topic Re: Question about upgrading to PAN-OS 11.1.6-h14 in Next-Generation Firewall Discussions

Question about upgrading to PAN-OS 11.1.6-h14

Aftermath — Wed, 20 Aug 2025 11:14:29 GMT

Hi There

We are currently running PAN-OS 10.2.13-h7 and are planning to migrate to 11.1.6-h14.
Before moving forward, I’d like to ask if this version (11.1.6-h14) is considered stable and safe to install, and if there are any known critical vulnerabilities that we should take into account.

Re: Question about upgrading to PAN-OS 11.1.6-h14

kiwi — Wed, 20 Aug 2025 11:53:14 GMT

Hi @Aftermath ,

As of this writing, PAN-OS 11.1.6-h10 is the preferred release for the 11.1.6 train, according to the official Preferred Release Guidance.

Source: https://live.paloaltonetworks.com/t5/customer-resources/pan-os-globalprotect-amp-user-id-preferred-release-guidance-from/ta-p/258304

You can also review the Known & Addressed Issues to plan a well-informed upgrade path.

Source: https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-release-notes/pan-os-11-1-6-known-and-addressed-issues/pan-os-11-1-6-known-issues

Kind regards,

-Kim.

Re: Question about upgrading to PAN-OS 11.1.6-h14

Aftermath — Wed, 20 Aug 2025 14:23:26 GMT

Hi @kiwi
Hope you good, and thanks for feedback. So how to answer these CVEs and may be have more regarding 11.1.6-h10 where the soluction is Upgrade to 11.1.6-h14 or later.

https://security.paloaltonetworks.com/CVE-2025-4230

https://security.paloaltonetworks.com/CVE-2025-0133

https://security.paloaltonetworks.com/CVE-2025-0137

Re: Question about upgrading to PAN-OS 11.1.6-h14

kiwi — Wed, 20 Aug 2025 14:43:44 GMT

Hi @Aftermath ,

After reading those three advisories, it seems that all three vulnerabilities can be mitigated by either implementing the workarounds or restricting access to the management interface or CLI.

In any case, a risk assessment is needed to decide whether or not to upgrade to the fixed version.

Kind regards,

-Kim.