BugZero | Palo Alto Networks BugID PAN-251897 - Fixed an issue where GlobalProtect user traffic in...

Palo Alto Networks - Defect ID: PAN-251897

Fixed an issue where GlobalProtect user traffic intermittently did not match the correct Security policy rule with HIP objects due to the firewall learning the GlobalProtect IP address-to-user mapping from multiple sources.

Palo Alto Networks - Defect ID: PAN-251897

Fixed an issue where GlobalProtect user traffic intermittently did not match the correct Security policy rule with HIP objects due to the firewall learning the GlobalProtect IP address-to-user mapping from multiple sources.

Last updated on July 31st, 2026

BugZero Risk Score
6.3 Medium

Overall: 6.3

Severity: 6.4

Community: 3.7

Lifecycle: 10.0

What is the BugZero Risk Score?

Palo Alto Networks Integration

Learn more about where this data comes from

Palo Alto Networks Integration

Learn more

BugZero Plan

Streamline upgrades with automated vendor bug scrubs

BugZero Plan

Learn more

BugZero Prevent

Wish you caught this bug sooner? Get proactive today.

BugZero Prevent

Learn more

Bug Details

Views: 2

Description

Disclaimer

Known affected versions were inferred from fixed-version data and were not explicitly confirmed by the vendor: 11.1.13-h10

The earliest recollection of this bug is traced back to PAN-OS 11.1.14 - July 31, 2026. This bug is fixed in PAN-OS versions 11.1.14. Fixed an issue where GlobalProtect user traffic intermittently did not match the correct Security policy rule with HIP objects due to the firewall learning the GlobalProtect IP address-to-user mapping from multiple sources. For more information: https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-release-notes/pan-os-11-1-14-known-and-addressed-issues/pan-os-11-1-14-addressed-issues

Change history

Top Palo Alto Networks Defects

6.3Defect ID: PAN-321573
( HA Active-Active firewalls only ) Fixed an issue where High Availability (HA) session synchronization did not occur between the active primary and secondary firewalls, which prevented sessions from properly synchronizing across the HA pair. This occurred after a firewall upgrade. With this fix, HA session synchronization between the active primary and secondary firewalls was restored.
6.3Defect ID: PAN-317598
( Firewalls in active/active HA configurations only ) Fixed an issue where NAT failures occurred due to the IP pool not releasing unused resources in the Active Secondary firewall. This occurred because the secondary firewall attempts to release a Persistent DIPP NATed port that was originally allocated by the NAT policy from first firewall, leading to a ownership mismatch during the session teardown process.
6.3Defect ID: PAN-304195
Fixed an issue on the firewall where performing a private data reset caused device telemetry to stop working. This issue also occurred after performing a factory reset and then running the CLI command set system ztp disable .
6.3Defect ID: PAN-292752
Fixed an issue where a command injection vulnerability could occur due to improper input sanitization.
6.3Defect ID: PAN-307773
Fixed an issue on Panorama where enabling Post-Quantum Pre-Shared Key (PPK) within an IKE Gateway profile that was configured as a part of a template stack failed or was inconsistent when attempted via the web interface, even when the keys were properly configured.

Palo Alto Networks Integration

Learn more about where this data comes from

Palo Alto Networks Integration

Learn more

BugZero Plan

Streamline upgrades with automated vendor bug scrubs

BugZero Plan

Learn more

BugZero Prevent

Wish you caught this bug sooner? Get proactive today.

BugZero Prevent

Learn more

Ready to prevent the next vendor outage?

Get a demo

Palo Alto Networks - Defect ID: PAN-251897

Fixed an issue where GlobalProtect user traffic intermittently did not match the correct Security policy rule with HIP objects due to the firewall learning the GlobalProtect IP address-to-user mapping from multiple sources.

Palo Alto Networks - Defect ID: PAN-251897

Fixed an issue where GlobalProtect user traffic intermittently did not match the correct Security policy rule with HIP objects due to the firewall learning the GlobalProtect IP address-to-user mapping from multiple sources.

Last updated on July 31st, 2026

BugZero Risk Score
6.3 Medium

Bug Details

Disclaimer

Links

Top Palo Alto Networks Defects

Ready to prevent the next vendor outage?

Palo Alto Networks - Defect ID: PAN-251897

Fixed an issue where GlobalProtect user traffic intermittently did not match the correct Security policy rule with HIP objects due to the firewall learning the GlobalProtect IP address-to-user mapping from multiple sources.

Palo Alto Networks - Defect ID: PAN-251897

Fixed an issue where GlobalProtect user traffic intermittently did not match the correct Security policy rule with HIP objects due to the firewall learning the GlobalProtect IP address-to-user mapping from multiple sources.

Last updated on July 31st, 2026

BugZero Risk Score
6.3 Medium

Bug Details

Disclaimer

Links

Top Palo Alto Networks Defects

Ready to prevent the next vendor outage?

Palo Alto Networks - Defect ID: PAN-251897

Fixed an issue where GlobalProtect user traffic intermittently did not match the correct Security policy rule with HIP objects due to the firewall learning the GlobalProtect IP address-to-user mapping from multiple sources.

Palo Alto Networks - Defect ID: PAN-251897

Fixed an issue where GlobalProtect user traffic intermittently did not match the correct Security policy rule with HIP objects due to the firewall learning the GlobalProtect IP address-to-user mapping from multiple sources.

Last updated on July 31st, 2026

BugZero Risk Score6.3 Medium

Bug Details

Disclaimer

Links

Top Palo Alto Networks Defects

Ready to prevent the next vendor outage?

Palo Alto Networks - Defect ID: PAN-251897

Fixed an issue where GlobalProtect user traffic intermittently did not match the correct Security policy rule with HIP objects due to the firewall learning the GlobalProtect IP address-to-user mapping from multiple sources.

Palo Alto Networks - Defect ID: PAN-251897

Fixed an issue where GlobalProtect user traffic intermittently did not match the correct Security policy rule with HIP objects due to the firewall learning the GlobalProtect IP address-to-user mapping from multiple sources.

Last updated on July 31st, 2026

BugZero Risk Score6.3 Medium

Bug Details

Disclaimer

Links

Top Palo Alto Networks Defects

Ready to prevent the next vendor outage?

BugZero Risk Score
6.3 Medium

BugZero Risk Score
6.3 Medium