Prisma Access Agent: Local Authenticated VPN Enforcement Bypass on Linux

An employee or contractor with access to a Linux workstation running Prisma Access Agent could bypass VPN protections and send network traffic outside the encrypted tunnel, potentially exposing sensitive operational data or command traffic to interception.

Transportation sector organizations and any enterprise using Prisma Access Agent on Linux workstations. This includes remote workers, field technicians, and office staff whose Linux devices need to send sensitive traffic (SCADA communications, engineering tool access, or operational data) over protected VPN connections.

An attacker with local login access to a Linux system running Prisma Access Agent can manipulate the agent's network enforcement to bypass the VPN tunnel. The attacker then routes sensitive network traffic directly over the internet instead of through the protected VPN connection, where it can be monitored or intercepted.