Yes, PAN-OS versions can be upgraded without a support license if it's done manually.
In order to download PAN-OS software images directly from the update server, the Palo Alto Networks firewall needs to have a support license activated on the support portal (it is not required to have the license installed on the firewall for PAN-OS image installs) and have internet access to download the software packages.
However, in certain environments customers's devices will not have access to the internet, but would still need to perform software upgrades.
In such cases, PAN-OS updates can be downloaded from the support portal and brought into the OutOfBand network to be installed manually
It is recommended to first manually upload and install the latest content version (App) and then manually upload and install the desired PAN-OS version.