Current Releases

If you are using a client (RDM, PowerShell, etc.), version 2026.3 is required for this DVLS version IMPROVEMENTS Core - Added the host and port, plus the asset's IP address, MAC address and machine name, to entries returned by the public API Core - Improved the public API for RDP (configured) and Website entries: you can create them without a sub type, update them with PUT/PATCH, and set their host, port and URL Gateway - Added "Access denied" to the message shown when a user without the Gateway user role tries to open a session through a gateway, so the reason is clear PAM - Made the results easier to read when you test a Windows local account discovery script Web - Added the Client ID field to the advanced search FIXES SECURITY Core - Fixed a security issue in Active Directory credential validation SECURITY Core - Fixed a security issue in how multifactor authentication data was stored SECURITY Core - Fixed a security issue in the email configuration test SECURITY Core - Fixed a security issue where the identity provider user sync could return sensitive user information Core - Fixed LDAP connections failing when the domain was set with only its NetBIOS name Core - Fixed the activity logs recording the data source user in the Machine user field Core - Fixed the default Application Access setting not applying to new Microsoft Entra ID users until the DVLS service was restarted Core - Fixed the import of a Microsoft Entra group with an apostrophe in its name failing with "Group not found on Azure AD" Gateway - Fixed a gateway's active session count not updating after you view its sessions Gateway - Fixed a second KDC server for an existing Kerberos realm being discarded with no message PAM - Fixed the "Privileged Access - Logs" report export ignoring the user filter Web - Fixed "Clean up now" in Database retention policies never cleaning up the logs Web - Fixed "Do not show again" on the system message being ignored when the dialog is closed with Escape Web - Fixed a DVLS Privileged Account picked from a "Prompt on connection" folder being rejected with the "Use active DVLS workspace" error Web - Fixed an error when clearing an empty destination user group in the User groups mapping tab of the authentication migration Web - Fixed an error when opening a scheduled report of an unsupported type Web - Fixed the Approve and Cancel buttons being cut off on mobile when you approve a new device sign-in Web - Fixed the confirmation message for deleting a Universal Key naming only its first serial instead of all the licenses it contains Web - Fixed the end time of a temporary access request resetting to the start time Web - Fixed the French "Invalid license" login error saying "Invalid IP address" instead Web - Fixed the Microsoft Entra ID banner blocking the page from scrolling in some settings Web - Fixed the user group count showing 0 when editing a user Web - Fixed the web SSH terminal no longer showing output or accepting input after a large command output Web - Fixed the wrong entry icon showing in "Search in all vaults" results Web - Removed an unwanted red icon from the Entry History "Revert" confirmation ** CONSOLE RELEASE NOTES ** IMPROVEMENTS Minor update

If you are using a client (RDM, PowerShell, etc.), version 2026.3 is required for this DVLS version IMPROVEMENTS Core - Added a Subscription ID field to the Azure Service Principal credential entry, for use with the Terraform provider Core - Spreadsheet document sheets are no longer lost when an affected RDM version saves them. DVLS now keeps the previous full workbook when an upload is missing sheets Core - Stopped sending "Error report" emails for a harmless OAuth token error (IDX10517) that recovers on its own PAM - When Active Directory refuses a domain sign-in, the error now gives the reason Active Directory sends (for example an expired, locked-out or invalid account) instead of only "LDAP result code: 49" Web - Added Keeper CSV and Keeper JSON as import sources in the web interface, so users can import their own Keeper vault. The JSON import keeps Keeper's record IDs, so attachments can be matched to the right entries FIXES Core - Fixed "Is Expiring" notification emails showing the vault name where the number of days before expiry should be Core - Fixed contractors created with the New-DSUser PowerShell cmdlet not receiving their invitation email Core - Fixed Devolutions Password Manager and Remote Desktop Manager clients that use external-browser sign-in staying disconnected after their token was revoked Core - Fixed synchronizer entries in the user vault not being saved when added or edited PAM - Fixed SSH password reset and account discovery failing on hosts that use sudo-rs or a system language other than English Web - Fixed a "No template is available" error when adding a Website entry with the Add entry mode set to "Template list only" Web - Fixed an error when adding a Secure Note entry with the interface language set to German Web - Fixed the Run As password of a PowerShell terminal (remote) entry being sent to the web client in clear text whenever the entry was read Web - The Duplicate action in the web client now needs the same permissions as in RDM. Users no longer need the "View sensitive information" permission to duplicate an entry ** CONSOLE RELEASE NOTES ** IMPROVEMENTS Minor update

If you are using a client (RDM, PowerShell, etc.), version 2026.3 is required for this DVLS version IMPROVEMENTS Core - Added a forced password change at first sign-in for the default dvls-admin account in the Docker image, so no hardcoded default password stays in use Core - Blocked uploads that would lose data from Spreadsheet documents saved by affected RDM versions. DVLS now keeps the previous full workbook and logs a warning Web - Added the ability to manage "My personal credentials" and "My privileged account" from the web interface FIXES SECURITY Core - Fixed an issue where applying a vault template could bypass entry security SECURITY Core - Fixed MFA secrets being exposed in the user list response SECURITY Core - Fixed missing authorization checks that let users create and edit account discovery scans on providers they could not manage SECURITY Gateway - Fixed an issue where Devolutions Gateway token destinations could bypass virtual gateway Network Access Rules SECURITY PAM - Fixed missing authorization checks that let non-administrative users import PAM accounts and overwrite PAM providers SECURITY PAM - Fixed missing authorization checks that let non-administrative users import PAM AD computers and create PAM sub-providers Core - Fixed approval emails not reaching user group members when a temporary access request was sent to a user group Core - Fixed RDM PowerShell cmdlets failing with "Unexpected exception" when loading a DVLS workspace without permission to view user groups Core - Fixed Set-DSEntityPermission resetting View and replacing existing rights when the OverrideExistingPermissions switch was not used Core - Fixed User Settings Vault entries being wrongly logged as orphaned when they failed to deserialize Core - Fixed users with the legacy User right no longer being able to remove or reset other users, or manage their MFA Gateway - Fixed a missing credential rights check when the host picked at launch only switched to a different row of the same password list Gateway - Fixed gateway connections failing with "The entry host name is not defined." for entries whose host is set to Linked (vault) > Prompt on connection PAM - Fixed heartbeat checks failing for PAM accounts that use a domain alias and belong to the Protected Users group PAM - Fixed the UPN username being sent together with the domain when connecting with IronRDP PAM - Fixed Windows local account discovery failing on scans that took more than 30 seconds to respond Web - Fixed a "TypeError reading ‘id'" error when confirming a privileged account checkout before opening a session Web - Fixed a NotFoundException being logged when editing a vault template Web - Fixed Microsoft SQL Server entries not being supported in the web interface Web - Fixed web client sessions never recording an end time on close, which inflated session durations in Privileged Session Monitoring ** CONSOLE RELEASE NOTES ** IMPROVEMENTS Minor update

If you are using a client (RDM, PowerShell, etc.), version 2026.3 is required for this DVLS version FIXES SECURITY CVE-2026-110287 - Core - Fixed users without the Edit asset permission being able to change an asset's contact password SECURITY CVE-2026-110804 - PAM - Fixed JIT elevation cleanup at check-in relying on client-provided values, which could delete Active Directory groups DVLS did not create or leave elevated access in place SECURITY CVE-2026-110805 - Core - Fixed a vulnerability in PingOne group lookups that could allow server requests to arbitrary addresses and expose sensitive data SECURITY CVE-2026-110806 - Core - Fixed passwords stored in session add-on settings being visible to users without permission to view credentials Core - Fixed the Console's SQL Server workspace migration reporting "The database does not exist" after a successful connection test Core - Fixed TLS syslog messages being silently dropped when the certificate was issued for a hostname Core - Fixed trial options appearing unavailable after the first administrator login on a new installation Core - Fixed users disabled or revoked in Entra ID, Okta, or PingOne remaining signed in to DVLS Core - Fixed various user interface issues Gateway - Fixed credential injection and credential group restrictions being skipped when a gateway farm became the default gateway PAM - Fixed Cisco account password resets failing due to a missing required component PAM - Fixed Cisco password resets failing when the password contained special characters PAM - Fixed inherited account lifecycle policies displaying default settings instead of the provider's settings PAM - Fixed MySQL account password resets failing PAM - Fixed the custom Windows accounts provider failing when using linked credentials ** CONSOLE RELEASE NOTES ** FIXES Minor update

If you are using a client (RDM, PowerShell, etc.), version 2026.3 is required for this DVLS version IMPROVEMENTS Core - Added a deprecation warning for sending SMS through email, planned for 2027.1, with a shortcut to configure Twilio Core - Removed the option to export in the .rdm v1 format; exports now use v2, while v1 files can still be imported PAM - Added the ability to select an SSH Key PAM account from the DVLS web interface FIXES SECURITY Core - Fixed an authorization issue that allowed low-privileged users to delete and restore vault attachments from the attachment history SECURITY CVE-2026-105488 Core - Fixed an account takeover risk involving phishing through the device code authentication flow SECURITY CVE-2026-105488 Core - Fixed an authorization issue that allowed unauthorized users to read, modify, or delete Global Contact and Folder entries SECURITY CVE-2026-9226 Core - Fixed an account takeover risk where Azure AD login session tokens could be replayed Core - Fixed an error when migrating legacy forbidden passwords to a vault Core - Fixed an issue where filtered entry pickers only displayed root-level entries instead of entries inside folders Core - Fixed an issue where the expired entries filter returned no results when filtering by folder or vault name Core - Fixed an issue where the Tor exit node list was downloaded on every login even when "Block Tor clients" was disabled Core - Multiple UI fixes Gateway - Fixed an issue where sessions through a virtual gateway failed to launch when the entry was configured to prompt for credentials PAM - Fixed an issue where "Exclude disabled accounts" became mandatory after editing a Windows Local Account provider in DVLS web PAM - Fixed an issue where a port set to 0 wasn't replaced with the default port when using the SSH Key provider PAM - Fixed an issue where Certificate entries couldn't be added when their value contained a backslash PAM - Fixed an issue where previously selected JIT groups were removed when adding a new group through search PAM - Fixed an issue where SSH key account discovery failed when an authorized key had no comment PAM - Fixed an issue where the legacy WinRM client mode skipped TLS certificate validation for HTTPS hosts when "Skip TLS validation" was disabled Web - Fixed an issue where users with Add but no Edit permission on a folder couldn't add a Document entry stored in the database ** CONSOLE RELEASE NOTES ** IMPROVEMENTS Core - Improved installation and diagnostic checks to detect and report port reservations that could cause the site to return a 503 error

If you are using a client (RDM, PowerShell, etc.), version 2026.3 is required for this DVLS version IMPROVEMENTS Core - Added an option to import legacy roles that were not created during migration, allowing them to be used in role assignments FIXES SECURITY Core - Fixed a security issue where the legacy partial login endpoint accepted and retained client-supplied session identifiers after authentication SECURITY Core - Fixed a SQL injection vulnerability in the database backup path setting SECURITY Core - Fixed an issue where low-privileged users could restore and permanently delete vault attachments through attachment history SECURITY Core - Fixed authentication and session tokens being stored unencrypted in the database SECURITY Core - Fixed integration secrets in data source settings being visible to users without administrative permissions SECURITY Core - Fixed missing access controls that allowed users without the required permissions to read or save System Vault entries SECURITY Core - Fixed the Microsoft Entra ID application secret being exposed in URL query strings when retrieving groups and role templates SECURITY Gateway - Fixed a security issue where any authenticated user could obtain a network scan token and access internal network information SECURITY PAM - Fixed domain controller detection occurring before the Devolutions Gateway ruleset was enforced, allowing network traffic to bypass the ruleset and gateway logging SECURITY PAM - Fixed the legacy WinRM client mode ignoring the "Skip TLS certificate validation" setting and always skipping certificate validation for HTTPS hosts Core - Fixed an error when filtering or sorting Administration logs by user on SQL Server databases using case-sensitive collation Core - Fixed the "dvls-admin" user on Basic installations being able to bypass the required password change by closing the browser Core - Fixed the Public API returning a 404 error instead of a 400 error for malformed request bodies Core - Fixed users without System Vault entry edit permission being able to edit System Vault entries through their regular entry permissions Gateway - Fixed an issue where "Force Gateway rulesets" could be bypassed when a connection explicitly targeted a physical gateway Gateway - Fixed rejected Devolutions Gateway certificates being incorrectly reported as unreachable domain controllers in Active Directory domain configurations PAM - Fixed Active Directory and Windows providers being unable to use a Devolutions Gateway in LDAPS mode with an already trusted certificate Web - Fixed notification settings not being saved when exactly two available actions were selected Web - Fixed renamed custom field titles not being retained when confirmed with the checkmark in the entry edit dialog Web - Fixed trailing spaces being saved in tags and "Exact expression" notification subscription filters despite appearing to be removed in the interface Web - Multiple UI fixes ** CONSOLE RELEASE NOTES ** IMPROVEMENTS Minor update

If you are using a client (RDM, PowerShell, etc.), version 2026.3 is required for this DVLS version IMPROVEMENTS Core - Password generation now honors custom characters defined in Devolutions Cloud password policies Core - Updated Public API vault type filters to correctly filter PAM vaults PAM - PAM license auto-assignment now considers provider-level role permissions Web - Users can now launch sessions without the "View password" permission FIXES SECURITY PAM - Gateway rulesets are now enforced before detecting the domain controller Core - Fixed an issue where Devolutions Send attachments were incorrectly limited to 1 MB instead of 30 MB Core - Fixed an issue where Devolutions Send emails were not sent from Remote Desktop Manager Core - Fixed an issue where Devolutions Send failed from Remote Desktop Manager when DVLS did not have a valid license Core - Fixed an issue where moving a single entry to another vault placed it at the vault root instead of preserving its source folder Core - Fixed an issue where non-admin users did not receive the "Warn if already opened" prompt and closed RDP sessions remained marked as open Core - Fixed an issue where privileged account entries with a missing provider link loaded indefinitely without feedback Core - Fixed an issue where roles assigned to the "Everyone" user group were not applied to all users Core - Fixed an issue where scheduled Active Directory synchronization did not work with linked vault credentials Core - Fixed an issue where the "Allow drag and drop" setting remained set to "None" and "Primary workspace owner" was not applied Core - Fixed an issue where trailing spaces were saved in tags and the "Exact expression" notification subscription parameter Core - Fixed Domain authentication and PAM Domain Provider failures after an upgrade when the domain controller's LDAPS certificate was not trusted by the DVLS server Core - Fixed errors when granting permissions to user groups Core - Fixed intermittent Linux build failures in the CI pipeline Core - TLS certificate validation is now enforced when connecting to Active Directory Gateway - Fixed an error when trusting a gateway certificate on DVLS running under Kestrel Gateway - Fixed an issue with certificates stored in the Windows certificate store Multiple UI fixes PAM - Fixed a TLS certificate error when browsing containers from the quick start PAM - Fixed an error when browsing domain containers during a quick scan PAM - Fixed an incorrect launcher message when a contractor lacked the required permissions on a PAM vault or entry PAM - Fixed an issue when assigning an Active Directory user as a reviewer PAM - Fixed an issue where moving an entry to a vault failed when the destination path was a folder PAM - Fixed an issue where the PostgreSQL provider was missing from the quick start PAM - Fixed an issue where updating a provider's managed account corrupted its password PAM - Fixed an issue where usage policies could be bypassed using inherited credentials PAM - Fixed the Import button activation in delta scan results Web - Fixed a scrolling issue on the PAM providers page Web - Fixed a WebSocket connection leak when terminal sessions were closed by the server Web - Updated the Telnet web client to fix terminal teardown and resizing issues ** CONSOLE RELEASE NOTES ** FIXES Fixed Basic Console installation failures caused by an unsupported bundled SQL Server installer version

If you are using a client (RDM, PowerShell, etc.), version 2026.3 is required for this DVLS version NEW FEATURES Core - Added a new encryption format for RDM export files Core - Added a one-time self-service extension for expired trials Core - Added custom user tags for filtering, sorting, reporting, and conditional access Core - Added granular administrative roles for more precise permission management Core - Added individual forbidden password rules with configurable matching modes Core - Added PostgreSQL support as a Devolutions Server database backend PAM - Added an option to keep Microsoft 365 and Active Directory JIT accounts between checkouts PAM - Added self-rotation for PAM provider credentials PAM - Added the ability to extend active PAM checkouts without checking in and requesting access again PAM - Merged PAM and shared vaults, allowing PAM credentials to be stored in regular high-security vaults Web - Added a compact kiosk view displaying web-launchable sessions as tiles IMPROVEMENTS Core - Added a setting to configure how long log files are retained on disk Core - Added checkout support for folders and multiple selections Core - Added expiration dates for user accounts Core - Added missing Remote Desktop Manager variables so scripts and entries now resolve them correctly Core - Added paging for large Active Directory group lists used by automatic user creation filters Core - Added SSH key support to Bitwarden synchronization Core - Added the ability to check out linked entries directly from the overview Core - Hidden the "Submit a support ticket" action when internet features are disabled Core - Imports now warn about entries with forbidden or policy-violating passwords instead of blocking them Core - Improved performance when moving entries to vaults containing thousands of entries Core - Improved support for vault templates when saving system settings Core - Linked credentials are now automatically checked out when used Core - Prevented connection logs linked to session recordings from being archived or purged Core - Removed unusable PSU licenses from the interface Core - Trimmed leading and trailing spaces from usernames during emergency login PAM - Added a dedicated permission for manually creating PAM accounts PAM - Added an option to skip TLS validation for the Windows provider PAM - Added AnyIdentity provider support through Devolutions Gateway and on Linux using cross-platform PowerShell remoting PAM - Added on-demand account discovery directly from the PAM providers list PAM - Added visibility of inherited checkout policy values Web - Added a session recording log viewer with an activity timeline Web - Added support for DVLS Privileged Account credentials Web - Added the "Allow password in variable" security setting to username and password credentials Web - Added the ability to delete multiple attachments at once Web - Added the ability to download multi-part session recordings as a single ZIP file Web - Added the ability to run saved Scripts/Macros entries in web PowerShell and SSH terminals Web - Added the ability to run scripts in PowerShell sessions opened through Devolutions Gateway Web - Converted legacy Website entries to the current entry type Web - Improved AI Assistant answer and approval prompt positioning Web - Improved the search and advanced search experience Web - Refreshed the user menu side panel layout Web - Restored ticketing administration for Jira, ServiceNow, and HaloPSA FIXES Core - Fixed a SQL timeout when renaming folders containing more than 3,500 entries Core - Fixed administrators being unable to reset a contractor's password Core - Fixed an issue where moving entries between vaults failed and could break linked credentials Core - Fixed an issue where moving entries to another vault no longer worked Core - Fixed an issue where the "Force MFA" setting could remain enabled after migrating from SQL to DVLS with no way to disable it Core - Fixed an issue where the server could remain permanently in maintenance mode after an interrupted maintenance run Core - Fixed automatic database retention cleanup not running when using a non-English SQL login Core - Fixed contractors being able to change or remove their own 2FA configuration without re-entering their password Core - Fixed database upgrades timing out during long-running steps, particularly on Azure SQL Core - Fixed notification preference emails containing a mix of translated and English text Core - Fixed partially translated email notifications and improved their date formatting Core - Fixed renamed folders and their contents disappearing from the connection tree Core - Fixed scheduled database retention incorrectly archiving or purging records within the configured retention period Core - Fixed support ticket submissions reporting success without creating a support case Core - Fixed the offline synchronization document size limit exceeding the value supported by Remote Desktop Manager Core - Fixed the scheduler service crashing when a custom log retention policy contained invalid values Core - Fixed the User column appearing blank in Global Open Sessions when Remote Desktop Manager was connected to a Devolutions Server data source Core - Fixed ticket prompts accepting free-form text when an existing ticket was required Core - Fixed user vault entry errors after migrating a SQL data source to DVLS Core - Fixed vault and folder password complexity policies being displayed as inherited without being enforced Core - Harmonized checkout and check-in behavior across platforms Gateway - Fixed an error when trusting a Devolutions Gateway certificate on Kestrel-hosted instances Gateway - Fixed incorrect gateway host and port resolution for native iLO and SQL Server sessions Gateway - Fixed session recording failures for Active Directory Console entries using a Devolutions Gateway farm Gateway - Fixed session recordings being larger than expected because configured frame rate and resolution settings were ignored PAM - Fixed accounts incorrectly appearing as Out of sync in Remote Desktop Manager PAM - Fixed Active Directory discovery, OU browsing, and group lookups failing with trusted domain controller certificates PAM - Fixed Active Directory TLS certificate validation and trusted certificate issues affecting discovery, OU browsing, and group retrieval PAM - Fixed an error when filtering containers during account discovery PAM - Fixed an issue where Active Directory account discovery returned no accounts for child domains when the forest root was unreachable PAM - Fixed an issue where moving a PAM entry to a folder in another vault failed PAM - Fixed checkouts not expiring and scheduled password rotations not running when many accounts were checked out simultaneously PAM - Fixed Cisco and MySQL password reset providers being uneditable after creation and restored the Cisco username field PAM - Fixed PAM account lifecycle and checkout policies being creatable without a valid PAM license PAM - Fixed PAM accounts incorrectly appearing as "Out of sync" in Remote Desktop Manager PAM - Fixed the "Automatically check in PAM account" setting displaying the wrong value PAM - Fixed the total checkout time being displayed incorrectly when an account was automatically checked in PAM - Fixed the View and Copy one-time password actions being unavailable in Remote Desktop Manager for checked-out PAM accounts with OTP configured PAM - Fixed users with a PAM provider role losing access to the Privileged Access section Web - Fixed closing a session from the kebab menu redirecting to Administration > Vaults instead of the current vault, and corrected the disconnect message Web - Fixed entries disappearing from the Connections tree when moved by drag and drop while a filter was active Web - Fixed long entry names being truncated in the Sessions tree and hiding the session recording indicator Web - Fixed Telnet sessions terminating unexpectedly Web - Fixed terminal sessions leaving network connections open after being ended from the server side Web - Fixed the "Find by name (user vault)" dialog displaying irrelevant results when no entry matched Web - Fixed the Connections tree not refreshing after deleting an entry while a filter was active Web - Fixed the Credentials dropdown offering "Linked (cross vault)" for user vault entries when the option was disabled Web - Multiple UI fixes ** CONSOLE RELEASE NOTES ** FIXES Fixed a "Could not apply least permissions" error when updating a server instance Fixed an error when editing and saving a Kestrel instance in maintenance mode Fixed an upgrade removing the scheduler account's permissions on the encryption configuration file Fixed duplicate Light and Dark theme options under Support > Options > Theme Fixed server instance changes made from the Console not being saved Fixed the command-line interface crashing when upgrading a server instance Fixed upgrades removing the scheduler account's permission to access the encryption configuration file

If you are using a client (RDM, PowerShell, etc.), version 2026.3 is required for this DVLS version NEW FEATURES Core - Added a new encryption format for RDM export files Core - Added a one-time self-service extension for expired trials Core - Added custom user tags for filtering, sorting, reporting, and conditional access Core - Added granular administrative roles for more precise permission management Core - Added individual forbidden password rules with configurable matching modes Core - Added PostgreSQL support as a Devolutions Server database backend PAM - Added an option to keep Microsoft 365 and Active Directory JIT accounts between checkouts PAM - Added self-rotation for PAM provider credentials PAM - Added the ability to extend active PAM checkouts without checking in and requesting access again PAM - Merged PAM and shared vaults, allowing PAM credentials to be stored in regular high-security vaults Web - Added a compact kiosk view displaying web-launchable sessions as tiles IMPROVEMENTS Core - Added a setting to configure how long log files are retained on disk Core - Added checkout support for folders and multiple selections Core - Added expiration dates for user accounts Core - Added missing Remote Desktop Manager variables so scripts and entries now resolve them correctly Core - Added paging for large Active Directory group lists used by automatic user creation filters Core - Added SSH key support to Bitwarden synchronization Core - Added the ability to check out linked entries directly from the overview Core - Hidden the "Submit a support ticket" action when internet features are disabled Core - Imports now warn about entries with forbidden or policy-violating passwords instead of blocking them Core - Improved performance when moving entries to vaults containing thousands of entries Core - Improved support for vault templates when saving system settings Core - Linked credentials are now automatically checked out when used Core - Prevented connection logs linked to session recordings from being archived or purged Core - Removed unusable PSU licenses from the interface Core - Trimmed leading and trailing spaces from usernames during emergency login PAM - Added a dedicated permission for manually creating PAM accounts PAM - Added an option to skip TLS validation for the Windows provider PAM - Added AnyIdentity provider support through Devolutions Gateway and on Linux using cross-platform PowerShell remoting PAM - Added on-demand account discovery directly from the PAM providers list PAM - Added visibility of inherited checkout policy values Web - Added a session recording log viewer with an activity timeline Web - Added support for DVLS Privileged Account credentials Web - Added the "Allow password in variable" security setting to username and password credentials Web - Added the ability to delete multiple attachments at once Web - Added the ability to download multi-part session recordings as a single ZIP file Web - Added the ability to run saved Scripts/Macros entries in web PowerShell and SSH terminals Web - Added the ability to run scripts in PowerShell sessions opened through Devolutions Gateway Web - Converted legacy Website entries to the current entry type Web - Improved AI Assistant answer and approval prompt positioning Web - Improved the search and advanced search experience Web - Refreshed the user menu side panel layout Web - Restored ticketing administration for Jira, ServiceNow, and HaloPSA FIXES Core - Fixed a SQL timeout when renaming folders containing more than 3,500 entries Core - Fixed administrators being unable to reset a contractor's password Core - Fixed an issue where moving entries between vaults failed and could break linked credentials Core - Fixed an issue where moving entries to another vault no longer worked Core - Fixed an issue where the "Force MFA" setting could remain enabled after migrating from SQL to DVLS with no way to disable it Core - Fixed an issue where the server could remain permanently in maintenance mode after an interrupted maintenance run Core - Fixed automatic database retention cleanup not running when using a non-English SQL login Core - Fixed contractors being able to change or remove their own 2FA configuration without re-entering their password Core - Fixed database upgrades timing out during long-running steps, particularly on Azure SQL Core - Fixed notification preference emails containing a mix of translated and English text Core - Fixed partially translated email notifications and improved their date formatting Core - Fixed renamed folders and their contents disappearing from the connection tree Core - Fixed scheduled database retention incorrectly archiving or purging records within the configured retention period Core - Fixed support ticket submissions reporting success without creating a support case Core - Fixed the offline synchronization document size limit exceeding the value supported by Remote Desktop Manager Core - Fixed the scheduler service crashing when a custom log retention policy contained invalid values Core - Fixed the User column appearing blank in Global Open Sessions when Remote Desktop Manager was connected to a Devolutions Server data source Core - Fixed ticket prompts accepting free-form text when an existing ticket was required Core - Fixed user vault entry errors after migrating a SQL data source to DVLS Core - Fixed vault and folder password complexity policies being displayed as inherited without being enforced Core - Harmonized checkout and check-in behavior across platforms Gateway - Fixed an error when trusting a Devolutions Gateway certificate on Kestrel-hosted instances Gateway - Fixed incorrect gateway host and port resolution for native iLO and SQL Server sessions Gateway - Fixed session recording failures for Active Directory Console entries using a Devolutions Gateway farm Gateway - Fixed session recordings being larger than expected because configured frame rate and resolution settings were ignored PAM - Fixed accounts incorrectly appearing as Out of sync in Remote Desktop Manager PAM - Fixed Active Directory discovery, OU browsing, and group lookups failing with trusted domain controller certificates PAM - Fixed Active Directory TLS certificate validation and trusted certificate issues affecting discovery, OU browsing, and group retrieval PAM - Fixed an error when filtering containers during account discovery PAM - Fixed an issue where Active Directory account discovery returned no accounts for child domains when the forest root was unreachable PAM - Fixed an issue where moving a PAM entry to a folder in another vault failed PAM - Fixed checkouts not expiring and scheduled password rotations not running when many accounts were checked out simultaneously PAM - Fixed Cisco and MySQL password reset providers being uneditable after creation and restored the Cisco username field PAM - Fixed PAM account lifecycle and checkout policies being creatable without a valid PAM license PAM - Fixed PAM accounts incorrectly appearing as "Out of sync" in Remote Desktop Manager PAM - Fixed the "Automatically check in PAM account" setting displaying the wrong value PAM - Fixed the total checkout time being displayed incorrectly when an account was automatically checked in PAM - Fixed the View and Copy one-time password actions being unavailable in Remote Desktop Manager for checked-out PAM accounts with OTP configured PAM - Fixed users with a PAM provider role losing access to the Privileged Access section Web - Fixed closing a session from the kebab menu redirecting to Administration > Vaults instead of the current vault, and corrected the disconnect message Web - Fixed entries disappearing from the Connections tree when moved by drag and drop while a filter was active Web - Fixed long entry names being truncated in the Sessions tree and hiding the session recording indicator Web - Fixed Telnet sessions terminating unexpectedly Web - Fixed terminal sessions leaving network connections open after being ended from the server side Web - Fixed the "Find by name (user vault)" dialog displaying irrelevant results when no entry matched Web - Fixed the Connections tree not refreshing after deleting an entry while a filter was active Web - Fixed the Credentials dropdown offering "Linked (cross vault)" for user vault entries when the option was disabled Web - Multiple UI fixes Web - Multiple UI fixes ** CONSOLE RELEASE NOTES ** IMPROVEMENTS Added a `--disable-telemetry` option to the IIS command-line installer to disable telemetry during installation FIXES Fixed a "Could not apply least permissions" error when updating a server instance Fixed an error when editing and saving a Kestrel instance in maintenance mode Fixed an upgrade removing the scheduler account's permissions on the encryption configuration file Fixed duplicate Light and Dark theme options under Support > Options > Theme Fixed server instance changes made from the Console not being saved Fixed the command-line interface crashing when upgrading a server instance Fixed upgrades removing the scheduler account's permission to access the encryption configuration file

If you are using a client (RDM, PowerShell, etc.), version 2026.2 is required for this DVLS version FIXES Core - Fixed an invalid license error when connecting from Remote Desktop Manager or the Launcher to servers using PAM package licenses with auto-assign enabled Core - Fixed an issue where System Settings couldn't be saved from Remote Desktop Manager when a ticketing system was configured Core - Fixed an issue where User Vault credentials couldn't be set in user-specific settings when entry creation was restricted to templates only PAM - Fixed an issue where the Get-DSPamVault PowerShell cmdlet returned errors or no results when listing accessible PAM vaults Web - Fixed an issue where spaces couldn't be entered when renaming an entry or folder from the right-click menu Web - Fixed an issue where the "User vault" label wasn't displayed in the configured language until the page was refreshed Web - Multiple UI fixes ** CONSOLE RELEASE NOTES ** IMPROVEMENTS Minor update

If you are using a client (RDM, PowerShell, etc.), version 2026.2 is required for this DVLS version IMPROVEMENTS Core - Improved automatic cleanup of website backup files on Linux FIXES SECURITY [CVE-2026-10786]Core - Fixed ticketing system credentials being exposed in data source settings to authenticated users Core - Fixed domain users not being added to their groups when some group members couldn't be resolved Core - Fixed scheduled Users reports failing when no tags were selected PAM - Fixed password reset failing for Cisco accounts Web - Fixed the documentation panel not using the full available height ** CONSOLE RELEASE NOTES ** IMPROVEMENTS Minor update

If you are using a client (RDM, PowerShell, etc.), version 2026.2 is required for this DVLS version IMPROVEMENTS Web - Added RustDesk entry details to the web interface Web - Users with the **Password Policies** permission can now edit the password template directly from the password generator FIXES SECURITY Core - Fixed a privilege escalation issue where non-administrators could add themselves to administrator groups SECURITY Core - Fixed an issue where the NetBox synchronizer API token was visible to users with view-only access SECURITY PAM - Password history now requires the appropriate password permissions, preventing unauthorized access to previous passwords Core - Fixed an issue where custom permission sets could be removed when saving unrelated system settings Core - Fixed an issue where domain users could not be linked to user groups Core - Fixed an issue where Passwordstate v10 entries incorrectly required an API key when saving Core - Fixed an issue where the **Duo automatic multi-factor** preference was not retained after login Core - Fixed an issue where the Duo SMS button did not send passcodes from the login window PAM - Fixed an error that prevented editing PAM accounts from Remote Desktop Manager PAM - One-time password secret keys are no longer sent to clients; codes are now always generated by the server Web - Fixed an issue where permission changes could not be saved from the batch grant access dialog Web - Fixed an issue where the password generator ignored the parent folder's password policy when creating entries ** CONSOLE RELEASE NOTES ** IMPROVEMENTS Minor update

If you are using a client (RDM, PowerShell, etc.), version 2026.2 is required for this DVLS version IMPROVEMENTS Core - Added a Devolutions Send region selector in Server settings for .com and .eu regions FIXES SECURITY CVE-2026-15058 Core - Improved security by preventing users from deleting another user's messages SECURITY CVE-2026-15637 PAM - Improved security by preventing unauthorized access to SSH private keys SECURITY CVE-2026-15641 Core - Improved security by preventing users from approving their own pending access requests Core - Password policy validation errors now provide clear, actionable feedback instead of a generic server error PAM - Fixed an issue preventing users with PAM management permission from selecting JIT groups PAM - Fixed an issue where previously selected JIT elevation groups could appear blank or disappear PAM - Fixed an issue where SSH provider timeout settings were ignored, causing endless loading when a host was unreachable Web - Fixed the Logs dashboard menu positioning for the "Last 7 days" filter ** CONSOLE RELEASE NOTES ** FIXES SECURITY CVE-2026-15642 Core - Improved security by preventing Azure Key Vault secrets from being exposed in recovery kits when sensitive data is excluded

If you are using a client (RDM, PowerShell, etc.), version 2026.2 is required for this DVLS version IMPROVEMENTS PAM - Improved the **Grant temporary access** screen by fixing scrolling when browsing the list PAM - Reduced Active Directory lookups when resolving approvers, improving responsiveness during approval actions Web - Added support for X.509 certificate credentials, allowing certificate entries created in Remote Desktop Manager to be viewed and used in the web interface FIXES SECURITY CVE-2026-14536 Core - Fixed an issue where MFA policies were not enforced when no default MFA method was configured Core - Fixed an intermittent login loop affecting YubiKey and MFA users Core - Fixed an issue where users using Alternate Email MFA were no longer recognized as having MFA enabled after updating Core - Fixed duplicated telemetry events and improved cleanup of outdated events Core - Multiple UI fixes PAM - Fixed a missing **Checkout permission** message when approving a checkout without the required permission PAM - Fixed an issue where users without the required vault access could appear as approvers Web - Fixed a loading overlay that blocked interaction with the compromised password dialog Web - Fixed an issue preventing Equivalent URLs from being configured on Web Browser entries Web - Fixed the **Copy to clipboard** action in the password list ** CONSOLE RELEASE NOTES ** IMPROVEMENTS Minor update

If you are using a client (RDM, PowerShell, etc.), version 2026.2 is required for this DVLS version IMPROVEMENTS Core - Improved Brandfetch icon display to better match the active application theme Core - Improved service security by correcting the DVLS Scheduler service registration path Core - Updated the OTP authentication mode name from "Username and password" to "Configured" for consistency with Remote Desktop Manager PAM - Added a Message column to recent activities exports to include elevation request details FIXES Core - Added a clearer message when the DVLS Free user limit is reached during first-time SSO sign-in Core - Fixed Active Directory synchronization and domain configuration errors in environments with overlapping domain names Core - Fixed an issue preventing users from changing the preferred domain controller when the current controller was unavailable Core - Fixed syslog messages that could fail RFC 5424 validation and interfere with event processing Core - Multiple UI fixes SECURITY PAM - Improved security of Active Directory browse endpoints against credential-coercion and unauthorized-access attacks PAM - Fixed Azure account password resets Web - Fixed an issue where the Launch button could disappear when an entry was checked out by another user Web - Fixed log comment edits being lost after refreshing the page Web - Fixed the System Settings search box not returning results ** CONSOLE RELEASE NOTES ** IMPROVEMENTS Minor update

If you are using a client (RDM, PowerShell, etc.), version 2026.2 is required for this DVLS version IMPROVEMENTS Core - Website Legacy entries can no longer be edited and must be converted before use. The option to permanently dismiss the conversion notice has also been removed PAM - Added requested elevation details to reports PAM - Added visibility into which approvers received temporary access and PAM checkout requests PAM - Prevented users from approving their own checkout requests through linked accounts when self-approval is disabled FIXES SECURITY Core - Fixed a security issue where duplicating a folder could expose attachments and handbook pages to users without access to the original content SECURITY Core - Fixed a security issue where ticketing service credentials (ServiceNow and Jira) could be viewed by authenticated users through data source settings SECURITY PAM - Fixed missing permission checks on discovery scan results, ensuring only authorized users can access discovery data SECURITY Core - Fixed a privilege escalation issue that could allow users creating vaults or PAM providers to assign themselves System Administrator rights SECURITY Core - Fixed an issue where social-login entry metadata could be visible to vault members who were explicitly denied access to those entries Core - Fixed a performance regression that caused system permission changes to take longer than expected to save Core - Fixed a synchronizer error that occurred when nested groups were deleted in Entra ID (Azure AD) Core - Fixed an issue preventing orders from being created when they contained both a starter pack and additional licenses Core - Fixed an issue where changing a password on first login after a basic installation could fail Core - Fixed an issue where exported attachments and documents could become unusable after re-importing with attachments included Core - Fixed an issue where the "Template list only" mode was not enforced, allowing entries to be created without a template Core - Fixed an issue where variables were not resolved when unsealing entries or sending related notifications Core - Fixed false password-change audit logs and notification emails when updating non-credential Website entry settings Core - Improved loading performance for repository assignments, including the Batch Grant Access window PAM - Fixed PostgreSQL accounts incorrectly appearing out of sync after successful password resets PAM - Fixed the "MFA on checkout" default setting not being saved Web - Fixed a JavaScript error when viewing entry details containing deserialization errors under Reports > Diagnostic > Entries Web - Fixed an issue where deleting an entry could trigger an error and leave the connections tree in an incorrect state until the page was refreshed Web - Fixed an issue where unsupported AI Assistant providers appeared blank in the edit dialog and could cause the wrong provider to be saved Web - Fixed Synchronizer entries becoming unusable in the web interface when the synchronization mode was set to manual or inherited manual Web - UI fixes ** CONSOLE RELEASE NOTES ** IMPROVEMENTS Minor updates

If you are using a client (RDM, PowerShell, etc.), version 2026.2 is required for this DVLS version IMPROVEMENTS Core - Added a global setting to disable the AI Assistant for all users Core - Added AI Assistant controls to Entry Type Availability settings for easier administration Core - API messages now match the language used in the web interface PAM - Password Rotation Schedules now follow your configured date and time format Web - DVLS now automatically uses your browser's language when you sign in, unless you have selected a different language FIXES SECURITY Core - Restricted access to deleted user group details to authorized administrators only SECURITY Core - Secured ticketing integration credentials so they are no longer visible to non-administrative users SECURITY PAM - Fixed a script injection vulnerability in built-in PAM provider scripts Core - Fixed an issue where updating the server could cause valid licenses to disappear when an expired license was present Core - Fixed password rotation issues affecting shared SQL accounts across multiple DVLS instances Core - Fixed SQL connection string passwords being written to logs in plain text during configuration reloads PAM - Fixed adding PAM accounts to existing vaults without a valid PAM license PAM - Fixed an issue where Azure SQL accounts in the infrastructure vault were incorrectly shown as out of sync PAM - Fixed an issue where scans of unresponsive Windows targets could block future account scans PAM - Fixed SSH provider connections through the Gateway PAM - Fixed the Default Security section appearing for administrators without System Settings access PAM - Improved the message shown when a password update is still pending, replacing provider errors with clearer information Web - Fixed an error when closing web remote sessions and corrected the displayed hostname on disconnect ** CONSOLE RELEASE NOTES ** IMPROVEMENTS Minor updates

If you are using a client (RDM, PowerShell, etc.), version 2026.2 is required for this DVLS version NEW FEATURES Core - Added a certificate-based Conditional Access Policy for certificate authentication Core - Added a dedicated AI Assistant entry in DVLS Core - Added a new credential mode to save and autofill social logins with the Password Manager extension Core - Added in-app notifications when a new DVLS server version is available Core - Added support for Microsoft Entra ID authentication using delegated permissions Core - Added the ability to configure the number of simultaneous checkouts allowed for an entry PAM - Added the ability to configure a default elevation group during checkout PAM - Added the option to require MFA when checking out a PAM account Web - Added Brandfetch auto-complete support when creating website entries IMPROVEMENTS Core - Added a search bar in the user selection dialog when creating a new domain user, searchable by sAMAccountName, displayName and OU Core - Added CVE vulnerability checks on the security dashboard with upgrade recommendations Core - Added the ability to filter entries by connection type through the REST API Core - Email notifications now use the user's configured language preference Core - Improved contractor user management with a redesigned onboarding experience, automatic password generation, and clearer disabled user indicators Core - Reduced the in-app trial period from 30 days to 14 days PAM - Added a "Skip TLS validation" option for the Windows provider PAM - Added support for using the provider account for SSH password heartbeat when target accounts have SSH access disabled PAM - Enhanced password rotation scheduling with more flexible configuration options PAM - Improved access requests to include the full hierarchy of linked connections Web - Added a button to clear all user notifications Web - Added a Convert button to the legacy website banner for faster entry conversion Web - Added a notification in the Administration Dashboard when a new DVLS version is available Web - Added vertical navigation in the Administration and Reports areas to make settings easier to find Web - Extended user synchronizer support in the web interface FIXES Core - Fixed a missing translation when requesting access to available vaults Core - Fixed a NullReferenceException that could occur when a deleted connection notification was processed Core - Fixed a portable license error ("Invalid license: RDM") on first login Core - Fixed a regression where Custom permissions behaved as Denied in web and RDM clients Core - Fixed a regression where vault assignments were not applied during user group import Core - Fixed a SQL timeout when renaming folders containing a large number of entries Core - Fixed an Access Denied error when non-admin users tried to add an entry from a template Core - Fixed an error when opening Duo MFA settings and improved invalid credential validation Core - Fixed an error when starting a trial with an no email address Core - Fixed an issue where duplicating a folder did not copy sub-entries Core - Fixed an issue where entry types disappeared from Type Availability when the last selected vault was content-restricted Core - Fixed an issue where removing an expired license incorrectly prompted for DVLS Free Core - Fixed attachments being lost when moving entries to another vault Core - Fixed DVLS being unable to connect to SQL Server on Linux when TLS encryption was enabled Core - Fixed Entra App Proxy pre-authentication failing when the DVLS account had MFA enforced Core - Fixed linked external vault information not being saved when linking an SSH key Core - Fixed missing translation and username details in temporary access approval emails Core - Fixed Syslog over TCP messages not being RFC 6587 compliant, preventing ingestion by some collectors Core - Fixed the "Do not show again" option not working in the Clipboard Privacy warning dialog Core - Fixed trailing spaces being saved in Tags and in Notification Subscription "Exact expression" parameters Core - Fixed User Settings Vault and Global settings not working for non-admin users in RDM Gateway - Fixed an issue where "Ping all Gateways" incorrectly reported failures Gateway - Fixed an issue where Gateway vault security incorrectly applied to PAM providers Gateway - Fixed GatewayManager creating a short-lived, undisposed HTTP client for every request, which could lead to socket exhaustion Gateway - Fixed the Update button remaining disabled after deleting a configured Gateway PAM - Fixed a regression where inherited OTP no longer worked on PAM accounts PAM - Fixed an issue where admins appeared as approvers even when disabled in settings PAM - Fixed an issue where approval through role/group permissions did not work PAM - Fixed checkout approvers not appearing in the approvers list when no PAM license is assigned PAM - Fixed having to scroll to access buttons in Reports > PAM Check-out requests PAM - Fixed incorrect "license required" messages shown to licensed PAM users PAM - Fixed PAM account details remaining visible while the account was checked out PAM - Fixed the PAM scheduler hanging on local Windows account scans when the target stopped responding PAM - Fixed the Windows Local Account provider template scan returning no results Web - Fixed a toast notification incorrectly showing "Not found" when deleting entries Web - Fixed a TypeError when opening Advanced Search as a user without a user vault Web - Fixed RDP/VNC/ARD left mouse clicks triggering a right-click in the web client when running in Firefox Web - Fixed the SSH web app not prompting for the private key passphrase when one was required Web - Fixed unnecessary icon cache fetches caused by virtual scrolling Web - Fixed web RDP sessions not invoking the KDC Proxy, causing Kerberos authentication to fall back to NTLM Web - Multiple UI fixes Web - Multiple UI fixes ** CONSOLE RELEASE NOTES ** IMPROVEMENTS The passwords file generated during a Basic Install now includes the SQL Express server/instance name for easier follow-up installs FIXES Core - Fixed additional access URIs not being editable in the Kestrel PAM - Fixed an issue where account discovery results were not always re-encrypted after an encryption key change

If you are using a client (RDM, PowerShell, etc.), version 2026.1 is required for this DVLS version FIXES SECURITY [CVE-2026-9522]PAM - Fixed an access control issue affecting account discovery scan configurations SECURITY [CVE-2026-9590]Core - Fixed a permission issue that could allow asset sections to be modified through the API without proper authorization SECURITY Core - Fixed synchronizers running against sealed credentials without prompting for unsealing first Core - Fixed an error that prevented starting a trial when an invalid email address was entered Core - Fixed sign-in issues when using Entra App Proxy with MFA and pre-authentication enabled PAM - Fixed a regression where the OTP field was not displayed for checked-out accounts using inherited OTP settings Web - Fixed the Clipboard Privacy warning dialog's "Do not show again" option not being respected Web - Fixed trailing spaces being saved in Tags and Notification Subscription exact-match filters ** CONSOLE RELEASE NOTES ** FIXES Core - Fixed the inability to edit additional access URIs in the Kestrel configuration

If you are using a client (RDM, PowerShell, etc.), version 2026.1 is required for this DVLS version IMPROVEMENTS SECURITY Core - Added audit logging for Send Copy actions so administrators can track who shared entries and with whom SECURITY Core - Improved authentication security to prevent external-provider sessions from bypassing password authentication under a different login method Core - Improved Active Directory user creation performance PAM - Added an option to skip TLS validation for the Windows Provider Web - Added Command key support for multi-selection in the web interface, allowing Mac users to extend selections with Cmd-click FIXES SECURITY [CVE-2026-5171 ]Core - Fixed an issue where users without Activity Logs permission could still retrieve entry logs through the API SECURITY [CVE-2026-7325]PAM - Fixed an LDAP coercion issue that could force DVLS to authenticate against a malicious LDAP server SECURITY [CVE-2026-8477]Core - Fixed a security issue where sealed entries could be accessed through the partial sensitive-data endpoint without triggering unseal notifications SECURITY [Le CVE-2026-9047]Core - Fixed an issue where adding an additional MFA factor could remove an existing MFA key SECURITY Core - Fixed a missing permission check that could allow users to create a new vault when importing an `.rdx` file referencing a non-existent vault SECURITY Core - Fixed a password change bypass that allowed users to change passwords without providing the previous password SECURITY Core - Fixed an access-rights cache issue that could allow a privileged user to retrieve another user's credentials SECURITY Core - Fixed an issue where Active Directory accounts could modify their own profile data through the API despite UI restrictions SECURITY Core - Fixed an issue where duplicating a connection could copy handbooks and attachments from entries the user could not access SECURITY Core - Fixed an issue where handbook content and attachment metadata from sealed entries could be accessed without following the unseal workflow SECURITY Core - Fixed an issue where non-admin users could bypass the Pending Approval flow by changing an entry's status SECURITY Core - Fixed an issue where sealed credentials could be unsealed in another DVLS instance without notifying administrators, and improved handling of linked sealed credentials after import SECURITY Core - Fixed an open redirect vulnerability during external OAuth sign-in failures or cancellations Core - Fixed a `NullReferenceException` in the notification processing service that could leave notifications stuck in an unprocessed state Core - Fixed an issue where Linked (External) credentials were not saved correctly on SSH entries linked to an SSH Key Core - Fixed attachments being lost when moving an entry to another vault Core - Fixed folder duplication so sub-entries are duplicated along with the parent folder Web - Fixed a `TypeError` when opening the Advanced Search dialog as a user without a User Vault ** CONSOLE RELEASE NOTES ** IMPROVEMENTS Minor updates

If you are using a client (RDM, PowerShell, etc.), version 2026.1 is required for this DVLS version FIXES SECURITY [CVE-2026-5146] Core - Closed a security gap allowing notification actions without authentication Core - Fixed a configuration error causing app settings to fail loading Core - Fixed admins receiving expiration alerts for other users' vault items Core - Fixed an issue where deleting a user could remove all users from the list Core - Fixed incorrect backup failure alerts and cleanup issues on Linux/Docker Core - Fixed unreliable installation of IIS ASP.NET Core Module on new Windows Server setups PAM - Fixed visibility selector closing too early when creating a new vault Web - Fixed "Disable MFA" dialog not closing after confirmation Web - Fixed default authentication method being ignored in Domain mode Web - Fixed empty notification banners appearing across admin pages Web - Fixed error dialogs showing blank content instead of messages Web - Fixed incorrect warning when saving entries with compromised passwords Web - Fixed login page defaulting to Domain authentication when set to "None" Web - Fixed reveal/copy actions targeting the wrong field after sorting entries Web - Fixed Security Dashboard crash when navigating after resolving ignored issues Web - Multiple UI improvements and fixes ** CONSOLE RELEASE NOTES ** IMPROVEMENTS Core - Added a support package generator to quickly collect diagnostics and configuration for faster issue resolution

If you are using a client (RDM, PowerShell, etc.), version 2026.1 is required for this DVLS version IMPROVEMENTS Core - Renamed Read-Only and Restricted user types to Legacy and removed Read-Only from default user templates Web - Updated third-party dependencies to address security issues, including a reported lodash vulnerability FIXES SECURITY Core - Added missing authorization check to prevent unauthorized access to handbook pages Core - Allowed CyberArk entries to be saved without a username when using OIDC authentication Core - Fixed the Buy a License flow so licenses can be purchased and retrieved properly Core - Prevented permission set changes from being lost when saving after navigation Core - Resolved issue preventing administrators from removing user subscriptions Web - Ensured Reset Password prompt appears above Emergency Login prompt Web - Fixed Hide/Reveal behavior on sensitive fields after table sorting Web - Hid unsupported System Dashboard options in Customize Layout dialog for restricted vaults ** CONSOLE RELEASE NOTES ** IMPROVEMENTS Minor updates

If you are using a client (RDM, PowerShell, etc.), version 2026.1 is required for this DVLS version IMPROVEMENTS Core - Added option for admins to reset a user's dashboard layout Core - Improved LDAP group handling to support users with over 1,000 groups Web - Session names now show the connection name instead of the host name for better consistency FIXES Core - Fixed error preventing MFA settings from being saved in user administration Core - Fixed false nightly "user modified" alerts during directory sync (Entra ID, AD, Okta, PingOne) Core - Fixed Linux issue where access URL didn't update after setting a custom domain Core - Fixed login failure after upgrade caused by improperly migrated security key data Core - Fixed login issue for contractor users when Devolutions authentication was disabled Core - Fixed MFA policy bypass allowing users to delete their own MFA methods Core - Fixed unintended default vault access granted to imported domain users PAM - Improved loading speed of Azure AD groups and user auto-creation RestAPI - Fixed sort order parameter not applying correctly in vault endpoint RestAPI - Fixed vault filter to correctly return Infrastructure vaults Web - Fixed authentication filter not resetting properly in Users list Web - Fixed error when clicking info icon in Entra ID configuration Web - Fixed Linux issue causing repeated dashboard widget duplication Web - Multiple UI fixes and improvements ** CONSOLE RELEASE NOTES ** IMPROVEMENTS Minor updates

If you are using a client (RDM, PowerShell, etc.), version 2026.1 is required for this DVLS version IMPROVEMENTS Core - Added "Show Release News" preference to control release notification visibility Core - Free License users now appear disabled with a clear visual indicator to explain login restriction Core - Renamed "System Dashboard" to "Administration Dashboard" for clearer terminology FIXES Core - Fixed "Allow API Key" setting not persisting after save Core - Fixed "Apply Least Permissions" failing when permissions were preconfigured Core - Fixed "Unable to save" error when users customize dashboards with a default dashboard set Core - Fixed clipboard restrictions not applying in RDP web sessions Core - Fixed contractor users unable to launch RDP sessions via permalink Core - Fixed error when running Last Usage Logs report for regular users Core - Fixed inability to update password generator templates Core - Fixed inability to view inherited OTP codes from root Core - Fixed intermittent dashboard widget reordering not applying Core - Fixed missing activity logs for User Group restore and delete actions Core - Fixed new users not being enabled by default when created Core - Fixed performance issues with Conditional Access Policies enabled Core - Fixed session termination redirecting incorrectly in Active Sessions view Core - Fixed user edits unintentionally removing assigned licenses Core - Fixed vault permissions appearing disabled for non-admin users Core - Resolved SQL collation issues during database and web backups Gateway - Added update notification to System Dashboard Gateway - Fixed advanced domain settings not saving Gateway - Fixed drain mode and scan option issues in Gateway farms Gateway - Fixed inability to terminate sessions using credential injection Gateway - Fixed session launch failures with inherited Gateway Rule Sets PAM - Fixed duplicated parent folders during account import PAM - Fixed incorrect error title on recurrent SSH key scan failure PAM - Fixed missing out-of-sync icon for SSH key accounts PAM - Fixed module admins unable to see external vaults during import PAM - Fixed PAM logs and rotation reports stuck loading on refresh PAM - Fixed SSH checkout approval error with "Yes, unless it's JIT" option PAM - Fixed unauthorized users appearing in checkout approver list PAM - Restored custom fields visibility in connection overview Web - Fixed "Access Denied" error for non-admin session launches with credential injection Web - Fixed PAM checkout redirect causing 404 error Web - Fixed Remote PowerShell entries not launching in web client ** CONSOLE RELEASE NOTES ** IMPROVEMENTS Core - Hid certificate passwords when updating Gateway certificates FIXES Core - Fixed error when editing Certificate Store locations Gateway - Fixed inability to add certificates when editing Gateway

If you are using a client (RDM, PowerShell, etc.), version 2026.1 is required for this DVLS version IMPROVEMENTS Core - Added dashboard layout reset capability allowing administrators to reset a user's corrupted or misconfigured dashboard layout back to defaults FIXES SECURITY CVE-2026-4828 Core - Fixed a security issue where MFA check could be bypassed when Emergency Code authentication was disabled SECURITY CVE-2026-4829 Core - Fixed an issue where OAuth session reuse could allow user impersonation, including administrators SECURITY CVE-2026-4924 Core - Fixed a security issue where MFA could be bypassed using an alternate authentication cookie SECURITY CVE-2026-4925 Core - Fixed an issue allowing users to remove their own MFA despite enforced restrictions SECURITY CVE-2026-4927 Core - Fixed an issue where users with management permissions could access other users' MFA secrets SECURITY CVE-2026-4989 Core - Fixed an issue where the gateway health check could be exploited for server-side request forgery (SSRF) Core - Fixed a regression where Microsoft User synchronization failed with an error reading 'UserCleanupDelta' Core - Fixed an issue where approving temporary access requests did not work when only groups were set as approvers Core - Fixed an issue where the contractor welcome email redirect did not work if the user was already logged in Core - Fixed KeePass XML import incorrectly creating Legacy Website entries instead of the correct entry type Core - Fixed Public API path query parameter filtering to work correctly with encoded URLs and nested paths Core - Fixed the scheduler service crashing when custom log retention policy configuration contained invalid data Gateway - Fixed a server-side request forgery vulnerability in the gateway health check route Gateway - Fixed an issue where new vaults could not be selected when changing the member filter in a gateway farm Gateway - Fixed session recording not working when the session does not connect through a gateway Gateway - Fixed the gateway going offline when a connection to a session fails due to a Virtual Gateway rule or other reason Web - Fixed a regression where the "All vault" button in the search stopped working Web - Fixed an issue where Domain/AD users could not be added by browsing and selecting them Web - Fixed normal users receiving an "Unable to save" error in the customize dashboard layout when a default dashboard exists Web - Fixed the credit card edit component missing a reveal sensitive data button Web - Fixed the entry security analyzer where the "Pwned" password filter was not working Web - Fixed the TOTP window display being broken ** CONSOLE RELEASE NOTES ** FIXES Core - Fixed a regression where SQL-to-DVLS migration silently failed to decrypt User Vault (private) entries, causing users to see empty vaults after migration