Guides

Choosing a PAN-OS upgrade target: guidance, latest release, fixes and compatibility

A method to pick the release to install on a Palo Alto Networks firewall: what the vendor's guidance is, what the newest release is, which release fixes what concerns you, and the constraints that decide between them.

Who it is for: Engineers planning a PAN-OS upgrade on firewalls or Panorama, and the people who approve the change.
Scope: PAN-OS on next-generation firewalls and Panorama. The method applies to any release line; the vendor's documents give the values for yours.

Published 19 Oct 2026 · Updated 19 Oct 2026 · Sources checked 19 Oct 2026

Start from what you run

An upgrade target is chosen for a device, not in the abstract. Write down the exact version the device reports, hotfix suffix included; its model; its Panorama and the Panorama's version; whether it runs in a high-availability pair; the content release installed; and the plugins (VM-Series, Panorama plugins) in use. Every constraint below is read against these facts.

Then list the vulnerabilities that concern this device: the advisories whose affected releases include the version it runs, with the first fixed release each names for your line. Patcharo computes that list from the recorded version and keeps the advisories' wording and links; a reader without it does the same by hand from the vendor's advisories.

Three candidates, three different questions

Candidate	The question it answers	Where it comes from
The vendor's release guidance	Which release does Palo Alto Networks advise its customers to run?	The vendor's support portal (customer sign-in). Patcharo does not read it and shows no recommendation for PAN-OS.
The newest maintenance release of your line	Which release of my line exists and carries the most fixes?	The release notes of the line; Patcharo's catalog lists it with its date when stated.
The first fixed release of your advisories	Which release closes the vulnerabilities that concern this device?	The security advisories, per line, hotfix suffixes included.

The three can coincide; they often do not. A target is chosen when it satisfies the third question and the constraints below, and respects the first when you can read it.

The newest release is not a recommendation, and a recommendation is not a guarantee that your advisories are fixed. Test every candidate against the first fixed releases of the vulnerabilities that concern you: a recommended release older than a first fixed release leaves the device affected.

The constraints that decide

Platform: the Compatibility Matrix lists the releases each model supports. A release absent from your model's row is not a candidate, whatever else it fixes.
Panorama: the upgrade guide requires Panorama to run a release at least as recent as the firewalls it manages. A firewall target newer than Panorama means upgrading Panorama first.
Upgrade path: moving to another release line goes through the base release of each intermediate line, as the upgrade guide describes; the number of steps, and the maintenance windows, grow with the distance.
Content release: each PAN-OS release requires a minimum content release version, stated in its release notes. Update content before the software.
High availability: the upgrade guide gives the order and the checks for an HA pair; a release both peers support is required.
Plugins and integrations: VM-Series and Panorama plugins have their own compatibility lines in the matrix.
Changes to default behaviour: each line's release notes list them; a target that changes a default you rely on needs a configuration review, not only an install.
Life cycle: a line close to its end of life is a target for a short time only; the End-of-Life Summary gives the dates.

A method in six steps

List the advisories that concern the device and the first fixed release each names for your line.
Take the newest of those first fixed releases as the floor: no candidate below it closes everything that concerns you.
Read the vendor's release guidance in its portal if you have access; prefer a guided release at or above the floor.
Check the candidate against the Compatibility Matrix (model, Panorama, plugins) and the content release requirement.
Read the candidate's Known Issues page and the line's changes to default behaviour; drop a candidate whose known issues hit your deployment.
Plan the path from the current release (intermediate base releases, Panorama first, HA order), then verify after the upgrade that the device reports the target version, suffix included.

After the upgrade

Record the version the device reports after the upgrade, with its suffix, and let the matching run again: the vulnerabilities that named a fixed release at or below the new version leave the list, the others stay. A remaining entry is either a vulnerability without a fix in your line yet, or a sign that the installed version is not the one you intended.

Current versions, from the catalog

Read from the vendor's own documents by the collection described in this guide; the examples in the text are illustrative and dated, these facts are live.

PAN-OS

Product page

12.2Latest public release —Vendor recommendation —Not collected
12.1Latest public release —Vendor recommendation —Not collected
11.2Latest public release —Vendor recommendation —Not collected
11.1Latest public release —Vendor recommendation —Not collected

Availability, recommendation and support are read from the vendor's documents and shown apart; a release Patcharo lists is not advice to install it.

Frequent mistakes

Choosing the newest release because it is the newest, without reading its known issues and the model's compatibility row.
Upgrading firewalls before Panorama, or without the minimum content release.
Stopping at a recommended release that is older than the first fixed release of an advisory that concerns the device.
Planning a cross-line upgrade as a single step.

What to verify before acting

The floor: the newest first fixed release among the advisories that concern the device, suffix included.
The Compatibility Matrix rows of the model, Panorama and plugins for the candidate.
The minimum content release of the candidate and the changes to default behaviour of the line.
The upgrade path from the current release and the HA procedure in the upgrade guide.
The end-of-life dates of the target line.

Sources

The official documents this guide rests on, read against the text on 19 Oct 2026. Nothing here is copied from them: read them for the authoritative wording.

PAN-OS Upgrade Guide
Palo Alto Networks TechDocs · Upgrade paths, the Panorama-before-firewalls rule, the content release requirement, the HA procedure.
Compatibility Matrix
Palo Alto Networks TechDocs · Supported releases per model, Panorama and plugin compatibility.
PAN-OS 11.1 Release Notes
Palo Alto Networks TechDocs · Known and addressed issues, changes to default behaviour, associated content versions.
End-of-Life Summary
Palo Alto Networks · How long each release line is maintained.
Palo Alto Networks Security Advisories
Palo Alto Networks PSIRT · The first fixed releases per line, used to test a candidate against the vulnerabilities that concern you.