topic Re: Support with PA-440 Software in General Topics

Support with PA-440 Software

S.Alizada — Sat, 24 Jan 2026 05:18:51 GMT

Dear all,

I have a pair of HA PA-440 with the software version of 11.2.7-h4, now I want to install the version 11.2.10-h2 to remediate CVE-(High Severity Vulnerability in PAN-OS) and (Customer Advisory on Device Certificate Renewal for NGFW Devices in Active-Passive High Availability (HA) with Service Route)

Now I want to install software version 11.2.10-h2 into my Palo Alto-440, the situation is that the version does not appear in the PA GUI to download and install.

I have downlaoded it from the Palo Alto CSP, and uploaded it into the PA, but there are the following issues:
1. The Version does not appear in the PA GUI?
2. Is the version 11.2.10-h2 compatible with PA-440?

Please advise how to fix this issue.

Thank you.

Best Regards,

Shah.

Re: Support with PA-440 Software

TomYoung — Sat, 24 Jan 2026 17:00:39 GMT

Hi @S.Alizada ,

It shows up for me on my PA-450. Could you confirm that you have Preferred Releases and Base Releases unchecked on the bottom of the GUI?

Thanks,

Tom

Re: Support with PA-440 Software

Raido_Rattameister — Sat, 24 Jan 2026 23:55:30 GMT

If software versions don't appear in GUI, then your firewall support has expired.

If you have recently renewed subscription then go to licenses page and click on check from server.

Re: Support with PA-440 Software

tonacoecarvalho.adv — Sun, 25 Jan 2026 05:00:29 GMT

Hi. 11.2.10-h2 is compatible with PA-440 (full 11.2 support for PA-400 series). It fixes the device cert renewal issue in active/passive HA with service routes + related high-sev stuff.

Image not showing after upload = common glitch (file already partially there or upload path glitch).

Fixes (try in order):

CLI on active:textdelete software version 11.2.10-h2
request system software reloadThen re-upload via GUI/SCP > should appear.

If still missing: Software page > bottom > "Install from file" > pick the .bin again > installs directly.

HA upgrade order:

Passive first: install > commit force > reboot
Verify HA sync + cert status
Failover
Repeat on old active

After: check
textshow system info | match sw-version
request certificate status
If fails, paste:
textshow system software status

I'll give exact commands.

Guilherme Lucas

Re: Support with PA-440 Software

kiwi — Thu, 29 Jan 2026 10:13:01 GMT

Hi @S.Alizada ,

Currently 11.2.10-h2 is not a recommended version. So likely you're running into the issue @TomYoung mentions.
Un-check the 'Preferred Releases' and 'Base Releases' as Tom suggests at the bottom of the page and refresh your view to update the list.

Kind regards,

-Kim.

Re: Support with PA-440 Software

OtakarKlier — Wed, 28 Jan 2026 17:12:40 GMT

Hello,

Uncheck the boxes and then click Check Now.

Regards,