The Issue

Cortex XDR, an endpoint security agent from Palo Alto Networks, can inject itself into the Ignition JVM, resulting in either a deadlock or blocked threads during Gateway startup for Windows systems. This behavior has been reported to Ignition Support Services by multiple users where one of the following actions were performed with Cortex XDR present on the Ignition Gateway host machine:

• A Windows update was recently performed.
• “Cortex XDR” / "Cortex" / "Palo Alto XDR" was recently installed or updated on the Ignition Gateway host machine.

After performing one of the actions listed above, this issue can be identified from the following:

• The Gateway webpage appears stuck in a “Loading” state.
• The latest wrapper.log shows no errors, but stalls to provide any new status information.
• A thread dump capture is performed on the JVM process and at least one of the following details are found:
  • $PANW-suffixed stack frames such as run$PANW. 
    • Note: PANW is an acronym representing Palo Alto Networks.

  • A deadlock is detected due to the classloading of NativeLibraryManagerImpl.

     

Impact

As a result, the Ignition Gateway will remain stuck in "Loading" state indefinitely. Windows Services will indicate that the Ignition service is running, but Ignition Gateway webpages will remain inaccessible. High CPU activity will also be detected on the host machine.

The Solution

On September 8, 2026, Palo Alto Networks released content update 2420, which contains a modification to their JAVA Protection Module for addressing this issue on Windows systems. This change is expected to reduce conflicts on existing Windows endpoints containing Java-based applications. To confirm this update was applied to your Cortex XDR Agent, refer to Palo Alto Network’s Cortex docs regarding Agent and Content upgrades.

If this update is not possible or the issue still persists on your Ignition Gateway, you will need to configure new exceptions to Cortex XDR’s security profile. The following list provides the required Ignition-related directories, executables, and processes:

• The Ignition install directory path. Located under C:\Program Files\Inductive Automation\Ignition by default.
• java.exe - the executable environment for running Ignition.
• The Ignition service - The default name of the Windows service for starting and stopping the Ignition Gateway.

For more details on configuring new exceptions to Cortex XDR’s security profile, refer to Palo Alto Network’s Cortex docs or contact their support services for further assistance.