Palo Alto PA-7000, PA-800, PA-3200 EOL and Standard Support End Dates

By Scott Bissett  ·  Published: November 7, 2026  ·  Reference guide  ·  Read from Palo Alto Networks' Hardware End-of-Life Dates page, End-of-Life Summary and End-of-Life Policy on the day of publication.

Palo Alto Networks ends Standard Support on the PA-7000 Series on May 2, 2027, and on the PA-800 Series on May 3, 2027, as on the PA-3200 Series (May 3, 2027). The same cut-off applies to the PA-5200 Series (May 2, 2027), the Panorama M-200 and M-600 management appliances (May 2, 2027) and the WF-500 WildFire appliance (May 2, 2027). None of these appliances reaches end of life on those days. What ends is Standard Support for the last PAN-OS release each one can run; the hardware then stays in Extended Support until its own end-of-life date, which for these models falls between August 31, 2028 and December 31, 2030.

The dates, appliance by appliance

The -ZTP variants of the PA-800 and PA-3200 share their series' dates. On the PA-5200 Series, Palo Alto adds a note that PAN-OS 11.1 also receives extended support until the hardware's end of life, so a PA-5200 that stays on 11.1 is covered to the same date as one on 11.2. Every model, including the ones already past end of life, is on the Palo Alto Networks PA-Series page.

Active support versus end of life, in Palo Alto's terms

Palo Alto runs two clocks for a firewall: one for the box and one for the operating system on it.

• End-of-Sale is, in Palo Alto's policy, the last day the product can be ordered.
• End-of-Life is the last day Palo Alto supports the product. For hardware, the policy promises technical assistance and replacement hardware for five years after End-of-Sale, as long as a support contract is kept up continuously. That is why each end-of-life date in the table is exactly five years after the end-of-sale date.
• Last Supported OS is the newest PAN-OS release the appliance can run: PAN-OS 11.2 for the PA-7000, PA-5200, M-200, M-600 and WF-500, and PAN-OS 11.1 for the PA-800 and PA-3200. Palo Alto states that this release is supported until the hardware's End-of-Life date.
• Standard Support and Extended Support are the two phases that release goes through. The Standard Support date is the PAN-OS release's own date: the End-of-Life Summary lists PAN-OS 11.2 standard support until May 2, 2027 and PAN-OS 11.1 until May 3, 2027. Extended Support "begins automatically" when Standard Support ends, and for a hardware model's last supported OS it lasts until that hardware's end-of-life date, even after the general extended-support date for that PAN-OS release has passed.

On our PA-Series page, the "active support" date for each model is Palo Alto's Standard Support end for its last supported OS, and the end-of-life date is Palo Alto's hardware End-of-Life date. In between, the firewall is supported, but on Extended Support terms.

What changes when Standard Support ends

Palo Alto's End-of-Life Policy spells out both phases for PAN-OS. Standard Support includes TAC support, content updates, bug fixes, maintenance releases, workarounds and fixes for vulnerabilities under Palo Alto's Product Security Assurance policy. Extended Support keeps a narrower set:

• TAC support, provided the customer has an active support contract;
• content updates, provided the customer keeps active subscriptions;
• bug fixes only for Priority 1 (P1) critical system stability issues where there is no workaround;
• vulnerability fixes only for Critical and High vulnerabilities (CVSS 7.0 or higher).

In practice: threat signatures and other content keep flowing, and a critical or high-severity PAN-OS vulnerability still gets a fix, but ordinary bugs and Medium or Low vulnerabilities fall outside what the policy commits to.

Security exposure

PAN-OS is a regular entry in CISA's Known Exploited Vulnerabilities catalog, including CVE-2024-3400 (command injection in the GlobalProtect feature) and the management-interface pair CVE-2024-0012 and CVE-2024-9474, added to the catalog together. The second of that pair shows where the Extended Support line sits: Palo Alto's own advisory scores CVE-2024-9474 at 6.9, Medium, below the CVSS 7.0 threshold the Extended Support terms name, and it is still in the exploited catalog. The same advisory says the risk is highest when the management interface is reachable from the internet; keeping it off the internet matters more once a box is on Extended Support. PAN-OS release-by-release dates are on the PAN-OS page.

What to do

1. Inventory by model and PAN-OS release. List every PA-7000, PA-5200, PA-800, PA-3200, Panorama M-200 or M-600 and WF-500, and the PAN-OS version each one runs. A box still on an older release than its last supported OS follows that release's own schedule, which can end sooner.
2. Move each appliance to its last supported OS (PAN-OS 11.2, or 11.1 on the PA-800 and PA-3200) before Standard Support ends, so it stays on the release that keeps Extended Support until the hardware's end of life.
3. Keep the support contract continuous. Palo Alto's policy says support contracts cannot be allowed to lapse and be reinstated later, and hardware support depends on a contract maintained continuously.
4. Budget the replacement against the end-of-life date, not the May 2027 date. Palo Alto's recommended replacements are in the table above. One of the two it names for the PA-7000, the PA-5450, has an end-of-sale date of its own on November 22, 2026 and hardware end of life on November 21, 2031.

Frequently Asked Questions

Related

• Palo Alto Networks PA-Series (hardware) — every appliance model and its dates
• PAN-OS — every PAN-OS release and its support dates
• PAN-OS end of life — the software clock, release by release
• End-of-support edge devices — firewalls, VPNs and routers past or near end of support