The earliest recollection of this bug is traced back to PAN-OS 12.1.4 - December 16, 2025. This bug is fixed in PAN-OS versions 12.1.4. ( Firewalls in active/active HA configurations only ) Fixed an issue where, when a commit operation was in progress, newly deployed IP address tags that used the XML API were not immediately reflected in address group resolution, which delayed IP address mapping to address groups and caused traffic to be incorrectly allowed or denied. For more information: https://docs.paloaltonetworks.com/ngfw/release-notes/12-1/pan-os-12-1-4-known-and-addressed-issues/pan-os-12-1-4-addressed-issues