Question about upgrading to PAN-OS 11.1.6-h14

[Aftermath]

Hi There

We are currently running PAN-OS 10.2.13-h7 and are planning to migrate to 11.1.6-h14.
Before moving forward, I’d like to ask if this version (11.1.6-h14) is considered stable and safe to install, and if there are any known critical vulnerabilities that we should take into account.

[kiwi]

Hi @Aftermath ,

As of this writing, PAN-OS 11.1.6-h10 is the preferred release for the 11.1.6 train, according to the official Preferred Release Guidance.

Source: https://live.paloaltonetworks.com/t5/customer-resources/pan-os-globalprotect-amp-user-id-preferred-r...

You can also review the Known & Addressed Issues to plan a well-informed upgrade path.

Source: https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-release-notes/pan-os-11-1-6-known-and-addressed...

Kind regards,

-Kim.

[Aftermath]

Hi @kiwi 
Hope you good, and thanks for feedback. So how to answer these CVEs and may be have more regarding 11.1.6-h10 where the soluction is Upgrade to 11.1.6-h14 or later.

https://security.paloaltonetworks.com/CVE-2025-4230 

https://security.paloaltonetworks.com/CVE-2025-0133 

https://security.paloaltonetworks.com/CVE-2025-0137 

[kiwi]

Hi @Aftermath ,

After reading those three advisories, it seems that all three vulnerabilities can be mitigated by either implementing the workarounds or restricting access to the management interface or CLI.

In any case, a risk assessment is needed to decide whether or not to upgrade to the fixed version.

Kind regards,

-Kim.