Fixed an issue on Windows and macOS endpoints where, when pre-logon with persistent tunnel was enabled, the agent did not transition from pre-logon mode to user-based authentication after an OS session logon. The agent remained in pre-logon mode until authentication was completed manually.

Fixed an issue on Windows endpoints where traffic configured to bypass Prisma Agent and use a coexisting third-party VPN client was incorrectly routed through the Prisma Agent tunnel instead.

Fixed an issue on Windows endpoints where, when both expired and valid client certificates matching the configured issuer were present in the certificate store, the Prisma Agent selected the expired certificate for gateway authentication, causing a repeated authentication loop that prevented users from connecting. The agent now automatically selects a valid certificate for authentication.