Release Notes

Other enhancements and updates for this release are:

• VNC audit conversion now happens server-side and no longer requires downloading and running additional components in order to access VNC/desktop sharing audit.

• We've added a rule to enforce an 'only one instance per user' rule for the connection manager.

• Improvements were made to error messages to make them more intuitive for the end user.

• Improvements were made to the connection manager for launching custom clients.

• We've added a 'Known Issues' guide for Gatekeeper Upgrades to the public documentation portal and improved the text and errors within the Gatekeeper UI.

• Resolved a login issue that was causing users from outside an authorized network to receive errors instead of the configured additional MFA check.

• Resolved an issue that was causing an interruption for the Connection Manager, impacting both regular connections and Nexus connections.

• Resolved an issue where some new user permissions were not appearing on certain servers.

• Resolved an issue where users were receiving 'unauthorized' errors after logging in.

Administrators, and users who manage credentials, now have the ability to scope down access to sensitive credentials based on User Group assignment. Assigning a Secret to a specific User Group allows administrators to provision access more stringently by only allowing specific users to create, view, and manage Secrets. 

Implementing a way for administrators to tighten down access controls provides better security hygiene by eliminating exposure of sensitive credentials to users who don't need that level of access, and it aligns with regulatory and cyber insurance requirements by providing audit trails and proof of following a least-privilege model. This new option gives users a way to give/revoke access to certain secrets, by either granting general access via permissions, or by scoping down the secret itself so that only certain users within a user group can manage secrets.

Other enhancements and updates for this release are:

• Added support for additional SSH key types for SSH Audit.

• Improvements to Plugin management were made so that when a user installs a new version of an already existing plugin, all existing configurations are automatically migrated to the new version.

• Made an improvement to our end user's experience with using CyberArk credentials so that responses are case sensitive.

• New System Settings pages and configuration options were added to the VPAM New UI.

• Resolved an issue where the BeyondTrust plugin was ignoring SSL Certificate configuration options.

• Resolved an issue where user identification data was being incorrectly displayed when switching between the VPAM legacy UI and new UI.

• Resolved a credential error on product startup.

• Resolved an issue where vendor reps could not reset their password.

• Resolved an Access Request issue where Approval Emails were directing users to the legacy UI, when the request was generated from the new UI.

• Resolved an issue with the password reset workflow.

• Resolved an issue with IPConnect and host name mapping with a host set to 'Launch via Host Name'.

We’ve added new UI controls to the Device Certificate configuration screen that lets CPAM administrators enable, disable, and adjust device posture checks directly. These controls manage both Active Directory Certificate Service (ADCS) validation and Posture/Safety Checks, ensuring that connections are only allowed from trusted machines with valid client certificates and compliant security settings (like up-to-date antivirus and firewall).

This update gives administrators full self-service control over security configurations without needing Imprivata assistance, while also improving overall system protection. By enforcing posture and certificate validation at the device level, it limits attack exposure and ensures that both the machine and the user are properly authenticated before access is granted.

Other enhancements and updates for this release are:

• Imprivata CPAM now automatically update Azure Entra ID (formerly Azure AD) SAML signing certificates during key rollovers, eliminating manual intervention. The system also supports multiple active certificates to ensure uninterrupted SSO authentication.

• Imprivata CPAM now support additional Syslog protocols, including RFC 3164 and RFC 5425 (TLS over TCP), alongside the existing RFC 5424 (UDP) implementation. This enhancement enables more secure, flexible, and standards-compliant event logging across varied network environments.

• We've added OAuth 2.0 support for SMTP so customers can authenticate securely with Microsoft 365.

• Improvements were made to the process of syncing Gatekeeper hosts from the Nexus.

• Resolved an issue where customers were unable to connect to XenApp service.

• Resolved an issue where users were experiencing errors when logging in using an SSO method.

• Resolved an issue with Reports V2 where an invalid sort was causing an error.

Before this release, ImprivataPrivileged Access Security (PAS) products supported best practices checks for HIPAA, PCI, NERC, and CJIS standards. This release offers users to enable a set of checks against NIST (National Institute of Standards and Technologies) to ensure their organization meets the controls and recommendations suggested by that regulatory entity.

Adding this standardization to our toolbelt of industry-specific checks enables our customers in government and other highly regulated industries to demonstrate their adherence to NIST standards alongside other regulatory checks offered with ImprivataPrivileged Access Security (PAS) products. These best practice checklists provide a single pane of glass for compliance posture and reduce manual cross-reference efforts to ensure compliance.

Other enhancements and updates for this release are:

• When launching RDP connections Users can select their screen size when launching browser-based RDP connections.

• Users can now access our public Help Documentation site directly from the UI Help menu.

• Resolved an issue where Nexus credentials were not passing for CPAM users when HD Audit was turned off.

• Resolved an issue where a character limit was preventing user from creating or editing tunneled services

• Resolved an issue where users were unable to enable application groups.

• Resolved a Nexus issue where one customer was not seeing the option to connect.

• Resolved an issue where user was receiving an error when downloading a video audit.

• Resolved an issue where connections were timing out due to Gateway maintenance tasks on a high number of Gateways.

• Resolved an issue with inconsistencies on the User Preferences page.

To tighten control over sensitive credentials, we will enforce a permissions-based gate on viewing protected secret fields; only users granted the right permission can unlock and reveal raw secret values. Following each unlock, any rotation task linked to that secret will automatically trigger after a configurable delay, ensuring that no credential remains exposed longer than necessary and maintaining a minimized “exposure window” for users.

This functionality improves compliance and auditability by logging unlock events in the admin log and linking rotation tasks to the triggering user, enhances security posture via automatic, time-bound credential rotation, and ultimately gets us one step closer to our 'PAM in PAS Co-platforming' product goals.

Before this release, the Tunneled Services only displayed either Online or Offline. When a tunnel is Offline, there is now a way to reset it or test it from the UI, or display contextual help information if something is misconfigured or not working.

This work helps our PAM integrations and syslog export with setup and testing by giving users the capability and guidance to test and troubleshoot in the UI. Additionally, this streamlines troubleshooting and resolution of connectivity issues that impact these service integrations which ultimately helps our internal teams.

Other enhancements and updates for this release are:

• Additional data points were added to the Audit Archival Storage tables to reflect the storage usage based on the method used.

• If you have multiple servers, automated emails will now include the specific server name.

• [CPAM only] A Gatekeeper Status Report was added to the Reports module. This report displays relevant Gatekeeper information such as Gatekeeper ID, version, connection status, registration status, and connection information.

• The new connection manager is now able to authenticate and connect to an HTTP proxy server.

• Resolved an issue where the connection manager's executable file was being flagged by Microsoft Defender SmartScreen for not having a publisher.

• Resolved an issue where user was receiving an 'Invalid Application ID' error when deleting applications.

• Resolved an issue where the History tab intermittently showed a 'Something went wrong' error.

• Resolved an issue where customer was seeing blank SSH audit files with SFTP file transfers.

• Resolved an issue where Gatekeeper Registration information was not showing in the Admin Log.

• Resolved an issue where users were experiencing an 'Invalid Filter Parameter' error when in the Edit Multiple Applications > Edit User Groups workflow.

• Resolved an issue where service connection retries were not being captured in the Admin Log when the service was using a stored credential.

• Resolved an issue where users were receiving a 'The server failed to provide a valid SSL certificate' error when launching the new connection manager.

• Resolved an issue where a customer could not log in because the Terms & Conditions were not enabled.

• Resolved an issue where vendor representatives could not successfully activate their account when the new VAPM UI was disabled.

• Resolved an issue where users were unable to configure or use LDAPS servers.

Our new connection manager is out of Beta! This milestone release of this feature has overall improved stability and functionality with all services working to include a better end user experience for both Mac and Windows users.

The New C-based connection manager rewrite is finished and will be the default connection manager for both the New UI and Legacy UI. This enables new capabilities such as the Containerized Network feature as well as removing the dependency on Java. The new connection manager capabilities include integration with Nexus, HTTP Tunnels, Virtual Interfaces, IP Connect, FTP support, and Magnet Links. It does not include support for UDP at this time. Note that users can still download and use the Legacy Connection Manager (SCM) if they need it.

This release introduces the ability to configure credential rotation tasks for local RDP and SSH credentials. Whoever is configuring the tasks can configure the settings for tasks to be rotated based on events, such as the use of the credential, or run on demand. The new password is created based on criteria defined in the customized password policy.

25.1.5 introduced task rotation for AD credentials, so this addition expands the capabilities with new credential and task types for RDP and SSH, allowing for broader use of the secrets and password rotation tasks.

Other enhancements and updates for this release are:

• Credential information is now available in the History tables and Session ID tables.

• When using AWS and Imprivata's SES, we've made some improvements so that our SES recognizes domains outside of our default ones.

• We've improved our Java8 optional support so users will no longer see error messages when editing multiple applications.

• Performance enhancements and maintenance fixes went in to the new Connection Manager.

• Resolved an issue where Credential Pools were not working for RDP connections over Nexus when the CPAM had version 25.1.5 and the VPAM had either version 23.3 or 24.2.

• Resolved an issue with where the sorting function in Reports v2 wasn't working.

• Resolved an issue where valid authentication combinations were returning errors.

• Resolved an issue where users were unable to change the name of a Gateway.

• Resolved an issue where an intermediate certificate was being placed into the SSL chain twice.

• Resolved an issue where the server was not checking or recognizing additional LDAP servers when the first one failed.

• Resolved an issue where connections were timing out due to Gateway maintenance tasks on a high number of Gateways.

• Resolved an issue where Gateways stopped trying to connect after multiple server restart events.

Our new connection manager is out of Beta! This milestone release of this feature has overall improved stability and functionality with all services working to include a better end user experience for both Mac and Windows users.

The New C-based connection manager rewrite is finished and will be the default connection manager for both the New UI and Legacy UI. This enables new capabilities such as the Containerized Network feature as well as removing the dependency on Java. The new connection manager capabilities include integration with Nexus, HTTP Tunnels, Virtual Interfaces, IP Connect, FTP support, and Magnet Links. It does not include support for UDP at this time. Note that users can still download and use the Legacy Connection Manager (SCM) if they need it.

This release introduces the ability to configure credential rotation tasks for local RDP and SSH credentials. Whoever is configuring the tasks can configure the settings for tasks to be rotated based on events, such as the use of the credential, or run on demand. The new password is created based on criteria defined in the customized password policy.

25.1.5 introduced task rotation for AD credentials, so this addition expands the capabilities with new credential and task types for RDP and SSH, allowing for broader use of the secrets and password rotation tasks.

Other enhancements and updates for this release are:

• All changes to Global RDP settings are now logged in the Admin Log.

• Resolved an issue where user could not select and save a custom service on a host.

• Resolved an issue where Internal Server Error was appearing when user tried to create a new report in reports v2.

• Resolved an issue where Internal Server Error was appearing when user sorted/filtered a reports v2 dashboard.

• Resolved an issue where convoluted user session history data was appearing on the History tables.

• Resolved an issue where Nexus RDP connections with attached Credentials were failing when the CPAM customer was on 25.1.5 and the VPAM was on 24.2 or older.

• Resolved an issue where admins were seeing audit entries attached to the wrong session user.

• Resolved an issue where QuickConnect sessions were throwing log errors but no visible error for the end user in the UI. Note this issue was only observed on new databases.

• Resolved an issue where data was not reflected in the Admin log on subsequent connection attempts to a service.

This new functionality, suggested by one of our CPAM customers, allows administrators to define custom parameters for the Client Title launch parameters. The customized names will appear in the window and tab header, making it easier and faster to find a window. This improvement applies to both VPAM and CPAM.

Allowing users to customize the naming convention of title bars allows them to display what they think is the most relevant information at the beginning of the text string, ultimately making windows much easier to find if multiple sessions are ongoing at the same time and easier to switch between them. The customized naming convention appears when a user hovers over a minimized window.

Other enhancements and updates for this release are:

• An improvement was made to the debug console that allows users to click on the 'Not Healthy' status on the status of Disaster Recovery Diagnostics to view and investigate the details of the Health Check.

• Filezilla's internal putty process will default to IPv4 resolution when connecting to an SFTP service on MacOS.

• Resolved an issue where the Vendor Self-registration button was appearing on the login page when the setting was disabled.

• Resolved an issue where the BeyondTrust PAM plugin was not working correctly.

• Resolved an issue that prevented users from downloading Scheduled Reports on-demand.

• Resolved an issue related to Disaster Recovery Health Checks where the UI was timing out before the health check was complete.

• Resolved an issue on where the Connection Manager (beta) was not terminating correctly on Linux.

The CPAM user documentation has been added to the public facing Imprivata documentation portal and will go live on April 17.

The documentation team worked incredibly hard to review, update, and transform the CPAM Admin and End User docs so they are publicly available for ease-of-access and organized so the different user types can quickly find the information they need.

Other enhancements and updates for this release are:

• Entra ID and x509 were added as authncontext SAML configuration options.

• Improvements were added to the VPAM new UI to include enhancements to User Management and Application Labels.

• Ephemeral tokens now work with VNC credential injection.

• An issue was resolved where Approver users were receiving an error when trying to approve Nexus vendor application requests.

• A pagination issue was resolved that resulted in only 25 hosts displaying in an application.

• An issue was resolved where SCP/SFTP audit logs were broken.

• An issue was resolved where users were experiencing errors when searching/filtering by Customer Name in the Gatekeeper UI.

• An issue was resolved so that ARM Linux receives the proper architecture Java package on upgrade.

• An issue was resolved where Nexus vendors were unable to register or connect to Gatekeeper V2 with a proxy.

• An issue was resolved which caused hostname mapping to fail after upgrading from Windows 11 23H2 to 24H2 with IP Connect installed.

Pre-flight checks were added to the self-upgrade process via the CLI.

The CLI now has the ability to run the pre-flight check without performing the upgrade, including checking on Disaster Recovery notes. If anything is amiss in the DR configuration the pre-flight check will fail and notify the user. Adding this functionality will empower hundreds of customers to self-service their upgrades while reducing operational burden from our Support team.

Other enhancements and updates for this release are:

• Pre-connection notifications were added to the new VPAM UI, allowing administrators to configure the settings and end users to receive the notifications.

• Resolved an issue that prevented users from inputting an MFA code into the login screen successfully. The MFA login workflow works as expected now.

• Resolved an issue that prevented reseting registration keys in some circumstances.

• Added a configuration option for disabling port monitoring from the Gatekeeper or Gateway. When this feature is disabled, the Gatekeeper or Gateway will not check if configured services are listening, and users will not see those services rendered as red text in the UI if no service is available on the remote system.

New checks and regulations added to our CJIS, HIPAA, and PCI Best Practices Checklists. The additions include updates and additions around password length and requirements, MFA, account expiration, client anti-virus health, and disaster recovery.

These additional checks ensure organizations continue to operate within regulatory boundaries, minimize operational risk, and maintain quality and efficiency within their industry.

Other enhancements and updates for this release are:

• The Imprivata FTP client is now enabled for Linux (Alma, CentOs and Ubuntu) for FPT and SFTP services.

• Improvements were made to the self-upgrade process for an overall better user experience, including enabling the self-upgrade dashboard by default.

• An issue was resolved in the VPAM new UI that prevented users from launching RDP within the RSSRDP client.

• An issue was resolved which allowed disabled non-admin users to log in to the mobile app and approve access requests.

• An issue which was causing unintended side effects by checking then unchecking the "Require MFA validation from iDP for SSO users" setting has been resolved, and the customers experiencing this issue should not experience further inconsistencies when configuring this setting.

We are releasing all available VPAM functionality in the new UI, including: Application & Vendor Management, Gateway Management, Vendors & Internal users can connect to applications, a new and refreshed view of History and Audit Data, and the Admin Log.

Not only does the new UI have a beautiful new look, it also provides an improved, more streamlined experience for all users of VPAM. Each component has been thoughtfully redesigned to quickly surface relevant information with less clicks and page loads, and to minimize the need to reference external product documentation.

As requested by one of our most enthusiastic customers, custom form fields that are filled out by vendors who are requesting access to an application will now appear in the notification emails that administrators and approvers receive.

Showing the custom form fields in the notification email provides even more detail and context to the person who is approving access to an application so they can make informed decisions on granting access without having to log in via the web portal.

Other enhancements and updates for this release are:

• Continued updates and bug fixes for the new Connection Manager are available in this release for sites who have enabled the beta of this from System Settings.

• If any issues arise while executing the self-upgrade option, a “reason for failure” will be logged in the Admin Log within the UI as well as via CLI output notification sent to the user.

• Resolved an issue that prevented Vendor Approval Request forms from displaying on Nexus connections.

• Resolved an issue that prevented copy/paste from working correctly on RDP sessions.

A change in the Windows 11 24H2 (released 10/1) MSTSC client affected the rendering of audited RDP sessions. This release contains a property that changes how bitmap information is sent in those RDP sessions to address this issue without the need for previously available workarounds which included disabling audit or using a separate client.

Users rely on MSTSC for capabilities such as drive sharing which cannot be delivered by the available workaround client. This ensures that users on the latest version of Windows can continue making connections as they did before Windows updates.

Other enhancements and updates for this release are:

• Continued updates and bug fixes for the new Connection Manager are available in this release for sites who have enabled the beta of this from System Settings

• Resolved an issue that prevented the search function on the report distribution list page from working as intended

• Improved the reliability of launching the SFTP/FTP client

• The available memory line when viewing a Gateway Instance now properly shows available memory rather than used memory

Updates to tunneled services to provide clarity around which Gateway a service is routed through and resolve a problem state that can prevent tunneled service connections from resuming after network connectivity issues.

This helps ensure that tunneled services can be easily used and relied upon for customers with complex network deployments and customers that need to route to on-prem services for authentication, SMTP or integrations when deployed in Imprivata cloud.

Other enhancements and updates for this release are:

• Resolved an issue on CPAM that would result in usability issues when the user’s browser is set to German.

• Resolved an issue that caused the login page to be difficult to read with the login page design.

• Created API endpoints for managing sessions.

• SMTP server response codes of 250 will now be correctly treated as successful.

• Security updates in response to our annual penetration testing.

The beta new connection manager is available to all users on Windows, Mac or Linux as of this release when enabled from the settings in the system admin module. This is available on both VPAM and CPAM.

The new connection manager significantly reduces the time it takes to go from clicking ‘connect’ on an application or Gatekeeper to having access to the endpoints. Additionally, previous requirements that periodically resulted in the need to clear temp files for some users have been addressed to provide a more consistent and reliable experience for all users. Finally, the new connection manager enables our new Containerized Network functionality.

The Containerized Network feature allows users on Windows to map services to new interfaces outside of the 127.X.Y.Z loopback addresses. This feature is for Windows users only and is automatically enabled when the Next-Gen Connection Manager is used.

VPAM and CPAM have always used an alternate port process for granting access when the local port selected is unavailable. For most use-cases this is unnoticed and allows users to connect without issue. In select use cases such as SMB access or access to PLCs with certain thick clients – alternate ports result in an inability to connect. This new feature allows an alternate interface to be used to ensure the required port is available and makes the connection process for these types of services significantly easier for the end user.

The History section has been added to the new UI and allows a new service access level view of history.

This is a major milestone for the new UI and brings a significantly improved experience to reviewing history. Users can now view history at the service level without the need to drill into multiple sessions to get the data needed. Additionally, the history table can be filtered by any available column or columns including the user, vendor, host, port, access time and more.

Other enhancements and updates for this release are:

• Initial components to allow administrators to initiate upgrades from within the product have been added

• API endpoints for access details, session details, Gateway management and others have been added

• Resolved an issue that prevented custom application access request forms from being properly used for Nexus connections

Approval requests that previously would notify only the users with the proper permission and department settings needed to handle the approval can now optionally notify system administrators as well.

This new option will make it easier for system administrators who would like a higher level of notifications for approval processes or those who would also be responsible for handling the approvals or may consider themselves an escalation point for those approvals.

Updated versions of the C#, Java and Python SDKs have been released which contain additional functionality and bugfixes.

This release coincides with our regular SDK update. SDK capabilities have been expanded and these updates require the new version of the SDK along with 24.1.6 or newer.

Other enhancements and updates for this release are:

• Resolved an issue that could prevent the system from properly establishing tunnels for Gateway tunneled services

• Resolved an error that would occur when users without local accounts, such as SAML users, attempted to use the password reset functionality

• Resolved an issue that could cause a users’ service access event to not appear on the session history page for access to a web service when a stored credential was used

• VPAM and CPAM servers deployed in Imprivata Cloud will now have Crowdstrike AV installed

Gatekeeper Admins in CPAM can now be reminded via email if a request remains pending for a configurable period of time.

This new process ensures that an automated reminder for the pending request is available and not dependent on manual outreach to the Gatekeeper Admin. This is configurable both to enable/disable as well as set an interval in hours for the reminder message.

Other enhancements and updates for this release are:

• Resolved an issue that could prevent deletion of applications in some cases.

• Users will no longer be able to inadvertently set the session timeout to zero minutes in the UI which would result in users unable to maintain sessions

• Non-admin users that can create external credential providers (PAM Integration) can now properly see the created objects on the list view

• Sorting choice for the list roles table will now persist for users

• Pre-connection notifications on VPAM will now be properly labeled as Application Pre-Connection Notes rather than “Site” Pre-connection Notes.

• Removed the ‘reason for access’ prompt automatically included when using a custom application access request form with other fields.

Custom Application Access Approval Profiles are now functional over the Nexus, ensuring that vendor reps connecting through Nexus relationships can be prompted for the same information as local vendors when determining approval.

An important piece of any new features brought to VPAM or CPAM is to ensure that, if applicable, those features work across the Nexus. This work closes that gap on a recent feature release both to ensure Nexus does not create any loss in functionality and to meet a direct request by an existing customer.

Other enhancements and updates for this release are:

• The new Linux SCM is available in beta form and can be enabled with the 24.1.4 release. When the Windows and Mac versions of the SCM are made available we will announce this as a major release highlight.

• Resolved an issue with a previous release version resulting in renaming Gatekeepers that were hosted on a Gateway

• The logout.action will now properly forward to the SAML logout for SAML users

The success@imprivata.com email has been removed from the login page text and default settings placeholder for support contact information.

After reviewing the emails that we receive at this address, the vast majority are issues where Imprivata cannot help the end user (anything from accounts being disabled to endpoints not online). The support contact information in system settings should be set with a proper contact for the customer site to ensure users can quickly get to a resource that can help them.

Nexus vendor reps enabled/disabled status will now be determined by the CPAM side of the Nexus connection by default and update the status on the VPAM side during the connection process if needed. Multiple customers ran into issues where local settings on the VPAM side unintentionally affected the ability of Nexus users to connect and requested an update to allow Nexus users to proceed with connecting if their account was in an enabled state on the CPAM server. This resolves an issue that would require manual actions from an admin to re-enable a disabled account. Settings options for the related property allow other behaviors that include rejecting the connection or allowing the user to request to be enabled when the local VPAM account is disabled.

Other enhancements and updates for this release are:

• Resolved an issue that prevented updated Gateway names from showing on specific pages

• Resolved an issue that could result in tunneled services going offline due to a hung scheduled tasks thread

• Updated Best Practices Checklist Password Length to 12 characters to better align with best security practices

• Updated instances of "Access Restrictions" settings headers to "Authentication Requirements" to better reflect the purpose of those settings

• Added a UI option for toggling the dynamic HTTP(S) service proxy on and off. When enabled, the proxy is dynamically enabled only for connections with stored credentials.

• Removed instances of "SecureLink" from certain emails and the "unavailable" page text.

The UI has received a branding update to ensure the new name is visible in the top left and color elements have been updated from the former SecureLink color scheme to Imprivata colors. This update also applies the new naming within the UI and emails to replace former instances of “SecureLink”.

This is a major step towards the unified solution naming across the Imprivata portfolio and ensures we can start getting this in front of customers immediately rather than coordinating this with the availability of the new UI.

Instances in a Gateway pool can now be drained to prevent new sessions from beginning on that instance.

It is also now possible to see what sessions are through a given instance. This request came from multiple customers as a means to isolate Gateway instances when there is a need to bring them offline for updates or other maintenance without impacting user connections.

Users can now set a preference for their preferred tunneling method for the Connection Manager.

Having the option to set a preferred tunneling method ensures faster connectivity for users who do not use the standard SSH tunnel by not requiring them to wait while an SSH attempt times out.

Other enhancements and updates for this release are:

• Gatekeeper users on CPAM can now use a TOTP authenticator for MFA

• The “Launch via” setting for services can now be defined upon service creation instead of only on editing the service

• Gateway CRUD actions will now properly generate admin log entries

• Resolved an issue that prevented updates to audit retention settings from taking effect

Approval profiles grant customization to the questions a user must fill out when requesting access. This feature allows that same customization in a new area where requests previously only had a "reason for access" prompt.

This gives customers more control over the information they're gathering and in turn allows for more informed decision making when granting approval for individual vendor reps to access applications. For some customers this enables them to bring workflows into VPAM that previously were completed outside of the product.

A new custom field for Terms and Conditions that applies to recipients of Quick Connect sessions has been added and will now allow capturing those users' approval of these terms in logs.

This request was completed to fulfill a specific CPAM site's needs, however, it has broad applicability for any site using Quick Connect to manage access to end users at their customer's sites.

Other enhancements and updates for this release are:

• MFA via Mobile Authenticator is now available for Gatekeeper Users on CPAM.

• Updating a credential will no longer allow duplicate usernames in the same credential pool.

• MSDP port type has been added.

A new feature has been added to allow exporting information directly out of the admin log to csv. This allows exporting the full content or content filtered by search terms and/or a date range. Many customers ask for custom reporting to gather information either not in the reports module or not easy to gather from the admin log. Syslog integration addresses this for some customers, but adding this functionality addresses it for many more. This will help reduce requests for custom reports and redirect those into upgrade opportunities.

Other enhancements and updates for this release are:

• Fixed an internal error that occurred when creating tunneled services while no gateways were available.

• Fixed errors that would occur when deleting applications or Gatekeepers via the SDK.

• Updating credentials in a credential pool will no longer unintentionally allow multiple credentials to share the same name.

Resolved connectivity issues that impacted users connecting both to and from systems on the latest version of Windows 11.

This issue impacted only systems on the latest version of Windows. Addressing this now helps ensure the impact is minimal and resolution is available before more broad adoption of the latest Windows updates.

We now support proxy configurations for pull upgrade connectivity, a requirement for a small number of sites.

Enabling this ensures that the pull upgrade model, required for upgrading to modern versions, is available to customers with proxy requirements.

We’ve implemented an about page within the previous debug page to provide information on component versions.

This is intended to quickly confirm component versions that may assist in resolving issues not related to the VPAM/CPAM server version. Above all, this should help our support team with easier access to information they need frequently.

Other enhancements and updates for this release are:

• Hosts may now be enabled via the SDK

• SDK connection failures will now see an accurate error

Multiple reports generated from the reports module have been updated to display the hierarchical departments rather than the legacy department field.

This update makes reporting clearer for sites that utilize the departments hierarchy for managing users and their permissions.

The credential and credential category list pages will now include paginated tables the same way many other list tables in the UI are displayed.

This will improve performance when loading these pages on sites that heavily utilize these features. Additionally, this allows column-based sorting.

Updated versions of the C#, Python and Java SDKs have been released and include support for Quick Connect, credential tokens and other fixes.

Customers using the SDK can begin using the latest versions (2.6.0 for C#, 2.3.0 for Python and Java) along with this release to utilize the new endpoints and updates.

Other enhancements and updates for this release are:

• Added support for Gatekeeper registration codes without expiration dates

• Added the Gatekeeper registration code to the Gatekeeper downloads page

• Resolved an issue that resulted empty upgrade commands being sent to Gatekeepers

• Departments will now appear in order when bulk editing applications

Connections to HTTP and HTTPS services will no longer have our man-in-the-middle component for HTTPS enabled by default. This will only be enabled for a connection if there is a credential that needs to be injected for the user.

This component can slow down connections and break specific HTTP(S) services. Ensuring it’s not running when it isn’t needed allows for more connections to work without requiring workarounds to disable this manually. This should decrease the number of HTTP(S) related cases opened for our support team.

Gatekeepers that are duplicated either through manual means of copying keys to use the same registration code or through the cloning of an entire VM that has an installed Gatekeeper will now be properly displayed to the user.

This is an important change for CPAM customers who had little insight into this before. This information can be helpful in identifying Gatekeeper connectivity issues, particularly intermittent issues, and sites that require separate Gatekeeper installations.

Changes have been made to improve performance with our built-in desktop sharing components. This should help resolve latency and framerate issues seen in recent versions.

Desktop Sharing performance has impacted several customers, and multiple steps have been taken to resolve the issues. This should drastically improve the experience for customers who rely heavily on desktop sharing.

Other enhancements and updates for this release are:

• Resolved an issue where email links for RDP2 audit conversions would be invalid

• Resolved an issue where in-browser notifications for completed audit conversions would lead to a “Page not Found” error

• Resolved an issue where disabling audit at the Gatekeeper Group level would prevent credential injection

• Multiple API Updates

• Updated the concurrents report in the ReportsV2 module to use our weekly_concurrents table for data

Users can now see additional Gatekeeper Information in the UI in relation to the JVM memory and threads.

This will help quickly identify and resolve Gatekeeper issues that can occur for Gatekeeper deployments on systems with low or minimal specifications.

Sessions created for Gateway tunneled services such as AD/LDAP or PAM integration connections will no longer generate any empty session data visible in the session history

Users and administrators reviewing audit will no longer have unnecessary data visible in the session history and can more quickly find user audit.

Other enhancements and updates for this release are:

• Resolved an issue where reports that included data in or out information with large values could result in emailing a blank report

• Resolved an issue that resulted in the Vendor Connection Report on VPAM being unable to show preview data in the UI

• Editing multiple scheduled reports without refreshing the page will no longer result in applying the initial report’s filters to subsequent reports

• Updated SSHD to fix a bug that could result in SSHD processes using an amount of memory exponentially higher than expected

As of this release we now have updated VHDs for deployments in Azure that are based on AlmaLinux 8 and support our pull model for upgrades. This is available for new deployments in Azure or migrations to Azure.

We’ve updated how our SSH audit is captured and stored in order to capture raw data with headers. This ensures more data is captured in the audit file to help resolve an infrequent issue that could cause SSH audit to be captured but not linked in the UI on session history.

With this release we've both created the credential token endpoint and updated our SDK versions. This will allow the credential tokens we use for injection to be available to the SDK as they are for users via the UI for endpoints such as HTTP/HTTPs services.

We’ve updated the Java and Jetty versions used by the PAS appliance. While the previously used versions posed no security risks, this upgrade ensures we’re using any security and performance fixes while addressing any concern with older versions appearing on scans.

Previously the local audit conversion on the SecureLink appliance could fail when creating a file larger than expected, preventing admins from viewing particularly long RDP sessions. We’ve adjusted the default limitation to prevent this issue in most, if not all circumstances.

VPAM is now available in German and will display in German for any user with German language settings set as default in their browser. This is dynamic based on the browser setting and does not require users to navigate menus to find language settings within PAS.

Administrators may now configure AD integration to sync roles for users on authentication. This previously was limited to user information including groups

Resolved an issue that had prevented admins or other users with appropriate permissions from being able to delete applications under specific circumstances.

Resolved an issue that prevented credential injection with telnet services in Putty and could degrate telnet connection performance.

Resolved an issue that could prevent admins from being able to use the "Move GK" option in CPAM.

This release enables UI controls over audit retention and archival settings. Previously any changes to these settings required our Technical Operations team to make configuration changes.

In addition to mounted storage for audit files, customers will now be able to configure S3 buckets for audit. This also opens up availability for this to our cloud environment and reduces the cost for long term audit retention in cloud.

Latency issues in our desktop sharing provided both by the Gatekeeper and in Quick Connect that were introduced in a prior release have been resolved.

This release resolves multiple connectivity issues with Universal Gatekeeper that could occur during Gatekeeper upgrades or routine connectivity key rotation.

Resolved an issue that resulted in session chat not allowing separate users connected to the same Gatekeeper to use the feature.

Resolved an issue that resulted in a "request is malformed" error when requesting access to a Gatekeeper with an ID greater than or equal to 1000.

Relocated the directory for temporary file storage during audit conversion to prevent conversion failures related to a lack of disk space.

For services that have had HD audit disabled by admins, rather than showing an empty space where the audit link would appear in session history, we will now show an indicator that HD audit has been disabled.