Release Notes

Before this release, Imprivata Privileged Access Security (PAS) products supported best practices checks for HIPAA, PCI, NERC, and CJIS standards. This release offers users to enable a set of checks against NIST (National Institute of Standards and Technologies) to ensure their organization meets the controls and recommendations suggested by that regulatory entity.

Adding this standardization to our toolbelt of industry-specific checks enables our customers in government and other highly regulated industries to demonstrate their adherence to NIST standards alongside other regulatory checks offered with Imprivata Privileged Access Security (PAS) products. These best practice checklists provide a single pane of glass for compliance posture and reduce manual cross-reference efforts to ensure compliance.

Other enhancements and updates for this release are:

• When launching RDP connections Users can select their screen size when launching browser-based RDP connections.

• Users can now access our public Help Documentation site directly from the UI Help menu.

• Resolved an issue where Nexus credentials were not passing for CPAM users when HD Audit was turned off.

• Resolved an issue where a character limit was preventing user from creating or editing tunneled services

• Resolved an issue where users were unable to enable application groups.

• Resolved a Nexus issue where one customer was not seeing the option to connect.

• Resolved an issue where user was receiving an error when downloading a video audit.

• Resolved an issue where connections were timing out due to Gateway maintenance tasks on a high number of Gateways.

• Resolved an issue with inconsistencies on the User Preferences page.

To tighten control over sensitive credentials, we will enforce a permissions-based gate on viewing protected secret fields; only users granted the right permission can unlock and reveal raw secret values. Following each unlock, any rotation task linked to that secret will automatically trigger after a configurable delay, ensuring that no credential remains exposed longer than necessary and maintaining a minimized “exposure window” for users.

This functionality improves compliance and auditability by logging unlock events in the admin log and linking rotation tasks to the triggering user, enhances security posture via automatic, time-bound credential rotation, and ultimately gets us one step closer to our 'PAM in PAS Co-platforming' product goals.

Before this release, the Tunneled Services only displayed either Online or Offline. When a tunnel is Offline, there is now a way to reset it or test it from the UI, or display contextual help information if something is misconfigured or not working.

This work helps our PAM integrations and syslog export with setup and testing by giving users the capability and guidance to test and troubleshoot in the UI. Additionally, this streamlines troubleshooting and resolution of connectivity issues that impact these service integrations which ultimately helps our internal teams.

Other enhancements and updates for this release are:

• Additional data points were added to the Audit Archival Storage tables to reflect the storage usage based on the method used.

• If you have multiple servers, automated emails will now include the specific server name.

• [CPAM only] A Gatekeeper Status Report was added to the Reports module. This report displays relevant Gatekeeper information such as Gatekeeper ID, version, connection status, registration status, and connection information.

• The new connection manager is now able to authenticate and connect to an HTTP proxy server.

• Resolved an issue where the connection manager's executable file was being flagged by Microsoft Defender SmartScreen for not having a publisher.

• Resolved an issue where user was receiving an 'Invalid Application ID' error when deleting applications.

• Resolved an issue where the History tab intermittently showed a 'Something went wrong' error.

• Resolved an issue where customer was seeing blank SSH audit files with SFTP file transfers.

• Resolved an issue where Gatekeeper Registration information was not showing in the Admin Log.

• Resolved an issue where users were experiencing an 'Invalid Filter Parameter' error when in the Edit Multiple Applications > Edit User Groups workflow.

• Resolved an issue where service connection retries were not being captured in the Admin Log when the service was using a stored credential.

• Resolved an issue where users were receiving a 'The server failed to provide a valid SSL certificate' error when launching the new connection manager.

• Resolved an issue where a customer could not log in because the Terms & Conditions were not enabled.

• Resolved an issue where vendor representatives could not successfully activate their account when the new VAPM UI was disabled.

• Resolved an issue where users were unable to configure or use LDAPS servers.

Our new connection manager is out of Beta! This milestone release of this feature has overall improved stability and functionality with all services working to include a better end user experience for both Mac and Windows users.

The New C-based connection manager rewrite is finished and will be the default connection manager for both the New UI and Legacy UI. This enables new capabilities such as the Containerized Network feature as well as removing the dependency on Java. The new connection manager capabilities include integration with Nexus, HTTP Tunnels, Virtual Interfaces, IP Connect, FTP support, and Magnet Links. It does not include support for UDP at this time. Note that users can still download and use the Legacy Connection Manager (SCM) if they need it.

This release introduces the ability to configure credential rotation tasks for local RDP and SSH credentials. Whoever is configuring the tasks can configure the settings for tasks to be rotated based on events, such as the use of the credential, or run on demand. The new password is created based on criteria defined in the customized password policy.

25.1.5 introduced task rotation for AD credentials, so this addition expands the capabilities with new credential and task types for RDP and SSH, allowing for broader use of the secrets and password rotation tasks.

Other enhancements and updates for this release are:

• Credential information is now available in the History tables and Session ID tables.

• When using AWS and Imprivata's SES, we've made some improvements so that our SES recognizes domains outside of our default ones.

• We've improved our Java8 optional support so users will no longer see error messages when editing multiple applications.

• Performance enhancements and maintenance fixes went in to the new Connection Manager.

• Resolved an issue where Credential Pools were not working for RDP connections over Nexus when the CPAM had version 25.1.5 and the VPAM had either version 23.3 or 24.2.

• Resolved an issue with where the sorting function in Reports v2 wasn't working.

• Resolved an issue where valid authentication combinations were returning errors.

• Resolved an issue where users were unable to change the name of a Gateway.

• Resolved an issue where an intermediate certificate was being placed into the SSL chain twice.

• Resolved an issue where the server was not checking or recognizing additional LDAP servers when the first one failed.

• Resolved an issue where connections were timing out due to Gateway maintenance tasks on a high number of Gateways.

• Resolved an issue where Gateways stopped trying to connect after multiple server restart events.

Our new connection manager is out of Beta! This milestone release of this feature has overall improved stability and functionality with all services working to include a better end user experience for both Mac and Windows users.

The New C-based connection manager rewrite is finished and will be the default connection manager for both the New UI and Legacy UI. This enables new capabilities such as the Containerized Network feature as well as removing the dependency on Java. The new connection manager capabilities include integration with Nexus, HTTP Tunnels, Virtual Interfaces, IP Connect, FTP support, and Magnet Links. It does not include support for UDP at this time. Note that users can still download and use the Legacy Connection Manager (SCM) if they need it.

This release introduces the ability to configure credential rotation tasks for local RDP and SSH credentials. Whoever is configuring the tasks can configure the settings for tasks to be rotated based on events, such as the use of the credential, or run on demand. The new password is created based on criteria defined in the customized password policy.

25.1.5 introduced task rotation for AD credentials, so this addition expands the capabilities with new credential and task types for RDP and SSH, allowing for broader use of the secrets and password rotation tasks.

Other enhancements and updates for this release are:

• All changes to Global RDP settings are now logged in the Admin Log.

• Resolved an issue where user could not select and save a custom service on a host.

• Resolved an issue where Internal Server Error was appearing when user tried to create a new report in reports v2.

• Resolved an issue where Internal Server Error was appearing when user sorted/filtered a reports v2 dashboard.

• Resolved an issue where convoluted user session history data was appearing on the History tables.

• Resolved an issue where Nexus RDP connections with attached Credentials were failing when the CPAM customer was on 25.1.5 and the VPAM was on 24.2 or older.

• Resolved an issue where admins were seeing audit entries attached to the wrong session user.

• Resolved an issue where QuickConnect sessions were throwing log errors but no visible error for the end user in the UI. Note this issue was only observed on new databases.

• Resolved an issue where data was not reflected in the Admin log on subsequent connection attempts to a service.

This new functionality, suggested by one of our CPAM customers, allows administrators to define custom parameters for the Client Title launch parameters. The customized names will appear in the window and tab header, making it easier and faster to find a window. This improvement applies to both VPAM and CPAM.

Allowing users to customize the naming convention of title bars allows them to display what they think is the most relevant information at the beginning of the text string, ultimately making windows much easier to find if multiple sessions are ongoing at the same time and easier to switch between them. The customized naming convention appears when a user hovers over a minimized window.

Other enhancements and updates for this release are:

• An improvement was made to the debug console that allows users to click on the 'Not Healthy' status on the status of Disaster Recovery Diagnostics to view and investigate the details of the Health Check.

• Filezilla's internal putty process will default to IPv4 resolution when connecting to an SFTP service on MacOS.

• Resolved an issue where the Vendor Self-registration button was appearing on the login page when the setting was disabled.

• Resolved an issue where the BeyondTrust PAM plugin was not working correctly.

• Resolved an issue that prevented users from downloading Scheduled Reports on-demand.

• Resolved an issue related to Disaster Recovery Health Checks where the UI was timing out before the health check was complete.

• Resolved an issue on where the Connection Manager (beta) was not terminating correctly on Linux.

The CPAM user documentation has been added to the public facing Imprivata documentation portal and will go live on April 17.

The documentation team worked incredibly hard to review, update, and transform the CPAM Admin and End User docs so they are publicly available for ease-of-access and organized so the different user types can quickly find the information they need.

Other enhancements and updates for this release are:

• Entra ID and x509 were added as authncontext SAML configuration options.

• Improvements were added to the VPAM new UI to include enhancements to User Management and Application Labels.

• Ephemeral tokens now work with VNC credential injection.

• An issue was resolved where Approver users were receiving an error when trying to approve Nexus vendor application requests.

• A pagination issue was resolved that resulted in only 25 hosts displaying in an application.

• An issue was resolved where SCP/SFTP audit logs were broken.

• An issue was resolved where users were experiencing errors when searching/filtering by Customer Name in the Gatekeeper UI.

• An issue was resolved so that ARM Linux receives the proper architecture Java package on upgrade.

• An issue was resolved where Nexus vendors were unable to register or connect to Gatekeeper V2 with a proxy.

• An issue was resolved which caused hostname mapping to fail after upgrading from Windows 11 23H2 to 24H2 with IP Connect installed.

Pre-flight checks were added to the self-upgrade process via the CLI.

The CLI now has the ability to run the pre-flight check without performing the upgrade, including checking on Disaster Recovery notes. If anything is amiss in the DR configuration the pre-flight check will fail and notify the user. Adding this functionality will empower hundreds of customers to self-service their upgrades while reducing operational burden from our Support team.

Other enhancements and updates for this release are:

• Pre-connection notifications were added to the new VPAM UI, allowing administrators to configure the settings and end users to receive the notifications.

• Resolved an issue that prevented users from inputting an MFA code into the login screen successfully. The MFA login workflow works as expected now.

• Resolved an issue that prevented reseting registration keys in some circumstances.

• Added a configuration option for disabling port monitoring from the Gatekeeper or Gateway. When this feature is disabled, the Gatekeeper or Gateway will not check if configured services are listening, and users will not see those services rendered as red text in the UI if no service is available on the remote system.

New checks and regulations added to our CJIS, HIPAA, and PCI Best Practices Checklists. The additions include updates and additions around password length and requirements, MFA, account expiration, client anti-virus health, and disaster recovery.

These additional checks ensure organizations continue to operate within regulatory boundaries, minimize operational risk, and maintain quality and efficiency within their industry.

Other enhancements and updates for this release are:

• The Imprivata FTP client is now enabled for Linux (Alma, CentOs and Ubuntu) for FPT and SFTP services.

• Improvements were made to the self-upgrade process for an overall better user experience, including enabling the self-upgrade dashboard by default.

• An issue was resolved in the VPAM new UI that prevented users from launching RDP within the RSSRDP client.

• An issue was resolved which allowed disabled non-admin users to log in to the mobile app and approve access requests.

• An issue which was causing unintended side effects by checking then unchecking the "Require MFA validation from iDP for SSO users" setting has been resolved, and the customers experiencing this issue should not experience further inconsistencies when configuring this setting.

We are releasing all available VPAM functionality in the new UI, including: Application & Vendor Management, Gateway Management, Vendors & Internal users can connect to applications, a new and refreshed view of History and Audit Data, and the Admin Log.

Not only does the new UI have a beautiful new look, it also provides an improved, more streamlined experience for all users of VPAM. Each component has been thoughtfully redesigned to quickly surface relevant information with less clicks and page loads, and to minimize the need to reference external product documentation.

As requested by one of our most enthusiastic customers, custom form fields that are filled out by vendors who are requesting access to an application will now appear in the notification emails that administrators and approvers receive.

Showing the custom form fields in the notification email provides even more detail and context to the person who is approving access to an application so they can make informed decisions on granting access without having to log in via the web portal.

Other enhancements and updates for this release are:

• Continued updates and bug fixes for the new Connection Manager are available in this release for sites who have enabled the beta of this from System Settings.

• If any issues arise while executing the self-upgrade option, a “reason for failure” will be logged in the Admin Log within the UI as well as via CLI output notification sent to the user.

• Resolved an issue that prevented Vendor Approval Request forms from displaying on Nexus connections.

• Resolved an issue that prevented copy/paste from working correctly on RDP sessions.

24.1.11 and corresponding LTS releases (23.2.11 and 22.4.21) are now generally available. This release includes continued updates to the content available within the new UI for VPAM and contains a change to address the RDP rendering issues users experience after upgrading to Windows 11 24H2.

Windows 11 24H2 RDP Rendering Issue Resolution

A change in the Windows 11 24H2 (released 10/1) MSTSC client affected the rendering of audited RDP sessions. This release contains a property that changes how bitmap information is sent in those RDP sessions to address this issue without the need for previously available workarounds which included disabling audit or using a separate client.

Users rely on MSTSC for capabilities such as drive sharing which cannot be delivered by the available workaround client. This ensures that users on the latest version of Windows can continue making connections as they did before Windows updates.

Additional Enhancements

Other enhancements and updates for this release are:

• Continued updates and bug fixes for the new Connection Manager are available in this release for sites who have enabled the beta of this from System Settings

• Resolved an issue that prevented the search function on the report distribution list page from working as intended

• Improved the reliability of launching the SFTP/FTP client

• The available memory line when viewing a Gateway Instance now properly shows available memory rather than used memory

24.1.10 and corresponding LTS releases (23.2.10 and 22.4.20) are now generally available. This release includes continued updates to the content available within the new UI for VPAM as well as a number of component updates and bug fixes.

Tunneled Service Updates

Updates to tunneled services to provide clarity around which Gateway a service is routed through and resolve a problem state that can prevent tunneled service connections from resuming after network connectivity issues.

This helps ensure that tunneled services can be easily used and relied upon for customers with complex network deployments and customers that need to route to on-prem services for authentication, SMTP or integrations when deployed in Imprivata cloud.

Additional Enhancements

Other enhancements and updates for this release are:

• Resolved an issue on CPAM that would result in usability issues when the user’s browser is set to German.

• Resolved an issue that caused the login page to be difficult to read with the login page design.

• Created API endpoints for managing sessions.

• SMTP server response codes of 250 will now be correctly treated as successful.

• Security updates in response to our annual penetration testing.

24.1.8 and the corresponding LTS release (23.2.8) are now generally available. This release includes the beta of the new Connection Manager which can be enabled from the settings in the system admin module.

Next-Gen Connection Manager Beta

The beta new connection manager is available to all users on Windows, Mac or Linux as of this release when enabled from the settings in the system admin module. This is available on both VPAM and CPAM.

The new connection manager significantly reduces the time it takes to go from clicking ‘connect’ on an application or Gatekeeper to having access to the endpoints. Additionally, previous requirements that periodically resulted in the need to clear temp files for some users have been addressed to provide a more consistent and reliable experience for all users. Finally, the new connection manager enables our new Containerized Network functionality.

Containerized Network Beta

The Containerized Network feature allows users on Windows to map services to new interfaces outside of the 127.X.Y.Z loopback addresses. This feature is for Windows users only and is automatically enabled when the Next-Gen Connection Manager is used.

VPAM and CPAM have always used an alternate port process for granting access when the local port selected is unavailable. For most use-cases this is unnoticed and allows users to connect without issue. In select use cases such as SMB access or access to PLCs with certain thick clients – alternate ports result in an inability to connect. This new feature allows an alternate interface to be used to ensure the required port is available and makes the connection process for these types of services significantly easier for the end user.

New UI Beta – History

The History section has been added to the new UI and allows a new service access level view of history.

This is a major milestone for the new UI and brings a significantly improved experience to reviewing history. Users can now view history at the service level without the need to drill into multiple sessions to get the data needed. Additionally, the history table can be filtered by any available column or columns including the user, vendor, host, port, access time and more.

Additional Enhancements

Other enhancements and updates for this release are:

• Initial components to allow administrators to initiate upgrades from within the product have been added

• API endpoints for access details, session details, Gateway management and others have been added

• Resolved an issue that prevented custom application access request forms from being properly used for Nexus connections

24.1.6 and the corresponding LTS release (23.2.6) are now generally available. This release contains a number of bug fixes and improvements and continues adding functionality to the beta of the new UI.

Option to Include System Admin Users in Approval Request Notifications

Approval requests that previously would notify only the users with the proper permission and department settings needed to handle the approval can now optionally notify system administrators as well.

This new option will make it easier for system administrators who would like a higher level of notifications for approval processes or those who would also be responsible for handling the approvals or may consider themselves an escalation point for those approvals.

SDK Update

Updated versions of the C#, Java and Python SDKs have been released which contain additional functionality and bugfixes.

This release coincides with our regular SDK update. SDK capabilities have been expanded and these updates require the new version of the SDK along with 24.1.6 or newer.

Additional Enhancements

Other enhancements and updates for this release are:

• Resolved an issue that could prevent the system from properly establishing tunnels for Gateway tunneled services

• Resolved an error that would occur when users without local accounts, such as SAML users, attempted to use the password reset functionality

• Resolved an issue that could cause a users’ service access event to not appear on the session history page for access to a web service when a stored credential was used

• VPAM and CPAM servers deployed in Imprivata Cloud will now have Crowdstrike AV installed

24.1.5 and the corresponding LTS release (23.2.5) are now generally available. This release contains a number of bug fixes and improvements and continues adding functionality to the beta of the new UI.

CPAM Gatekeeper Enable Request Reminder Emails

Gatekeeper Admins in CPAM can now be reminded via email if a request remains pending for a configurable period of time.

This new process ensures that an automated reminder for the pending request is available and not dependent on manual outreach to the Gatekeeper Admin. This is configurable both to enable/disable as well as set an interval in hours for the reminder message.

Additional Enhancements

Other enhancements and updates for this release are:

• Resolved an issue that could prevent deletion of applications in some cases.

• Users will no longer be able to inadvertently set the session timeout to zero minutes in the UI which would result in users unable to maintain sessions

• Non-admin users that can create external credential providers (PAM Integration) can now properly see the created objects on the list view

• Sorting choice for the list roles table will now persist for users

• Pre-connection notifications on VPAM will now be properly labeled as Application Pre-Connection Notes rather than “Site” Pre-connection Notes.

• Removed the ‘reason for access’ prompt automatically included when using a custom application access request form with other fields.

24.1.4 and the corresponding LTS release (23.2.4) are now generally available. This release coincides with the beta release of our new UI! For this release the new UI will not be enabled by default but will be available to be enabled in customer sandbox environments.

Application Access Approval Profiles over Nexus

Custom Application Access Approval Profiles are now functional over the Nexus, ensuring that vendor reps connecting through Nexus relationships can be prompted for the same information as local vendors when determining approval.

An important piece of any new features brought to VPAM or CPAM is to ensure that, if applicable, those features work across the Nexus. This work closes that gap on a recent feature release both to ensure Nexus does not create any loss in functionality and to meet a direct request by an existing customer.

Additional Enhancements

Other enhancements and updates for this release are:

• The new Linux SCM is available in beta form and can be enabled with the 24.1.4 release. When the Windows and Mac versions of the SCM are made available we will announce this as a major release highlight.

• Resolved an issue with a previous release version resulting in renaming Gatekeepers that were hosted on a Gateway

• The logout.action will now properly forward to the SAML logout for SAML users

24.1.3 and the corresponding releases (23.2.3, 22.4.117) are now generally available. This release contains a number of direct customer requests as well as updates that change the default behavior around support contact information.

Remove "Success" Email

The success@imprivata.com email has been removed from the login page text and default settings placeholder for support contact information.

After reviewing the emails that we receive at this address, the vast majority are issues where Imprivata cannot help the end user (anything from accounts being disabled to endpoints not online). The support contact information in system settings should be set with a proper contact for the customer site to ensure users can quickly get to a resource that can help them.

Nexus Vendor Rep Account Enabling

Nexus vendor reps enabled/disabled status will now be determined by the CPAM side of the Nexus connection by default and update the status on the VPAM side during the connection process if needed. Multiple customers ran into issues where local settings on the VPAM side unintentionally affected the ability of Nexus users to connect and requested an update to allow Nexus users to proceed with connecting if their account was in an enabled state on the CPAM server. This resolves an issue that would require manual actions from an admin to re-enable a disabled account. Settings options for the related property allow other behaviors that include rejecting the connection or allowing the user to request to be enabled when the local VPAM account is disabled.

Additional Enhancements

Other enhancements and updates for this release are:

• Resolved an issue that prevented updated Gateway names from showing on specific pages

• Resolved an issue that could result in tunneled services going offline due to a hung scheduled tasks thread

• Updated Best Practices Checklist Password Length to 12 characters to better align with best security practices

• Updated instances of "Access Restrictions" settings headers to "Authentication Requirements" to better reflect the purpose of those settings

• Added a UI option for toggling the dynamic HTTP(S) service proxy on and off. When enabled, the proxy is dynamically enabled only for connections with stored credentials.

• Removed instances of "SecureLink" from certain emails and the "unavailable" page text.

24.1.1 and the corresponding releases (23.2.1, 22.4.15) are now generally available. This release coincides with the official naming update to Vendor Privileged Access Management (formerly SecureLink Enterprise Access) and Customer Privileged Access Management (formerly SecureLink Customer Connect). This release also includes a fix for the audit linking issue (SLK-3423) in the 24.1.1 release only.

Updating Naming and Branding

The UI has received a branding update to ensure the new name is visible in the top left and color elements have been updated from the former SecureLink color scheme to Imprivata colors. This update also applies the new naming within the UI and emails to replace former instances of “SecureLink”.

This is a major step towards the unified solution naming across the Imprivata portfolio and ensures we can start getting this in front of customers immediately rather than coordinating this with the availability of the new UI.

Gateway Pool Management for Session Queues

Instances in a Gateway pool can now be drained to prevent new sessions from beginning on that instance.

It is also now possible to see what sessions are through a given instance. This request came from multiple customers as a means to isolate Gateway instances when there is a need to bring them offline for updates or other maintenance without impacting user connections.

User Preference for Connection Manager Tunneling Method

Users can now set a preference for their preferred tunneling method for the Connection Manager.

Having the option to set a preferred tunneling method ensures faster connectivity for users who do not use the standard SSH tunnel by not requiring them to wait while an SSH attempt times out.

Additional Enhancements

Other enhancements and updates for this release are:

• Gatekeeper users on CPAM can now use a TOTP authenticator for MFA

• The “Launch via” setting for services can now be defined upon service creation instead of only on editing the service

• Gateway CRUD actions will now properly generate admin log entries

• Resolved an issue that prevented updates to audit retention settings from taking effect

23.1.12 and the corresponding releases (22.4.14, 21.4.10.14) are now generally available. This release includes multiple features and fixes targeting specific customer requests including a fix for the audit linking issue.

Application Access Request Approval Profiles

Approval profiles grant customization to the questions a user must fill out when requesting access. This feature allows that same customization in a new area where requests previously only had a "reason for access" prompt.

This gives customers more control over the information they're gathering and in turn allows for more informed decision making when granting approval for individual vendor reps to access applications. For some customers this enables them to bring workflows into VPAM that previously were completed outside of the product.

Quick Connect Terms and Conditions

A new custom field for Terms and Conditions that applies to recipients of Quick Connect sessions has been added and will now allow capturing those users' approval of these terms in logs.

This request was completed to fulfill a specific CPAM site's needs, however, it has broad applicability for any site using Quick Connect to manage access to end users at their customer's sites.

Additional Enhancements

Other enhancements and updates for this release are:

• MFA via Mobile Authenticator is now available for Gatekeeper Users on CPAM.

• Updating a credential will no longer allow duplicate usernames in the same credential pool.

• MSDP port type has been added.

3.1.11 and the corresponding release (22.4.13) are now generally available. The main feature within this release is Admin Log Export, available on both VPAM and CPAM.

Admin Log Export Feature

A new feature has been added to allow exporting information directly out of the admin log to csv. This allows exporting the full content or content filtered by search terms and/or a date range. Many customers ask for custom reporting to gather information either not in the reports module or not easy to gather from the admin log. Syslog integration addresses this for some customers, but adding this functionality addresses it for many more. This will help reduce requests for custom reports and redirect those into upgrade opportunities.

Additional Enhancements

Other enhancements and updates for this release are:

• Fixed an internal error that occurred when creating tunneled services while no gateways were available.

• Fixed errors that would occur when deleting applications or Gatekeepers via the SDK.

• Updating credentials in a credential pool will no longer unintentionally allow multiple credentials to share the same name.

23.1.10 and the corresponding releases (22.4.12, 21.4.10.13) are now generally available. This release contains an important fix for RDP connectivity to the latest versions of Windows 11 as well as an update to allow easier access to component versions among other fixes.

Resolved RDP Connection Issues to Windows 11 22H2 Endpoints

Resolved connectivity issues that impacted users connecting both to and from systems on the latest version of Windows 11.

This issue impacted only systems on the latest version of Windows. Addressing this now helps ensure the impact is minimal and resolution is available before more broad adoption of the latest Windows updates.

Allow Proxy Configuration for Pull Upgrades

We now support proxy configurations for pull upgrade connectivity, a requirement for a small number of sites.

Enabling this ensures that the pull upgrade model, required for upgrading to modern versions, is available to customers with proxy requirements.

About Page (Components)

We’ve implemented an about page within the previous debug page to provide information on component versions.

This is intended to quickly confirm component versions that may assist in resolving issues not related to the VPAM/CPAM server version. Above all, this should help our support team with easier access to information they need frequently.

Additional Enhancements

Other enhancements and updates for this release are:

• Hosts may now be enabled via the SDK

• SDK connection failures will now see an accurate error

23.1.9 and the corresponding releases (22.4.11 and 21.4.10.12) are now generally available. This release contains improvements to performance and usability of specific pages and coincides with the latest update to the SDK that enables features not previously supported by the SDK.

Update Reports Module to Show User Department Hierarchy

Multiple reports generated from the reports module have been updated to display the hierarchical departments rather than the legacy department field.

This update makes reporting clearer for sites that utilize the departments hierarchy for managing users and their permissions.

Pagination of Credential and Credential Category List Pages

The credential and credential category list pages will now include paginated tables the same way many other list tables in the UI are displayed.

This will improve performance when loading these pages on sites that heavily utilize these features. Additionally, this allows column-based sorting.

Updated SDK Versions Released

Updated versions of the C#, Python and Java SDKs have been released and include support for Quick Connect, credential tokens and other fixes.

Customers using the SDK can begin using the latest versions (2.6.0 for C#, 2.3.0 for Python and Java) along with this release to utilize the new endpoints and updates.

Additional Enhancements

Other enhancements and updates for this release are:

• Added support for Gatekeeper registration codes without expiration dates

• Added the Gatekeeper registration code to the Gatekeeper downloads page

• Resolved an issue that resulted empty upgrade commands being sent to Gatekeepers

• Departments will now appear in order when bulk editing applications

23.1.8 and the corresponding releases (22.4.10 and 21.4.10.11) are now generally available. This release contains Gatekeeper information updates and important bug fixes including multiple fixes related to the reporting module.

Improve HTTP(S) Handling when not using stored Credentials

Connections to HTTP and HTTPS services will no longer have our man-in-the-middle component for HTTPS enabled by default. This will only be enabled for a connection if there is a credential that needs to be injected for the user.

This component can slow down connections and break specific HTTP(S) services. Ensuring it’s not running when it isn’t needed allows for more connections to work without requiring workarounds to disable this manually. This should decrease the number of HTTP(S) related cases opened for our support team.

Display “Duplicate” Gatekeeper Installations

Gatekeepers that are duplicated either through manual means of copying keys to use the same registration code or through the cloning of an entire VM that has an installed Gatekeeper will now be properly displayed to the user.

This is an important change for CPAM customers who had little insight into this before. This information can be helpful in identifying Gatekeeper connectivity issues, particularly intermittent issues, and sites that require separate Gatekeeper installations.

Desktop Sharing Performance Improvements

Changes have been made to improve performance with our built-in desktop sharing components. This should help resolve latency and framerate issues seen in recent versions.

Desktop Sharing performance has impacted several customers, and multiple steps have been taken to resolve the issues. This should drastically improve the experience for customers who rely heavily on desktop sharing.

Additional Enhancements

Other enhancements and updates for this release are:

• Resolved an issue where email links for RDP2 audit conversions would be invalid

• Resolved an issue where in-browser notifications for completed audit conversions would lead to a “Page not Found” error

• Resolved an issue where disabling audit at the Gatekeeper Group level would prevent credential injection

• Multiple API Updates

• Updated the concurrents report in the ReportsV2 module to use our weekly_concurrents table for data

23.1.7 and the corresponding releases (22.4.9 and 21.4.10.10) are now generally available. This release contains Gatekeeper information updates and important bug fixes including multiple fixes related to the reporting module.

Improved Gatekeeper Statistics

Users can now see additional Gatekeeper Information in the UI in relation to the JVM memory and threads.

This will help quickly identify and resolve Gatekeeper issues that can occur for Gatekeeper deployments on systems with low or minimal specifications.

Gateway Tunneling Improvement

Sessions created for Gateway tunneled services such as AD/LDAP or PAM integration connections will no longer generate any empty session data visible in the session history

Users and administrators reviewing audit will no longer have unnecessary data visible in the session history and can more quickly find user audit.

Additional Enhancements

Other enhancements and updates for this release are:

• Resolved an issue where reports that included data in or out information with large values could result in emailing a blank report

• Resolved an issue that resulted in the Vendor Connection Report on VPAM being unable to show preview data in the UI

• Editing multiple scheduled reports without refreshing the page will no longer result in applying the initial report’s filters to subsequent reports

• Updated SSHD to fix a bug that could result in SSHD processes using an amount of memory exponentially higher than expected

23.1.6 and the corresponding releases (22.4.8 and 21.4.10.9) are now generally available. This release contains important bug fixes, back-end updates and coincides with the latest release of our SDK.

Azure VHD Availability for New Deployments

As of this release we now have updated VHDs for deployments in Azure that are based on AlmaLinux 8 and support our pull model for upgrades. This is available for new deployments in Azure or migrations to Azure.

SSH Audit Updates

We’ve updated how our SSH audit is captured and stored in order to capture raw data with headers. This ensures more data is captured in the audit file to help resolve an infrequent issue that could cause SSH audit to be captured but not linked in the UI on session history.

Credential Token Support in the SDK

With this release we've both created the credential token endpoint and updated our SDK versions. This will allow the credential tokens we use for injection to be available to the SDK as they are for users via the UI for endpoints such as HTTP/HTTPs services.

Upgrade to latest Java and Jetty

We’ve updated the Java and Jetty versions used by the PAS appliance. While the previously used versions posed no security risks, this upgrade ensures we’re using any security and performance fixes while addressing any concern with older versions appearing on scans.

Update Default Settings for Audit Conversion

Previously the local audit conversion on the SecureLink appliance could fail when creating a file larger than expected, preventing admins from viewing particularly long RDP sessions. We’ve adjusted the default limitation to prevent this issue in most, if not all circumstances.

23.1.5 and the corresponding releases (22.4.7 and 21.4.10.9) are now generally available. This release contains important bug fixes and back-end updates.

New Feature - German Release for EA

VPAM is now available in German and will display in German for any user with German language settings set as default in their browser. This is dynamic based on the browser setting and does not require users to navigate menus to find language settings within PAS.

New Feature - Role Mapping through AD Integration

Administrators may now configure AD integration to sync roles for users on authentication. This previously was limited to user information including groups

Bug Fix – Unable to Delete Application

Resolved an issue that had prevented admins or other users with appropriate permissions from being able to delete applications under specific circumstances.

Bug Fix – Telnet Service Credential Injection

Resolved an issue that prevented credential injection with telnet services in Putty and could degrate telnet connection performance.

Bug Fix – Unable to Move Gatekeepers

Resolved an issue that could prevent admins from being able to use the "Move GK" option in CPAM.

23.1.3 and the corresponding releases (22.4.5 and 21.4.10.7) are now generally available. This release contains key bug fixes and improvements as well as general availability for new features related to audit retention.

UI Settings for Audit Retention and Archival

This release enables UI controls over audit retention and archival settings. Previously any changes to these settings required our Technical Operations team to make configuration changes.

S3 Storage for Audit Archival

In addition to mounted storage for audit files, customers will now be able to configure S3 buckets for audit. This also opens up availability for this to our cloud environment and reduces the cost for long term audit retention in cloud.

Desktop Sharing (Orange Pill) Latency Fix

Latency issues in our desktop sharing provided both by the Gatekeeper and in Quick Connect that were introduced in a prior release have been resolved.

23.1.2 and the corresponding releases (22.4.4, 22.3.7, 22.2.10 and 21.4.10.6) are the last releases under the current version schema. This release contains key bug fixes and improvements and no new major features.

Gatekeeper Connectivity Fixes

This release resolves multiple connectivity issues with Universal Gatekeeper that could occur during Gatekeeper upgrades or routine connectivity key rotation.

Session Chat

Resolved an issue that resulted in session chat not allowing separate users connected to the same Gatekeeper to use the feature.

Fixed Gatekeeper Access Requests for Sites with Large Numbers of Gatekeepers

Resolved an issue that resulted in a "request is malformed" error when requesting access to a Gatekeeper with an ID greater than or equal to 1000.

Audit Conversion Temporary Storage Relocated

Relocated the directory for temporary file storage during audit conversion to prevent conversion failures related to a lack of disk space.

Show "HD Audit Disabled" in Session History

For services that have had HD audit disabled by admins, rather than showing an empty space where the audit link would appear in session history, we will now show an indicator that HD audit has been disabled.