Fixed an issue on Android endpoints where HIP report traffic was routed through the physical network interface instead of through the VPN tunnel. On deployments using a Network Load Balancer (NLB), this caused HIP report submissions to time out because the in-tunnel gateway IP was unreachable from the physical interface. HIP report submissions and logout API requests are now routed through the VPN tunnel.

Fixed an issue on macOS endpoints where end-user coaching notifications did not appear after endpoint DLP (EDLP) blocked a file transfer, even though DLP incidents were generated correctly.

Fixed an issue where endpoint DLP (EDLP) did not correctly block file transfers to USB drives or network shares when a large number of files were copied in a single operation. Some files at the start of a batch copy were allowed to transfer to the destination even when DLP policies should have blocked them.

Fixed an issue on Windows and macOS endpoints where, when pre-logon with persistent tunnel was enabled, the agent did not transition from pre-logon mode to user-based authentication after an OS session logon. The agent remained in pre-logon mode until authentication was completed manually.

Fixed an issue on Windows endpoints where traffic configured to bypass Prisma Agent and use a coexisting third-party VPN client was incorrectly routed through the Prisma Agent tunnel instead.

Fixed an issue on macOS endpoints where the Prisma Agent service became unresponsive and restarted repeatedly, causing a continuous connect and disconnect cycle approximately every 30 seconds.

Fixed an issue on Windows endpoints where, after a fresh installation with pre-logon enabled, the agent did not establish the pre-logon tunnel and displayed a "Failed authentication" error.

Fixed an issue on Windows endpoints where, after installing Prisma Agent with pre-logon enabled, the Prisma Agent credential provider was set as the default Windows sign-in method. On the Windows login screen, users were presented with the Prisma Agent sign-in option instead of the standard Windows password prompt and were required to click "Sign-in options" to select the password method before signing in.

Fixed an issue on Windows endpoints where, after an OS session logoff followed by logon, SAML authentication was significantly delayed and multiple browser windows opened during the authentication process. This issue was specific to Prisma Agent 26.4.

Fixed an issue on Windows endpoints where upgrading Prisma Agent reset the embedded browser's DNS settings to a default value, overwriting any administrator-configured override. In deployments where administrators configured the embedded browser DNS mode to allow resolution against internal or split-horizon identity providers, the setting was reverted on each upgrade, causing the embedded browser authentication page to fail to load with a DNS resolution error after upgrading.

Fixed an issue on Windows endpoints where, when the re-authentication frequency timer expired, the agent silently dropped back to pre-logon mode instead of prompting the user to sign in again. The login prompt did not appear automatically; users were required to manually click "Sign In" to reconnect.

Fixed an issue on Windows endpoints where files copied to USB drives through endpoint DLP (EDLP) enforcement were written with all-lowercase filenames, regardless of the original filename casing.

Fixed an issue on macOS endpoints where files copied to external APFS or HFS drives were left as zero-byte (empty) files. The destination file appeared to be created but contained no data.

Fixed an issue on Windows endpoints where, after the pre-logon tunnel connected, the agent did not display a user login prompt and did not transition to a user tunnel. Clicking "Login" had no effect; disabling and re-enabling the agent was required to initiate user authentication.

Fixed an issue on Windows endpoints where a failed major version upgrade left the agent services in a disabled state, causing all subsequent uninstall attempts to fail immediately. After a failed upgrade, the previous version remained listed in "Add or Remove Programs" but could not be removed.

Fixed an issue where renaming folders on a network share drivereturned an "Invalid Device" error when Endpoint DLP was enabledon the Prisma Agent. Renaming text files on the same networkshare was not affected. Folder rename operations on network sharedrives now complete successfully when Endpoint DLP is enabled.

Fixed an issue on Windows endpoints where clicking the session extension banner approximately one hour before session expiry had no effect. The session disconnected at the scheduled expiry time, requiring the user to manually reconnect the tunnel.

Fixed an issue on Windows endpoints where the agent displayed a connected status but all traffic bypassed security policy enforcement. This condition occurred silently following authentication errors or pre-logon timeout events and persisted until the user signed out and signed back in.

Fixed an issue on macOS endpoints where DNS root zone queries caused all system DNS resolution to stop responding for approximately 5 seconds per query. Systems that issued frequent DNS root zone queries experienced repeated network interruptions affecting all applications.