Cloud NGFW: Mandatory Panorama Upgrade to 11.2.7-h4 or higher for managing Cloud NGFW Firewalls.

[prneelakrish]

Mandatory Panorama Upgrade to 11.2.7-h4 or higher for managing Cloud NGFW Firewalls

Symptom

• Panorama may see issues managing Cloud NGFW for AWS and Azure Firewall Resources if not upgraded to version 11.2.7-h4 or later by April 07, 2026.
• For Cloud NGFW for AWS, Panorama Managed Firewall Resources may see issues if Panorama AWS Plugin is not upgraded to version 5.4.2 by April 07, 2026.

Environment

• Cloud NGFW for Azure
• Cloud NGFW for AWS
• Panorama Managed Cloud NGFW Firewall Resource

Cause

Cloud NGFW Firewall Resources will be upgraded starting April 07, 2026, hence the request to upgrade Panorama PanOS version 11.2.7-h4 and Panorama AWS Plugin to version 5.4.2 prior to the aforementioned date.

Resolution

To ensure continued management of your Cloud NGFW resources, your Panorama must be upgraded to PAN-OS version 11.2.7-h4 or higher before April 07, 2026.

Target Version: PAN-OS 11.2.7-h4 or higher

Required Action: Upgrade your Panorama to version 11.2.7-h4 or later if it manages your Cloud NGFW.
Panorama Policy Management

Plugin upgrade required to version 5.4.2. Please refer to this doc here:
Panorama Plugin for AWS

Timeline
You must complete the Panorama and AWS plugin upgrades before the deadline. After this date, Palo Alto Networks will begin upgrading your Cloud NGFW infrastructure during non-business hours in the regional time zone where your firewall operates.

Additional Information

Impact During the Cloud NGFW Firewall Resource Update initiated by Palo Alto Networks post April 07, 2026 (No Customer Action Required)

• Data Plane Traffic Is Not Affected: Your Cloud NGFW resource will continue to secure traffic uninterrupted during the update.
• Minimal Management Impact: You may observe a brief interruption to the management interface during the update.

[JayGolf]

Thanks for sharing @prneelakrish