On Android endpoints, Prisma Access Agents does not correctly process overlapping or adjacent IP address ranges for forwarding profile destinations. When a destination includes a smaller subnet contained within a larger subnet (such as a /25 within a /24), both appear as separate route entries instead of only the larger subnet. When a destination includes two adjacent subnets of the same size (such as two /25s), both appear as separate entries instead of being merged into a single supernet. The redundant route entries can prevent the tunnel from correctly excluding traffic as intended.

For Prisma Access Agents on iOS, if you configure a forwarding profile with a Direct catch-all rule for all traffic (0.0.0.0/0), all network traffic stops after the agent connects. The catch-all rule causes the internal DNS server to route outside the tunnel instead of through it, so DNS resolution does not complete and all traffic stops. On Android, the same forwarding profile configuration causes DNS queries to resolve through the carrier's public DNS server instead of the internal DNS server, so internal hostnames do not resolve as expected.

On iOS endpoints, Prisma Access Agent does not correctly process overlapping or adjacent IP address ranges for forwarding profile destinations. When a destination includes a smaller subnet contained within a larger subnet (such as a /25 within a /24), both appear as separate route entries instead of only the larger subnet. When a destination includes two adjacent subnets of the same size (such as two /25s), both appear as separate entries instead of being merged into a single supernet. The redundant route entries can prevent the tunnel from correctly excluding traffic as intended.

When the Prisma Access Agent is disabled, the generated event log does not include the Source User field. This field appears as missing, null, or "Unknown" in the event log details.

On endpoints running macOS, if the Prisma Access Agent is installed manually without a mobile device management (MDM) profile, and users do not allow the endpoint security extension and grant Full Disk Access for the enforcer, the com.paloaltonetworks.pangdlp.enforcer process continues to restart. This behavior can result in a loss of data loss prevention (DLP) coverage on the endpoint.

On Windows endpoints running Prisma Access Agent version 26.2.2, the Prisma Access Agent app does not display the Server name and Connect button when the agent is enrolled but has not yet completed authentication.

When uninstalling the Prisma Access Agent on endpoints running macOS using the command-line interface (CLI) uninstaller (sudo uninstaller), if Anti-Tamper protection is enabled and you enter the Anti-Tamper uninstall password at the prompt for the local administrator password, the uninstallation does not complete successfully. This leaves the agent in a partially uninstalled and corrupted state where some components, such as pacli, are removed, but others, such as paaui, remain, leaving the endpoint unprotected and unmanageable.