Secret Server 12.3.000001 Release Notes
Release Date: On-premises: October 21, 2026
Component Versions
The Distributed Engine, Advanced Session-Recording Agent, and Protocol Handler versions that ship with this release. It does not cover SQL Server, .NET, or operating system requirements, which are in the system requirements documentation.
Distributed Engine and Advanced Session-Recording Agent: 8.6.7.0
Protocol Handler: 6.0.3.59
New Features
Capabilities that did not exist in an earlier release. Modifications to capabilities you already have are under Changes.
Authentication and Access Control
- Manage TOTP permission is a new secret-level permission that lets a user or group manage a secret's TOTP settings without full Edit access.
Delinea Platform Integration
- Migration Readiness Report is a new report, available under Reports, for assessing an instance's readiness for migration.
Discovery and Password Changing
- AliCloud password changer adds remote password changing for AliCloud access keys and RAM console users.
- Google Cloud Platform Console password changer adds remote password changing for GCP Console users. Heartbeat is not supported.
- Nutanix password changers add four remote password changers for Nutanix accounts, including CVM and AHV.
Launchers and Remote Access
- PowerShell launcher is a new launcher type supported by the Protocol Handler on Windows. Its scripts replicate to Disaster Recovery replicas along with the secrets and launchers that use them.
Secrets and Folders
- Required character changes is a new password requirement option that sets how many characters a new password must change from the old one.
Changes
Modifications to behavior that already existed — renamed items, relocated settings, altered defaults, and refinements to existing capability. Entries beginning Action Required: need something from you before or after upgrading. New capability is under New Features; corrections to faulty behavior are under Bug Fixes.
The ID column shows the internal tracking number for each item. You can reference these numbers when contacting Delinea Support.
| ID | Title | Release Notes |
|---|---|---|
| 575805 | Setup File Paths Validated Against Directory Traversal | Setup file paths are now validated to block access to files outside the intended directory. |
| 609349 | Advanced Session Recording Accepts Multiple Agent Callback URLs | Advanced Session Recording now accepts a delimited list of agent callback URLs for failover. |
| 633889 | RDP and SSH Launcher Load Time With Large Lists | The RDP and SSH launchers now load faster when working with large lists. |
| 653291 | Secret Template Export API Returns JSON on Request | The Secret Template export endpoint (GET /api/v1/secret-templates/{id}/export) now accepts a format parameter to return JSON. XML remains the default, so existing integrations are unaffected. |
| 661270 | API Documentation for Metadata Field Filtering | The REST API documentation now states that MetadataType and ItemId are required when filtering by MetadataFieldId. |
| 667567 | German Translations Revised | German user interface translations have been revised for accuracy. |
| 689623 | Bulk Update Secret Fields Supports Dropdown and List Fields | Bulk Update Secret Fields now supports dropdown and list fields. |
| 691064 | Entra ID Password Changing Supports Azure US Government Cloud | Entra ID password changing and heartbeat now support the Azure US Government cloud. Government-cloud secrets require a Distributed Engine from the August 2026 release or later. |
| 692945 | Dependencies Tab Shows a Validation Column | The Dependencies tab now includes a Validation column showing each dependency's pre-run validation result. |
| 697406 | Active Directory Discovery Object Limit per Scan | Action Required: If an Active Directory discovery scan legitimately matches more than 500,000 objects, raise the new Max Objects Per Scan setting or narrow the scan scope. Discovery now stops at this limit instead of exhausting Distributed Engine memory, so larger scans fail until you do. |
| 703926 | Event Pipeline Target Folders Selectable From a Folder Tree | Event pipeline target folders can now be selected from a folder tree as well as by search. |
| 714281 | Password Requirements API Accepts Dictionaries on Create | Password requirements can now be created with password dictionaries assigned in a single API call, instead of a create followed by an update. |
| 719549 | Read-Only Mode Settings Page | Read-only mode settings now have their own page in administration. |
| 729130 | Resilient Secrets Licensing Grace Period | Resilient Secrets replicas now continue to inherit Platform licensing for 21 days after the last successful transfer. |
| 730574 | External Vaults Have a Scope Field | External vaults now have a Scope field, so external secrets that need different permissions can be kept separate. A secret found in more than one vault can be moved between them. |
| 731995 | Numeric Fields Enforce Minimum and Maximum Values | Numeric fields now reject out-of-range values with a clear validation message. |
| 732000 | Whole-Number Fields Reject Decimal Values | Whole-number fields, such as ports, now reject decimal values with a clear error. |
| 732570 | Entra ID Password Changer Retries Transient Failures | The Entra ID password changer now retries transient failures automatically and uses a streamlined Microsoft Graph call, accommodating Microsoft's eventual-consistency changes in Entra ID. |
| 737156 | Upgrade Center Sync Data Step Waits for Prior Steps | In the Platform Upgrade Center, the Sync Data step now stays Pending until every earlier step is Completed or Skipped. |
| 737222 | Upgrade Center Unification Step Text | The unification step text in the Platform Upgrade Center has been updated for the ready-to-start state. |
| 738755 | Azure App Registration Password Changer Waits for Replication | The Azure App Registration password changer now polls for up to 60 seconds for a new credential to take effect before reporting a result, because Microsoft now applies the change asynchronously. |
| 738762, 745691 | AWS IAM Password Changing Supports GovCloud | AWS IAM password changing now supports GovCloud regions, and AWS IAM secret templates include a Region field. A blank region defaults to commercial AWS. |
| 740494 | Built-In Template Fields Encrypted | Built-in secret template fields that previously shipped unencrypted are now encrypted. |
| 740906 | Launcher Key Exchange Supports SHA-512 RSA-OAEP | Launcher key exchange now supports SHA-512 RSA-OAEP encryption, for FIPS 140-3 compliance. |
| 743381 | Upgrade Center Unified Mode Step Retries | The Unified Mode step in the Platform Upgrade Center now retries automatically on failure. |
| 744648 | Secret Exports Can Include Template Name | Secret exports can now include a Secret Template Name column for each secret. |
| 745287 | Platform Active Directory Search Timeout Extended | Active Directory user and group searches in Delinea Platform now allow up to 60 seconds before timing out. |
| 747065 | QuantumLock Password Changes Skip Unrecoverable Key Assignments | QuantumLock password changes now skip key assignments that cannot be recovered and report how many were skipped, instead of failing the entire password change. |
| 747103 | Secret Search With Extended Display Columns | Secret search with extended display columns now runs faster on large instances. |
| 748039 | Resilient Secrets One-Time Password Decryption Failures Reported | When a one-time password record cannot be decrypted, Resilient Secrets now halts the run and names the affected secret on the source, and skips the record and reports it in the log on the replica. |
| 748672 | Unused Database Indexes Removed | Sixty unused database indexes have been removed to reduce database size and speed up writes. |
| 751045 | Failed Sessions Labeled in Session Monitoring | Session monitoring now labels sessions that did not start as "Session failed to launch" and sessions whose recording could not be processed as "Recording processing failed". |
| 751265 | Business User Members Skipped in Platform Role Migration | Business User members are now skipped and reported during Platform role-membership migration. |
| 751354 | FIDO2 Registration Validation | FIDO2 two-factor registration now applies stricter input validation and enrolls more reliably. |
| 753121 | Database Cache Writes on SQL Collation Instances | Database cache writes no longer trigger full table scans on instances that use a SQL collation, which reduces load. |
| 753710 | Secret Search on Instances With Many Secret Items | Secret search now runs faster on instances with large numbers of secret items. |
| 753944 | Upgrade Center Mark Complete Confirmation Text | The Mark Complete confirmation in the Platform Upgrade Center federation step now explains more clearly what completing the step does. |
| 754245 | XML Exports Include Only Referenced Sites | XML exports now include only the sites referenced by the exported secrets and their dependencies, instead of every site configured on the instance. |
| 757893 | Folder-Scoped Secret Search | Secret searches scoped to a folder with many secrets now complete significantly faster, especially on instances with large permission sets. |
Bug Fixes
Defects corrected in this release. Behavior that worked as designed but now works differently is listed under Changes.
| ID | Title | Release Notes |
|---|---|---|
| 523085 | Unix Initial Account Takeover Returns a Generic Error | Fixed an issue where initial account takeover for Unix accounts failed with the generic error "Connection lost due to error 96258" when the selected takeover secret had no stored password or SSH private key. Secret Server now reports the missing credentials immediately and names the secret. |
| 555487 | Engine Changes Passwords After Losing the Response Bus | Fixed an issue where a Distributed Engine that lost connectivity to the Engine Response Bus kept changing passwords it could not report back to Secret Server. The engine now stops processing password changes in that state. |
| 570455 | Proxied RDP Sessions Disconnect on Unicode Keystrokes | Fixed an issue where proxied RDP sessions with recording enabled disconnected when Unicode characters were typed. |
| 572603 | Inactive Users Not Disabled in Domains Without Sync Groups | Fixed an issue where inactive users were not disabled in synchronized domains that had no sync groups specified. The first sync after upgrade may disable long-inactive users in those domains; they are re-enabled at their next login. |
| 575514 | Discovery Fails on Long Domain Names | Fixed an issue where discovery failed when a domain name was longer than 255 characters. |
| 584758 | Access Request Reports Show Incorrect Approval Status | Fixed an issue where reports on secret access requests showed an incorrect status for requests that went through an approval workflow. |
| 613197 | Session Monitoring Search Ignores Default Days | Fixed an issue where the Session Monitoring search page ignored the Default Days setting and queried all session history, causing slow loads and timeouts. Initial results now respect the configured limit. |
| 624056 | Force Check-In API Does Not Honor noAutoCheckout | Fixed an issue where force checking in a secret through the API with noAutoCheckout set to false was not handled correctly. The secret is now checked in and then automatically checked out to the requestor. |
| 627165 | Session Recording Causes Flicker in Launched Applications | Fixed an issue where session recording caused flicker in SAP GUI, WinSCP, and other launched applications. Protocol Handler 6.0.3.54 uses a new composite capture method; GPU-accelerated applications continue to use the previous method, and a Group Policy or configuration setting can revert to it. |
| 630551 | Proxy Sessions Remain Active After Ending Unexpectedly | Fixed an issue where RDP and SSH proxy sessions that ended unexpectedly could remain active on the secret when the SSH proxy inactivity timeout was off. These sessions now time out after five minutes regardless of that setting. |
| 638413 | Bulk Actions Fail on Large Secret Selections | Fixed an issue where bulk actions on very large secret selections failed with an application error. |
| 646030, 744089 | User Audit Log Fails to Load for Large Histories | Fixed an issue where the user audit log failed to load, or timed out, for users with very large audit histories. |
| 654717 | View Session Log Link Missing From Secret Audit | Fixed an issue where the View session log link was missing from the secret Audit tab for recorded SSH proxy sessions. |
| 664036 | SSH Terminal Output Misaligned in Some Clients | Fixed an issue where SSH Terminal output was misaligned in PuTTY, Windows PowerShell, and macOS Terminal. |
| 678559 | Platform Audit Events Missing Target Details | Fixed an issue where Secret Server audit events sent to Delinea Platform were missing target details. |
| 679487 | Active Directory Basic Password Change Fails on Long Passwords | Fixed an issue where the Active Directory basic password change failed when the current or new password was longer than 63 characters. Passwords of up to 256 characters are now accepted. |
| 682885 | Keystroke View Shows Leftover Icon After Playback | Fixed an issue where the full-screen keystroke view in Session Monitoring showed a leftover refresh icon after video playback. |
| 686678 | Keystroke-Only SSH Recordings Missing From Session Review | Fixed an issue where SSH sessions recorded with keystrokes only, without video, did not appear in Session Review. |
| 687206 | FIDO2 Key Registration Fails With a Port in the URL | Fixed an issue where FIDO2 key registration failed on on-premises instances accessed through a URL that included a port number. |
| 688159 | Script Links Open Behind Dependency Dialogs | Fixed an issue where script links in dependency edit dialogs opened behind the dialog. They now open the script details in a new tab. |
| 688411 | Bulk Access Requests Fail for Workflow Secrets | Fixed an issue where requesting access to multiple workflow-enabled secrets through a bulk action failed to load durations and returned an error. |
| 689760 | Event Pipeline Time Filters Spanning Midnight Do Not Trigger | Fixed an issue where event pipelines did not trigger when Event Time filters were combined to span midnight, such as after 18:00 and before 13:00. |
| 690253 | Missing-Targets Banner on Secret Policy Pipelines | Fixed an issue where event pipeline policies applied only to a secret policy showed a banner saying the policy had no targets. |
| 690722 | Site Audit Page Shows Engine Audits | Fixed an issue where the site Audits (Site Log) page showed engine audits instead of site audits. |
| 690866 | Password Type Filter Returns Incorrect Results | Fixed an issue where the password type filter on the All Secrets page returned incorrect results. |
| 693083 | Autofill Works Only on the First URL in a List | Fixed an issue where credentials auto-filled only on the first site in a comma-delimited URL list. Credentials now auto-fill on every listed site, and search by URL matches any URL in the list. |
| 694463 | Ticket Numbers Not Linked in Secret Audit Log | Fixed an issue where the Secret Audit Log did not link ticket numbers to the configured ticket system URL. |
| 694783 | Data Retention Jobs Slow or Failing on Large Tables | Fixed an issue where Data Retention jobs ran inefficiently and could fail on large tables. New indexes make these jobs faster. |
| 696993 | Password Requirement Fields Accept Out-of-Range Values | Fixed an issue where password requirement character-count fields silently changed out-of-range values instead of showing a validation error. |
| 701408 | New Dependency Button Overlaps Other Elements | Fixed an issue where the New dependency button overlapped other elements on the Dependencies tab. |
| 701671 | Discovery Scanner Settings Not Updated on Type Change | Fixed an issue where changing a discovery scanner's base scanner did not show the settings for the newly selected type. |
| 704546 | Misspelling in Engine Update Dialog | Fixed an issue where the engine update confirmation dialog misspelled the word "version". |
| 707269 | API Documentation Link Shows an Outdated Version | Fixed an issue where the REST API documentation link showed an outdated version instead of the installed Secret Server version. |
| 707470 | Password Type API Clears LDAP Connection Settings | Fixed an issue where updating a password type through the API cleared its LDAP connection settings when the field was omitted, breaking OpenLDAP password changers. |
| 707931 | Platform Access Request Emails Show UTC Times | Fixed an issue where access request and approval emails sent from Delinea Platform showed times in UTC instead of the user's time zone. |
| 708834 | Manual Heartbeats Wait for the Next Scheduled Cycle | Fixed an issue where manually run heartbeats waited for the next scheduled cycle, delaying status updates by several minutes. They now go to the engine immediately. |
| 710928 | Personal Folders Not Collapsed by Default | Fixed an issue where Personal Folders did not start collapsed on All Secrets when Unlimited Vault Access was enabled. |
| 711201 | Session Review Missing User for Advanced Session Recording | Fixed an issue where Session Review did not show the user for sessions recorded by the Advanced Session Recording Agent. |
| 713889 | Manual Rolling Upgrade File Download Fails | Fixed an issue where file downloads always failed during a manual rolling upgrade of an on-premises instance. |
| 713900 | Duplicate Login Audit Events With FIDO2 | Fixed an issue where logins using FIDO2 two-factor authentication recorded duplicate Successful Login audit events for local accounts. |
| 714527 | RDP Launch Does Not Prompt for Smart Card | Fixed an issue where RDP launches did not prompt for a smart card when the account required smart card logon. |
| 719523 | Report Downloads Have the Wrong File Name | Fixed an issue where report downloads were named "null.csv" instead of the expected file name. |
| 720872 | Audit Export Drops Oldest Record | Fixed an issue where audit exports dropped the oldest record when PII obfuscation was enabled. |
| 722040 | Action Menu Missing From Secret Title | Fixed an issue where the action menu was missing from the secret title. |
| 723020 | Inaccurate Terminology in Throttle Settings | Fixed an issue where Throttle Settings used inaccurate terminology. |
| 723324 | Approval Minute Durations Reject 24:00 or More | Fixed an issue where Approval Allow Minute Durations did not accept values of 24:00 or greater. |
| 724527 | Alt+Tab and Win+R Not Sent to Remote Machine During Recording | Fixed an issue where Alt+Tab and Win+R did not reach the remote machine on Protocol Handler RDP launches with session recording enabled. |
| 725637 | Rule Subscriber Account Type Filter Shows Wrong Types | Fixed an issue where the Account type filter for inbox rule subscribers showed groups when Users was selected. The list now shows only the selected type: users, groups, or email addresses. |
| 726715 | Heartbeat Status Chart Unreadable in Dark Mode | Fixed an issue where the heartbeat status chart did not display correctly in dark mode. |
| 726989 | Inbox Filter Error on Secret Erase Requests | Fixed an issue where filtering the inbox by your own completed requests returned an error on Secret Erase requests. |
| 727768 | HSM Error Recovery Fails Without Administrator Rights | Fixed an issue where the automatic application pool recycle after an HSM error failed on on-premises servers when the application pool account was not a local administrator. Secret Server now falls back to an in-process recycle that needs no elevated permissions. |
| 728493 | Discovery Domain Scope OUs Not Displayed by Default | Fixed an issue where organizational units did not appear in the discovery Domain scope dialog until search text was typed and cleared. |
| 729278 | User Management Audit Filter Defaults to Select One | Fixed an issue where the User Management audit scope filter defaulted to "Select One" instead of "All" on first load. |
| 730189 | Bulk Operations Tooltip Shows the Wrong Value | Fixed an issue where hovering any cell on the Bulk Operations page showed the bulk action name. The tooltip, and screen readers, now give the value of the hovered cell. |
| 732162 | Dependency Scripts Ignore the PowerShell Core Setting | Fixed an issue where dependency changer and pre-run validation scripts ignored the Use PowerShell Core setting. |
| 732199 | Validate and Save Overwrites Dependency Script | Fixed an issue where clicking "Validate & Save" on a dependency with a separate pre-run validation script overwrote the dependency's own script and arguments with the validation script's. The dependency then ran the wrong script. |
| 732718 | Disaster Recovery Log Shows Wrong Replica Version | Fixed an issue where the Disaster Recovery activity log showed an incorrect replica version after replication. |
| 732728 | Data Storage Path Shown on Cloud Disaster Recovery | Fixed an issue where, in Secret Server Cloud, the Disaster Recovery configuration showed a Data Storage Path field that did not save. The field no longer appears on cloud instances. |
| 732880 | XML Import Audited as Successful When It Failed | Fixed an issue where XML secret imports were audited as successful when they had failed. The audit log now records the true result, including how many items were imported and why any failed, and imports that fail before processing any item are audited too. |
| 733380 | Event Pipeline Allows Only One Filter per Type | Fixed an issue where an event pipeline could not have more than one filter of the same type. |
| 733547 | RDP Proxy Error When a Target Rejects CredSSP | Fixed an issue where the RDP proxy returned an unclear internal error when a target rejected CredSSP authentication. It now returns a clear, actionable error. |
| 733865 | Discovery Account Locked Out by a Password Change | Fixed an issue where a discovery account could be locked out when its password was changed while discovery was running. A new opt-in setting defers password changes on discovery credential secrets until discovery finishes. |
| 734289 | Windows Local Accounts Scanner Template Cannot Be Edited | Fixed an issue where editing the Windows Local Accounts discovery scanner template failed with an error. |
| 734454 | Entra ID Discovery Finds No Accounts | Fixed an issue where Entra ID discovery completed with no results instead of importing discovered roles and accounts. |
| 735199 | Add and Add From External Dialogs Show the Same Users | Fixed an issue where the Add and Add from External user dialogs showed the same list of users. |
| 735326 | Disaster Recovery Fails With Many File Attachments | Fixed an issue where Disaster Recovery replication failed on vaults with very large numbers of file attachments. |
| 735383 | Discovery Source Creation Blocked by a False Duplicate | Fixed an issue where creating a discovery source was blocked because its name resembled an existing source. When a name is genuinely in use, the error now identifies the conflicting discovery source. |
| 735397 | Favorites From the Secret Detail View Missing | Fixed an issue where secrets favorited from the secret detail view did not appear in all favorites menus. |
| 736621 | Database Deadlocks Under Checkout Load | Fixed an issue where expired-checkout processing and concurrent secret checkouts caused database deadlocks under load. |
| 737576 | Distributed Engine Crash During Recorded SSH Proxy Sessions | Fixed an issue where large output bursts in recorded SSH proxy sessions crashed the Distributed Engine and dropped all active proxy sessions. |
| 737640 | Launch Dialog Flashes a Permissions Warning | Fixed an issue where the launch dialog briefly flashed a permissions warning when opening. |
| 737661 | Script Views Not Audited | Fixed an issue where viewing a script did not write a View audit entry. All read paths, including the web interface and APIs, are now audited. |
| 737767 | Disabled Users Cannot Be Removed From Groups Through the API | Fixed an issue where disabled users could not be removed from groups through PATCH /api/v1/groups/{id}/users. The allowInactiveUsersUpdate field is now ignored. |
| 738793 | SSH Password Changer Authenticate As Section Hidden | Fixed an issue where the Authenticate As section of the SSH password changer was hidden when SSH password authentication was disabled, blocking key, username, and passphrase configuration. |
| 738954 | Manual Upgrade ZIP Download Fails | Fixed an issue where the Manual Upgrade wizard on on-premises instances failed to download application ZIP files larger than 700 MB. |
| 739343 | Ticket System Parameters Marked Required | Fixed an issue where Ticket System Parameters on secret templates were incorrectly marked as required. |
| 739543 | Unix and AIX Takeover Imports Fail Initial Takeover | Fixed an issue where accounts imported by Unix and AIX sudo takeover rules failed initial password takeover. |
| 739576 | Web Session Recordings Truncated in the Browser | Fixed an issue where web session recordings appeared truncated when played in the browser, even though the downloaded file was complete. |
| 739684 | Disaster Recovery Replicas Stuck Requiring a Handshake | Fixed an issue where Disaster Recovery replicas could get stuck requiring a handshake after a failed start. |
| 740318 | Discovery Misreports Local Admin Rights | Fixed an issue where the discovery network view showed Local Admin Rights as No for local administrator accounts. |
| 740686 | Password Changer Test Shows a Stale Success Message | Fixed an issue where the password changer Test dialog showed a stale success message after a failed test. |
| 740734 | Folder Permission API Fails for Deactivated Users | Fixed an issue where folder permission API calls for deactivated users returned success without making a change, or failed with a server error. |
| 741217 | Secret Key Rotation Status Stops Updating | Fixed an issue where the Secret Key Rotation status stopped updating when polling timed out. A message now appears, and refreshing the page resumes polling. |
| 742048 | Import Accounts Template Selection Error | Fixed an issue where selecting a secret template in Import Accounts failed with a script error. |
| 742095 | SAML Certificate Changes Not Audited | Fixed an issue where SAML certificate additions and replacements were not recorded in the SAML audit log. |
| 742103 | Discovery Rules Account Info API Error | Fixed an issue where GET /api/v1/discovery/rules/accounts/info/{secretTemplateId} returned a server error for templates without a password type. |
| 742601 | SSH Proxy Records Keystrokes With Recording Disabled | Fixed an issue where SSH proxy sessions recorded keystrokes when session recording was disabled. |
| 742631 | Duplicate Validation Messages on Numeric Fields | Fixed an issue where numeric fields showed two overlapping validation messages for the same error. |
| 742647 | Secret Template Permissions Lost When Filtered | Fixed an issue where saving secret template permissions while a search filter was active removed permissions hidden by the filter, such as a group's Template Owner permission. |
| 743383 | My Secrets Card View Expand State Not Announced | Fixed an issue where the expand and collapse controls in the My Secrets card view did not convey their state to screen readers. |
| 744028 | AD Password Rotation Fails for Protected Users Accounts | Fixed an issue where Active Directory password rotation failed for Protected Users accounts on Windows Server 2022 domain controllers after Distributed Engine 8.4.98.0. |
| 744042 | Entra ID Heartbeat Fails Under Location Conditional Access | Fixed an issue where Entra ID heartbeat marked accounts as failed when a location-based Conditional Access policy blocked the sign-in. |
| 744068 | View Secret Templates Permission Cannot Load Template Tabs | Fixed an issue where the View Secret Templates permission could not load the Fields and Mapping tabs without Administer Secret Templates. |
| 744144 | Undecryptable Session Recordings Play as Garbled Video | Fixed an issue where session recordings that could not be decrypted played as unplayable or truncated video. Playback now reports a clear error, and decryption failures are logged with more diagnostic detail. |
| 744511 | Session Connector With a Custom Launcher Fails | Fixed an issue where Session Connector launches that wrap a custom launcher failed with an error. |
| 745734 | Web Password Filler and Credential Manager Recordings Fail to Play | Fixed an issue where session recordings from Web Password Filler and Credential Manager failed to play with a "too short to make a video" error. |
| 746257 | Session Recording Agent Check-Ins Slow and Failing | Fixed an issue where, in Secret Server Cloud, session recording agent check-ins were slow and frequently failed under heavy load. |
| 747026 | Amazon IAM Key Password Type Cannot Map to Console Template | Fixed an issue where the Amazon IAM Key password type could not be mapped to the Amazon IAM Console Password template. The region mapping is now optional. |
| 747053 | Session Recording Player Controls Overlap the Session Log | Fixed an issue where session recording player controls overlapped the session log when the player was maximized. |
| 747073 | Cloud Subscriptions Page Shows a Negative Engine Maximum | Fixed an issue where, in Secret Server Cloud, the Engines (Default Site) row on the Cloud Subscriptions page showed a maximum of -2147483648 and warned when usage was within the limit. |
| 747077 | Closing a Dashboard With the Password Rotation Widget Errors | Fixed an issue where closing a dashboard that contained the password rotation widget triggered an error. |
| 747281 | Discovery-Imported SSH Takeover Secrets Fail Password Changes | Fixed an issue where discovery-imported SSH takeover secrets failed ongoing password changes. |
| 747387 | Application Pool Crash During Proxied Session Recording | Fixed an issue where a race condition in SSH and RDP proxy session recording could crash the Secret Server application pool and disconnect users. |
| 747586 | Ticket System Validation Runs Twice | Fixed an issue where ticket system validation ran twice per comment or checkout submission, creating duplicate entries in the ticket system. |
| 747767 | RDP Proxy Launch With a Blank Host Returns a Misleading Error | Fixed an issue where launching a proxied RDP secret with no host returned a misleading database version error. It now returns a clear machine-required error. |
| 748364 | Template Filter List Expands to Full Screen Height | Fixed an issue where the secret template filter list on the RPC tab expanded to the full height of the screen. |
| 748396 | Site Renames Not Replicated to Disaster Recovery | Fixed an issue where site renames were not replicated to Disaster Recovery replicas. |
| 748559 | Resilient Secrets Replicates Invalid Entra ID Domain Values | Fixed an issue where Resilient Secrets wrote invalid tenant, client, and secret values into a replicated Entra ID domain that uses a sync secret. |
| 749608 | Dependency Bulk Changes Fail on Checkout or Approval Secrets | Fixed an issue where, in Secret Server Cloud, secret dependency bulk changes failed on secrets that require checkout or approval. |
| 749626 | Session Connector Produces Corrupted RDP Files | Fixed an issue where RDS applications launched through the Session Connector produced .rdp files reported as corrupted. |
| 749634 | SOAP Checkout Status Returns Invalid User | Fixed an issue where, in Secret Server Cloud, the SOAP GetCheckOutStatus call returned "Invalid user" despite a valid token. |
| 750862 | SSH Terminal and RDP Proxy-Credential Sessions Missing From Session Review | Fixed an issue where SSH Terminal sessions and RDP proxy-credential sessions did not appear in Session Review. |
| 750865 | Secret Exports Missing Template Name for Inactive Templates | Fixed an issue where secret exports left the Secret Template Name column empty for secrets based on inactive templates. |
| 751029 | Secret Sharing Permissions Lost When Filtered | Fixed an issue where saving Secret Sharing with an active search filter removed users or groups hidden by the filter. |
| 751096 | Entra ID Heartbeat Fails Without Revocation Endpoint Access | Fixed an issue where Entra ID heartbeats failed when the engine host could not reach a certificate revocation endpoint (CRL or OCSP). Revocation checks are still enforced in FIPS mode. |
| 751298 | Changing a Dashboard Widget Report Returns an Error | Fixed an issue where changing the report on a dashboard widget returned an error. |
| 751310 | Manage Metadata Button Does Not Open in Platform | Fixed an issue where the Manage Metadata button on a secret did not open the Metadata page in Delinea Platform. |
| 751314 | FIDO2 Sign-In Fails With an Intermittent Signature Error | Fixed an issue where signing in with a FIDO2 security key intermittently failed with an invalid signature error. |
| 751460 | Folder-Scoped XML Exports Missing Secret Templates | Fixed an issue where folder-scoped XML exports had an empty Secret Templates section. They now include the templates used by the exported secrets. |
| 752156 | CSV Import Ignores Create Secret Template Permission | Fixed an issue where CSV secret import allowed secrets to be created on templates the user lacked Create Secret permission for. Import now lists and accepts only templates the user can create secrets on. |
| 752254 | Spelling Errors in the User Interface | Fixed an issue where user interface text contained a number of spelling errors. |
| 752947 | Platform Users Lose Permissions on Replicas During an Outage | Fixed an issue where Platform users on a Resilient Secrets replica could lose all permissions while Delinea Platform was unreachable. They now keep their last known permissions. |
| 752980 | Incorrect Message for Missing Group Vault Settings | Fixed an issue where an incorrect message was shown when vault settings for a group could not be found. |
| 753129 | Shifted Keystrokes Misrecorded in RDP Proxy Sessions | Fixed an issue where RDP proxy keystroke transcripts recorded shifted symbols as their unshifted key and uppercase letters as lowercase. Mixed-case input and shifted symbols are now recorded correctly and remain searchable, and command-key combinations are kept out of the transcript. |
| 753968 | SSH Terminal Shows a Placeholder Instead of the Company Name | Fixed an issue where SSH Terminal and proxy messages showed an unsubstituted placeholder instead of the product and company names. |
| 756437 | Nutanix Credential Rejections Logged as Success | Fixed an issue where Nutanix CVM and Prism Central password changes rejected for invalid or insufficient credentials were logged as successes instead of errors. |
| 756673 | Allow-List URLs With Commas or Mixed Case Do Not Match | Fixed an issue where web launcher and autofill allow-list entries did not match when a URL contained a comma or was saved in mixed case. |
| 757875 | Task Identifier Column Error on Bulk Operations | Fixed an issue where adding the Task Identifier column to the Bulk Operations page from the column selector caused a display error. |
| 757919 | Raw HTML in the Install New License Dialog | Fixed an issue where the Bulk Entry example in the Install New License dialog and the description on the Data Retention page displayed raw HTML. |
| 768749 | SAML and OpenID Connect Users Cannot Register or Use FIDO2 Keys | Fixed an issue where users who signed in through SAML or OpenID Connect and used a FIDO2 security key as their second factor could not register the key or complete sign-in, and were returned to the login page. |
