Disclaimer

Known affected versions were inferred from fixed-version data and were not explicitly confirmed by the vendor: 9.1.11-h5, 10.1.3-h4

The earliest recollection of this bug is traced back to PAN-OS 10.1.4 - July 22, 2025. This bug is fixed in PAN-OS versions 10.1.4, 9.1.12. Fixed an issue with the GlobalProtect Clientless VPN where, when an application sent a negative max age value on a cookie, part of the cookie was retained by PAN-OS and used for the subsequent connection on the user session. For more information: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-release-notes/pan-os-10-1-4-known-and-addressed-issues/pan-os-10-1-4-addressed-issues https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-release-notes/pan-os-9-1-addressed-issues/pan-os-9-1-12-addressed-issues