortex XSOAR combines security orchestration, incident management, and interactive investigation into a seamless experience. The orchestration engine is designed to automate security product tasks and weave in human analyst tasks and workflows.

To install this version, see the following:

• Single Server Installation
• Multi-Tenant Installation

If upgrading from an earlier version including how to install and download, see Upgrade Your Installation.

This Cortex XSOAR version introduces several new features and fixes existing issues. The release notes describe these changes, as well as any known issues.

• New Features
• Addressed Issues
• Known Issues

SHA1 Hash: 22b5caaa2072d8d41fc43b8506e473f45c01af3d

Original source

The following table lists the issues addressed in Prisma Agent version 25.6.2.

ISSUE ID DESCRIPTION PANG-9620 Fixed an issue where users were unable to sign in after upgrading the Prisma Agent to version 25.6.1 on macOS 15.x Sequoia. The login window failed to render after upgrade, showing only a blank page, and sign-in could only be completed using SSO. Users can now sign in using username and password after upgrading. PANG-9630 Fixed an issue on Linux where the Prisma Agent failed to establish a connection to the gateway when no client certificate was configured and the connection relied on endpoint manager (EM) cookies for authentication. The agent now successfully connects when using EM cookies without a client certificate. PANG-9276 Fixed an issue on Linux where the Prisma Agent would fail to reconnect after waking from sleep, requiring a service restart or device reboot to restore connectivity. The agent now reconnects automatically when the device wakes from sleep. PANG-9220 Fixed an issue on macOS endpoints where, after a device resumed from sleep, the Prisma Agent failed to update its connection status in the UI. The UI showed an incorrect status that didn't reflect the actual connection state. The agent UI now correctly reflects the connection state after resuming from sleep. PANG-9092 Fixed an issue on macOS endpoints where the Prisma Agent failed to automatically reconnect after network transitions (such as switching between Wi-Fi networks or going from Wi-Fi to LAN). Users had to manually reconnect. The agent now reconnects automatically after network transitions. PANG-9067 Fixed an issue on Windows where the Prisma Agent failed to complete HIP data collection and upload a HIP report when: 1. The HIP profile included a check for specific applications using the Running Processes criteria. 2. The process list on the Windows endpoint was very large (greater than 450 running processes). The agent now successfully collects and uploads HIP reports when checking for running processes, regardless of the number of processes on the endpoint. Original source

The following table lists the addressed issues in Prisma Agent 26.3.3 for macOS and Windows.

ISSUE ID | DESCRIPTION

PANG-14824 | Fixed an issue on Windows and macOS endpoints where, when pre-logon with persistent tunnel was enabled, the agent did not transition from pre-logon mode to user-based authentication after an OS session logon. The agent remained in pre-logon mode until authentication was completed manually.

PANG-14822 | Fixed an issue on Windows endpoints where traffic configured to bypass Prisma Agent and use a coexisting third-party VPN client was incorrectly routed through the Prisma Agent tunnel instead.

PANG-14472 | Fixed an issue on Windows endpoints where, when both expired and valid client certificates matching the configured issuer were present in the certificate store, the Prisma Agent selected the expired certificate for gateway authentication, causing a repeated authentication loop that prevented users from connecting. The agent now automatically selects a valid certificate for authentication.

Original source

The Prisma Agent is a next-generation mobile access agent that allows you to use Prisma Access to secure your mobile workforce. The Prisma Agent delivers secure and convenient access to both enterprise apps and the internet, and also simplifies network, IT, and security operations for your organization.

Review the release information to stay up-to-date with the latest issues with the Prisma Agent.

New Features in Prisma Agent

Prisma Agent Known Issues

Prisma Agent Addressed Issues

Changes to Default Behavior in Prisma Agent

Original source

PAN-OS 10.2.2-h4 Addressed Issues

ISSUE ID DESCRIPTION PAN-238792 Fixed the following device certificate issues: • The firewall was unable to automatically renew the device certificate-Fetching device certificates failed incorrectly with the error message OTP is not valid. • Firewalls disconnected from Strata Logging Service after renewing the device certificate. • The device certificate was not correctly generated on the log forwarding card (LFC). • WildFire cloud logs did not log thermite certificate usage status. PAN-237935 Extended the offline PAN-DB, Panorama, and WildFire certificates which were previously set to expire on September 2, 2024. PAN-237876 Extended the firewall Panorama root CA certificate which was previously set to expire on April 7th, 2024. PAN-237871 (WF-500 appliances and PAN-DB private cloud deployments only) Fixed an issue where the root-cert was set to expire on December 31, 2023. With this fix, the expiration date has been extended. PAN-231771 Fixed an issue where the firewall issued /box/getserv/ requests with PAN-OS 7.1.0 and did not take device certificates. PAN-227568 When a device certificate is installed, renewed, or removed, the firewall will reconnect to the WildFire cloud to use the newest certificate. PAN-215576 Fixed an issue where the userID-Agent and TS-Agent certificates were set to expire on November 18, 2024. With this fix, the expiration date has been extended to January 2032. PAN-202450 Fixed an issue where the device-client-cert was set to expire on December 31, 2023. With this fix, the expiration date has been extended. PAN-198372 Fixed an issue where the root-cert was set to expire on December 31, 2023. With this fix, the expiration date has been extended. Original source

Fixed Issues

PAN-273215: Fixed an issue where a syntax error in the index generation script caused a high management plane CPU load after upgrading

PAN-271774: Fixed an issue where the firewall logs displayed the reason for data filtering action as FW Skipped: XXXX.

PAN-268823: Fixed an issue where Monitor > Log Display did not display all logs when you applied a filter.

PAN-268727: Fixed an issue where traffic was dropped when the accumulation proxy was enabled and header insertion modified packets.

PAN-268314: Fixed an issue where new files were not sent to WildFire. With this fix, the WildFire reserved drive space has been increased for greater session caching capability.

PAN-268002: Fixed an issue where URL filtering response pages were not displayed for sites that were blocked as a result of SSL/TLS handshake inspection.

PAN-267704: Fixed an issue where the firewall did not send an ICMP error packet to Envoy when the MSS was exceeded.

PAN-265111: Fixed an issue where fragmented SSL hello packets were reordered when going out of the SC/ZTT towards the datacenter.

PAN-264249: Fixed an issue on the firewall where SNMP queries timed out when using SNMP.

PAN-263973: Fixed an issue where log collectors had a low incoming log rate.

PAN-263287: The PAN-COMMON-MIB.my file was updated to support new object identifiers (OID) to poll interface use via SNMP with table identifiers.

PAN-262383: Fixed an issue where the firewall was unable to decompress the HTTP2 header, which caused the session to be classified as unknown-tcp instead of web-browsing.

PAN-261673: (VM-Series firewalls on Microsoft Azure environments only) Fixed an issue where, when Accelerated Networking was enabled, traffic was dropped because of the flow_parse_ip_hdr counter related to an Nvidia driver issue.

PAN-259910: Fixed an issue where the firewall reported the same value over consecutive SNMP polls when asynchronous mode was enabled.

PAN-259351: A fix was made to address CVE-2024-3393.

PAN-258166: (PA-220 firewalls only) Fixed an issue where the root partition frequently reached 100%.

PAN-257601: (PA-5450 firewalls only) Fixed an issue where Networking Cards (NC) experienced an internal link fault which caused path monitoring failure on the Dataplane Processing Card (DPC).

PAN-257515: Fixed an issue where Possible Domain Fronting Detection for HTTP/2 generated false positives. With this change, domain fronting is limited to HTTP/1.

PAN-257327: (PA-5440 firewalls only) Fixed an issue where a failover event occurred unexpectedly on the firewall.

PAN-255930: Fixed an issue where persistent DIPP NAT entries were deleted even when being used during an active session.

PAN-253213: Fixed an issue where the firewall sent HIP notifications every time it received a HIP report instead of every two hours.

PAN-248067: Fixed an issue where inter firewall tunnels between Mobile User Gateway node and ZTNA tunnel terminators were down due to host routes getting aged out while still in the routing table.

PAN-247857: (PA-7050 firewalls in HA configurations only) Fixed an issue on the firewall where a dataplane process restarted when updating the routing table.

PAN-246699: Fixed an issue on Panorama where Rule Usage and Apps Seen under Security policy rules stopped incrementing.

PAN-245428: Fixed an issue where FIB entries aged out and were incorrectly removed after an HA failover event.

PAN-244894: Fixed an issue where turning off mprelay logging caused mprelay heartbeat failure.

PAN-241126: Fixed an issue where the client IP address was incorrect in the authentication logs for Captive Portal authentication events when the client used IPv6.

PAN-240739: Fixed an issue where the ECMP FIB update on the dataplane did not clear the pending change flag, which caused the next non-ECMP FIB update to miss the latest generation ID and age out after 5 minutes.

PAN-239271: Fixed an issue where changing the firewall's DNS led to connectivity to the hostname-configured User-ID agent.

PAN-236685: Fixed an issue where the Traffic log did not display the results of an application filter.

PAN-233712: Fixed an issue where the firewall did not install a host route in the FIB when the BGP peer was down, which caused traffic to be dropped.

PAN-233581: Fixed an issue on firewalls in active/active HA configurations where SYN+ACK packets of asymmetric TCP sessions were dropped because of a session synchronization issue.

PAN-233195: Fixed an issue where logs continued to be ingested when the vldmgr process was restarted.

PAN-229367: Fixed an issue where the firewall restarted when a route update message was received while the firewall was processing traffic.

PAN-227543: Fixed an issue where the firewall did not match traffic to FQDN objects if the FQDN object contained uppercase characters.

PAN-227503: Fixed an issue where the link status of the log interface was unable to be obtained correctly using SNMP.

PAN-225213: Fixed an issue where Push All Changes displayed changes that were already committed in the push scope for another device group after performing a selective commit and selective push to the first device group.

Original source

Review a list of known and addressed issues for PAN-OS 10.2.12.

For contacting support, for information on support programs, to manage your account or devices, or to open a support case, go to https://support.paloaltonetworks.com.

PAN-OS 10.2.12 Known Issues

PAN-OS 10.2.12-h6 Addressed Issues

PAN-OS 10.2.12-h4 Addressed Issues

PAN-OS 10.2.12-h3 Addressed Issues

PAN-OS 10.2.12-h2 Addressed Issues

PAN-OS 10.2.12-h1 Addressed Issues

PAN-OS 10.2.12 Addressed Issues

Original source

Review a list of known and addressed issues for PAN-OS 10.2.13.

For contacting support, for information on support programs, to manage your account or devices, or to open a support case, go to https://support.paloaltonetworks.com.

PAN-OS 10.2.13 Known Issues

PAN-OS 10.2.13-h24 Addressed Issues

PAN-OS 10.2.13-h23 Addressed Issues

PAN-OS 10.2.13-h22 Addressed Issues

PAN-OS 10.2.13-h21 Addressed Issues

PAN-OS 10.2.13-h18 Addressed Issues

PAN-OS 10.2.13-h16 Addressed Issues

PAN-OS 10.2.13-h10 Addressed Issues

PAN-OS 10.2.13-h7 Addressed Issues

PAN-OS 10.2.13-h5 Addressed Issues

PAN-OS 10.2.13-h4 Addressed Issues

PAN-OS 10.2.13-h3 Addressed Issues

PAN-OS 10.2.13-h2 Addressed Issues

PAN-OS 10.2.13-h1 Addressed Issues

PAN-OS 10.2.13 Addressed Issues

Original source