High CPU after XDR 2380 Content update

Joe-Oberfoell — Tue, 11 Aug 2026 14:29:44 GMT

Anyone else seeing this? Its slowing all our servers down and VM's

Re: High CPU after XDR 2380 Content update

susekar — Tue, 11 Aug 2026 15:05:46 GMT

Greetings for the day.

Regarding the high CPU usage observed after the Cortex XDR 2380 content update, this is a known phenomenon that can occur when a content update triggers intensive security scans or encounters resource contention, particularly on high-load servers like ADFS WAP or database servers .

Recommended Mitigation Steps:

For critical servers, consider increasing system resources (e.g., doubling vCPUs and RAM) as a short-term remediation .
Module Isolation: To identify the specific cause, perform a module isolation test:
- Disable the Malware Profile first .
- If high CPU persists, disable the Exploit Profile and restart the impacted applications/services .
- Test disabling Event Collection if the issue is still unresolved .

For a thorough investigation, I recommend raising a TAC support ticket with the Cortex XDR Palo Alto Networks team. They can perform an in-depth analysis to identify the root cause (RCA) and provide the necessary resolution.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

Re: High CPU after XDR 2380 Content update

Joe-Oberfoell — Tue, 11 Aug 2026 15:19:14 GMT

Thx, I did open a ticket. This is the 1st time in 4 years a content update has ever slowed us down.

topic High CPU after XDR 2380 Content update in Cortex XDR Discussions

High CPU after XDR 2380 Content update

Re: High CPU after XDR 2380 Content update

Recommended Mitigation Steps:

Re: High CPU after XDR 2380 Content update