BugZero | Palo Alto Networks BugID PAN-110685 - Fixed a rare issue where an incorrect User-IDâ¢ m...

Palo Alto Networks - Defect ID: PAN-110685

Fixed a rare issue where an incorrect User-IDâ¢ match to the respective LDAP group caused a security policy mismatch.

Palo Alto Networks - Defect ID: PAN-110685

Fixed a rare issue where an incorrect User-IDâ¢ match to the respective LDAP group caused a security policy mismatch.

Last updated on July 22nd, 2025

BugZero Risk Score
6.3 Medium

Overall: 6.3

Severity: 6.4

Community: 3.7

Lifecycle: 10.0

What is the BugZero Risk Score?

Palo Alto Networks Integration

Learn more about where this data comes from

Palo Alto Networks Integration

Learn more

BugZero Plan

Streamline upgrades with automated vendor bug scrubs

BugZero Plan

Learn more

BugZero Prevent

Wish you caught this bug sooner? Get proactive today.

BugZero Prevent

Learn more

Bug Details

Description

Disclaimer

Known affected versions were inferred from fixed-version data and were not explicitly confirmed by the vendor: 8.1.10, 9.1.3-h1

The earliest recollection of this bug is traced back to PAN-OS 8.1.11 - July 22, 2025. This bug is fixed in PAN-OS versions 8.1.11, 9.1.4. Fixed a rare issue where an incorrect User-IDâ¢ match to the respective LDAP group caused a security policy mismatch. For more information: https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-release-notes/pan-os-8-1-addressed-issues/pan-os-8-1-11-addressed-issues https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-release-notes/pan-os-9-1-addressed-issues/pan-os-9-1-4-addressed-issues

Change history

Top Palo Alto Networks Defects

6.3Defect ID: PAN-321573
( HA Active-Active firewalls only ) Fixed an issue where High Availability (HA) session synchronization did not occur between the active primary and secondary firewalls, which prevented sessions from properly synchronizing across the HA pair. This occurred after a firewall upgrade. With this fix, HA session synchronization between the active primary and secondary firewalls was restored.
6.3Defect ID: PAN-317598
( Firewalls in active/active HA configurations only ) Fixed an issue where NAT failures occurred due to the IP pool not releasing unused resources in the Active Secondary firewall. This occurred because the secondary firewall attempts to release a Persistent DIPP NATed port that was originally allocated by the NAT policy from first firewall, leading to a ownership mismatch during the session teardown process.
6.3Defect ID: PAN-304195
Fixed an issue on the firewall where performing a private data reset caused device telemetry to stop working. This issue also occurred after performing a factory reset and then running the CLI command set system ztp disable .
6.3Defect ID: PAN-292752
Fixed an issue where a command injection vulnerability could occur due to improper input sanitization.
6.3Defect ID: PAN-307773
Fixed an issue on Panorama where enabling Post-Quantum Pre-Shared Key (PPK) within an IKE Gateway profile that was configured as a part of a template stack failed or was inconsistent when attempted via the web interface, even when the keys were properly configured.

Palo Alto Networks Integration

Learn more about where this data comes from

Palo Alto Networks Integration

Learn more

BugZero Plan

Streamline upgrades with automated vendor bug scrubs

BugZero Plan

Learn more

BugZero Prevent

Wish you caught this bug sooner? Get proactive today.

BugZero Prevent

Learn more

Ready to prevent the next vendor outage?

Get a demo

Palo Alto Networks - Defect ID: PAN-110685

Fixed a rare issue where an incorrect User-IDâ¢ match to the respective LDAP group caused a security policy mismatch.

Palo Alto Networks - Defect ID: PAN-110685

Fixed a rare issue where an incorrect User-IDâ¢ match to the respective LDAP group caused a security policy mismatch.

Last updated on July 22nd, 2025

BugZero Risk Score
6.3 Medium

Bug Details

Disclaimer

Links

Top Palo Alto Networks Defects

Ready to prevent the next vendor outage?

Palo Alto Networks - Defect ID: PAN-110685

Fixed a rare issue where an incorrect User-IDâ¢ match to the respective LDAP group caused a security policy mismatch.

Palo Alto Networks - Defect ID: PAN-110685

Fixed a rare issue where an incorrect User-IDâ¢ match to the respective LDAP group caused a security policy mismatch.

Last updated on July 22nd, 2025

BugZero Risk Score
6.3 Medium

Bug Details

Disclaimer

Links

Top Palo Alto Networks Defects

Ready to prevent the next vendor outage?

Palo Alto Networks - Defect ID: PAN-110685

Fixed a rare issue where an incorrect User-IDâ¢ match to the respective LDAP group caused a security policy mismatch.

Palo Alto Networks - Defect ID: PAN-110685

Fixed a rare issue where an incorrect User-IDâ¢ match to the respective LDAP group caused a security policy mismatch.

Last updated on July 22nd, 2025

BugZero Risk Score6.3 Medium

Bug Details

Disclaimer

Links

Top Palo Alto Networks Defects

Ready to prevent the next vendor outage?

Palo Alto Networks - Defect ID: PAN-110685

Fixed a rare issue where an incorrect User-IDâ¢ match to the respective LDAP group caused a security policy mismatch.

Palo Alto Networks - Defect ID: PAN-110685

Fixed a rare issue where an incorrect User-IDâ¢ match to the respective LDAP group caused a security policy mismatch.

Last updated on July 22nd, 2025

BugZero Risk Score6.3 Medium

Bug Details

Disclaimer

Links

Top Palo Alto Networks Defects

Ready to prevent the next vendor outage?

Fixed a rare issue where an incorrect User-IDâ¢ match to the respective LDAP group caused a security policy mismatch.

Fixed a rare issue where an incorrect User-IDâ¢ match to the respective LDAP group caused a security policy mismatch.

BugZero Risk Score
6.3 Medium

Fixed a rare issue where an incorrect User-IDâ¢ match to the respective LDAP group caused a security policy mismatch.

Fixed a rare issue where an incorrect User-IDâ¢ match to the respective LDAP group caused a security policy mismatch.

BugZero Risk Score
6.3 Medium