>
    Strata Copilot
    Prisma Access Agent 26.1 Known Issues
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Access Agent
    3. Prisma Access Agent Release Notes
    4. Prisma Access Agent Release Information
    5. Prisma Access Agent Known Issues
    6. Prisma Access Agent 26.1 Known Issues
    Download PDF
    Prisma Access Agent

    Prisma Access Agent 26.1 Known Issues

    Table of Contents

    Prisma Access Agent 26.1 Known Issues

    Review the known issues in Prisma Access Agent 26.1.
    Prisma Access Agent version 26.1 has the following known issues:

    Known Issues on macOS and Windows Prisma Access Agents

    Issue IDDescription
    PANG-11011
    An issue exists where the Prisma Access Agent on macOS and Windows forwarding profile domain/FQDN list is case-sensitive, leading to inconsistent forwarding rule evaluation. When users perform DNS queries for domains configured in Forwarding profile rules, the agent matches the rule correctly only when the query uses the exact same case as configured. For example, querying a domain in lowercase (such as "example.com") matches the configured rule as expected, but querying the same domain in uppercase (such as "EXAMPLE.COM") fails to match the same rule and instead falls through to the default rule, even though DNS resolution succeeds in both cases. This issue affects both Windows and macOS workstations. The expected behavior is that FQDN matching should be case-insensitive, as DNS itself is case-insensitive by standard.
    PANG-10918
    An issue exists in the Prisma Access Agent for macOS where the Use Single Sign-on (Mac) agent setting does not work as expected. When Use Single Sign-on (Mac) is enabled for macOS devices that support with Platform SSO, the Prisma Access Agent embedded browser briefly appears before disappearing during authentication. The expected behavior is that when Use Single Sign-on (Mac) is enabled, the embedded browser should not appear at all and authentication should proceed directly using Platform SSO. This issue also occurs when the setting is disable.
    PANG-10248
    An issue exists in Prisma Access Agent where OPSWAT's missing-patch lookup fails when an allowlist security policy is enforced that blocks all traffic through the tunnel without explicitly allowing traffic to OS update servers. This occurs because OPSWAT uses the system's native update service to perform patch lookups—Software Update on macOS (communicating with swdist.apple.com and swscan.apple.com) and Windows Update on Windows (communicating with slscr.update.microsoft.com)—and Prisma Access Agent does not provide an implicit rule to exempt this traffic from the tunnel. As a result, HIP missing patch collection does not function when the security policy drops traffic to these endpoints.
    Recommended Solution: Configure the firewall to allow traffic to OS update endpoints (*.apple.com for macOS or *.update.microsoft.com for Windows).
    Alternative Workaround: Configure a forwarding profile that excludes DNS and network traffic to *.apple.com and *.update.microsoft.com traffic from the tunnel (by setting Connectivity to Direct in the forwarding rule).

    Known Issues on Linux Prisma Access Agents

    Issue IDDescription
    PANG-11153
    On Linux, the Prisma Access Agent may experience recurring PASrv process crashes approximately every 20 seconds due to abnormal termination, causing the agent to become unresponsive and preventing log collection. This issue occurs primarily during agent upgrade operations.
    PANG-10947
    When Prisma Access Agent is configured in on-demand mode on Arch Linux and the network connection is interrupted and then restored, the agent fails to automatically reconnect to the gateway. As a result, the agent remains in a disconnected state.
    PANG-10865
    On Prisma Access Agent for Linux systems, the Prisma Access Agent user interface exhibits minor cosmetic and usability inconsistencies. The Location list lacks a line separator between entries and is not sorted alphabetically, with the exception of the "Best Location" option.
    PANG-10801
    During a Host Information Profile (HIP) check on Prisma Access Agent for Linux, the system incorrectly validates certificates based solely on the issuer's Common Name (CN). This results in expired or revoked certificates being considered valid if their issuer's CN matches the configured criteria, potentially allowing non-compliant endpoints to pass HIP checks.
    PANG-10668
    After upgrading to Prisma Access Agent version 26.1.0.25 on Arch Linux with KDE Plasma desktop environments, the settings page in the Prisma Access Agent app might appear partially blank when the operating system's dark theme is enabled. This prevents the display of relevant information on the settings page.
    PANG-9501
    When using Prisma Access Agent on a system running Fedora 42 (GNOME), running the pacli traffic log <n> command does not show the log details.
    PANG-9196
    When Prisma Access Agent is installed on a Linux virtual machine (VM) running on an ESXi host, and the VM undergoes network changes (such as connecting or disconnecting from gateways) or experiences a sleep/wake cycle, the entire VM and the ESXi host might become unresponsive. Access to the ESXi host is lost, and the system hangs for approximately 5 minutes before access is regained.

    © 2026 Palo Alto Networks, Inc. All rights reserved.