topic Re: NEW CVE causes new hotfix, can the hotfix be considered stable? in General Topics

NEW CVE causes new hotfix, can the hotfix be considered stable?

S.Ramesh960545 — Mon, 17 Mar 2025 03:58:13 GMT

Previously it was mentioned that 10.2.12-h6 was the latest stable version. In light of the new CVEs and the recommendations that come with it, can I verify that 10.2.13-h5 is the new stable version?

Re: NEW CVE causes new hotfix, can the hotfix be considered stable?

Raido_Rattameister — Mon, 17 Mar 2025 13:57:09 GMT

Currently TAC advisory and firewall both show preferred version to be 10.2.10-h9.

Palo don't tend to update preferred version based on CVEs so you should review if CVE applies to your use case and install hotfix if it does.

https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-p/258304

Re: NEW CVE causes new hotfix, can the hotfix be considered stable?

albertojaden8 — Mon, 26 May 2025 09:53:29 GMT

@Raido_Rattameister Thanks for sharing this, Raido. I agree it's important to not just rely on the preferred version list but also cross-check CVEs relevant to our environment. That link you shared is definitely helpful as a reference: https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-p/258304