Skip to content
Patcharo

Guides

PAN-OS versions explained: release lines, maintenance releases and the -h1, -h2, -h3 suffixes

How to read a PAN-OS version number, what a hotfix suffix changes, where the vendor lists what each release fixes, and what the number alone can never tell you.

Who it is for
Network and security engineers who run Palo Alto Networks firewalls or Panorama and read PAN-OS release numbers in advisories and inventories.
Scope
PAN-OS on next-generation firewalls and Panorama. Not GlobalProtect app, Prisma Access or content releases, which have their own numbering.

Published 19 Oct 2026 · Updated 19 Oct 2026 · Sources checked 19 Oct 2026

What a PAN-OS version number says

A PAN-OS version has three numbers and, sometimes, a suffix. The first two numbers name the release line, which Palo Alto Networks calls a feature release: 10.2, 11.1, 11.2 and so on. The third number counts the maintenance releases of that line, published to fix issues without adding features. The optional suffix, written -h followed by a number, names a hotfix built on top of one maintenance release.

Each release line has its own set of release notes on the vendor's documentation site, with one page per maintenance release (its known issues and the issues it addresses) and one page per hotfix (the issues it addresses). The release line also has its own dates in the vendor's End-of-Life Summary: a release date, an end of standard support and an end of extended support.

WrittenWhat it isWhere the vendor documents it
11.1A release line (feature release)The release notes set of the line; its dates in the End-of-Life Summary
11.1.4The fourth maintenance release of the 11.1 lineThe “PAN-OS 11.1.4 Known and Addressed Issues” page
11.1.4-h7The seventh hotfix built on the 11.1.4 maintenance releaseThe “PAN-OS 11.1.4-h7 Addressed Issues” page
11.2.0The first release of the next lineThe release notes set of the 11.2 line
The numbers follow the vendor's naming; the pages exist under the same titles for every line. A dated example written for this guide; the current releases are in the live block and on the product pages.

Release lines and maintenance releases

A maintenance release belongs to one line and only moves inside it: upgrading from one maintenance release to the next stays within the line and does not change the feature set. The vendor organises its release notes so that each maintenance release lists the issues it addresses; a later maintenance release of the same line is published with the earlier ones' fixes in it, which is why advisories name a first fixed release per line (“fixed in this release and later releases of the line”).

Lines live side by side. The same vulnerability is usually fixed by a different release in each line that is still maintained, and a line past its end of life gets no fix at all. Reading an advisory therefore starts by finding your line, then the first fixed release stated for it.

The newest maintenance release of a line is a fact of availability. It is not, by itself, what the vendor recommends you run: Palo Alto Networks publishes its release guidance for customers in its support portal, which Patcharo does not read. Patcharo shows what exists and what fixes what, with the sources.

The -h1, -h2, -h3 suffixes: hotfixes

A hotfix is a build of one maintenance release that addresses a short list of issues, often a security fix that could not wait for the next maintenance release. Its suffix counts the hotfixes of that maintenance release: -h1 is the first hotfix of a maintenance release, -h7 the seventh. The suffix restarts with each maintenance release, so the -h1 of one maintenance release is unrelated to the -h1 of the next.

The hotfix suffix is part of the identifier an advisory uses. When a security advisory says a vulnerability is fixed in a hotfix, the plain maintenance release under it is affected: a reader who drops the suffix will believe a fix is installed when it is not. Patcharo compares versions with the suffix, so a record with the suffix and a record without it get different answers.

Do not assume that a hotfix carries the fixes of the earlier hotfixes of the same maintenance release, nor that the next maintenance release carries the fix of a hotfix. The vendor documents what each release addresses, page by page: read the “Addressed Issues” of the hotfix you consider, and the fixed releases the advisory names for your line.

Where to read what a release fixes and what it still has

Each release notes set has a Known and Addressed Issues chapter: one page per maintenance release with its known issues and addressed issues, and one page per hotfix. Issues carry the vendor's identifiers (PAN- followed by digits) and, when a fix closes a vulnerability, the CVE identifier appears in the entry or in the advisory that names the release.

  • To know whether a release fixes a vulnerability, read the security advisory: it names the first fixed release per line, hotfix suffixes included.
  • To know what else changed in a release, read its Addressed Issues page; to know what the vendor still lists as broken, read its Known Issues page.
  • To know whether a release exists for your model, read the Compatibility Matrix, which lists the supported releases per platform.
  • To know how long the line is maintained, read the End-of-Life Summary.

What the number alone never tells you

  • Whether a vulnerability is fixed: only the advisory's fixed releases say so, and they differ per line.
  • Whether the release runs on your platform or with your Panorama: the Compatibility Matrix and the upgrade guide say so.
  • Whether the vendor recommends it: the vendor's release guidance is published to customers in its portal, not in the number.
  • Whether the line is still maintained: the End-of-Life Summary says so, and an advisory lists no fix for a line past its end of life.

Reading the number is the first step. Choosing the release to install is a decision that weighs the fixes you need, the platform, the management server, the upgrade path and the vendor's guidance: the next guide walks through it.

The current PAN-OS releases, as the catalog reads them

Patcharo reads the table of contents of each release line's release notes on the vendor's documentation site, about every six hours, and lists every maintenance release and hotfix it names. The block below is that reading, with the day it was last verified; the product page lists every line and release.

Current versions, from the catalog

Read from the vendor's own documents by the collection described in this guide; the examples in the text are illustrative and dated, these facts are live.

PAN-OS

Product page
  • 12.2Latest public release —Vendor recommendation —Not collected
  • 12.1Latest public release —Vendor recommendation —Not collected
  • 11.2Latest public release —Vendor recommendation —Not collected
  • 11.1Latest public release —Vendor recommendation —Not collected

Availability, recommendation and support are read from the vendor's documents and shown apart; a release Patcharo lists is not advice to install it.

Frequent mistakes

  • Dropping the -h suffix when recording a version, which turns a fixed firewall into an affected one, or the reverse.
  • Treating the newest maintenance release as the recommended one: the vendor's guidance is a separate statement.
  • Reading a fix stated for one line as valid for another line.
  • Assuming a hotfix is cumulative, or that the next maintenance release includes it, without reading the Addressed Issues pages.

What to verify before acting

  • The exact version string of the device, suffix included, as the device itself reports it.
  • The first fixed release the advisory names for your line, and the vendor's wording about later releases.
  • The Compatibility Matrix for your platform and the Panorama requirements of the upgrade guide.
  • The end-of-life dates of your line in the End-of-Life Summary.

Sources

The official documents this guide rests on, read against the text on 19 Oct 2026. Nothing here is copied from them: read them for the authoritative wording.