Devolutions Server Versionen

• Added an option in the Local to Cloud migrator to set the Devolutions Cloud workspace as the default workspace after migration.
• Improved session tabs: reopening last sessions keeps tab order and the active tab, the docked navigation pane appears in the tab list, and closing a background session no longer steals focus from other applications.
• Improved the auto-hidden navigation pane to focus the filter box when opened, if the filter is placed in the navigation pane.
• Improved the network tools (Ping, Traceroute, Port scan, Diagnose, WHOIS and others) with faster host name resolution, clear errors for unknown hosts and a steady ping interval.

• Fixed auto-typing the username or password not reaching the embedded session.
• Fixed Cisco AnyConnect VPN sometimes losing the password because it was typed before the prompt appeared.
• Fixed collapsed (auto-hide) panes, such as the navigation pane, missing a separator line.
• Fixed deleting old backups showing an unnecessary error when a backup folder could not be removed, for example while OneDrive was syncing.
• Fixed embedded RDP sessions switching to full screen leaving a stray window, and the full-screen toolbar's "Restore" and "Embedded" buttons not working.
• Fixed entries appearing duplicated in the navigation tree when a vault was loaded from the offline cache.
• Fixed keyboard shortcuts not working for open modes unpinned from the Open with parameters submenu.
• Fixed PowerShell sessions in Windows Terminal or the embedded console garbling the display when recalling command history with the resize window option on.
• Fixed pressing Enter a second time with "Filter the tree list only on Enter key press" not opening the highlighted entry.
• Fixed Proton Pass sign-in failing when a CAPTCHA was required; a verification window now opens to complete it.
• Fixed repeated or duplicate browser sign-in prompts for DVLS workspaces behind an Entra ID pre-authentication proxy.
• Fixed some issue where embedded RDP sessions kept memory after their tab was closed.
• Fixed SSH sessions using an SSH key breaking when terminal compression was enabled.
• Fixed text boxes selecting all their text when a dialog opened or after switching back to RDM with Alt+Tab.
• Fixed the desktop extension's passkey sync prompting for the password of locked vaults.
• Fixed the DVLS workspace username prompt requiring a password when only a username was needed.
• Fixed the keyboard focus indicator not showing on the default button of prompts, or after switching back to RDM.
• Fixed the Launcher's sub menus showing some options that are not available in it.
• Fixed the main window title no longer showing the active tab title, and restored the application name in dialog window titles.
• Fixed the offline sync settings for documentation and documents not inheriting from higher folders when a folder was set to Default.
• Fixed the request vault access list showing no vaults for DVLS workspaces on newer servers.
• Fixed the spreadsheet editor in document entries, which no longer blocks the interface while an Excel file loads.
• Fixed the Windows credential prompt not being centered when launching an embedded RDP session.

Server

• Core - Added an option to import legacy roles that were not created during migration, allowing them to be used in role assignments.

Console

• Made a minor update.

Server

• Core - Fixed integration secrets in data source settings being visible to users without administrative permissions.
• Core - Fixed an issue where low-privileged users could restore and permanently delete vault attachments through attachment history.
• Core - Fixed authentication and session tokens being stored unencrypted in the database.
• Gateway - Fixed a security issue where any authenticated user could obtain a network scan token and access internal network information.
• Core - Fixed missing access controls that allowed users without the required permissions to read or save System Vault entries.
• Core - Fixed a security issue where the legacy partial login endpoint accepted and retained client-supplied session identifiers after authentication.
• Core - Fixed a SQL injection vulnerability in the database backup path setting.
• Core - Fixed the Microsoft Entra ID application secret being exposed in URL query strings when retrieving groups and role templates.
• PAM - Fixed the legacy WinRM client mode ignoring the "Skip TLS certificate validation" setting and always skipping certificate validation for HTTPS hosts.
• PAM - Fixed domain controller detection occurring before the Devolutions Gateway ruleset was enforced, allowing network traffic to bypass the ruleset and gateway logging.
• Core - Fixed an error when filtering or sorting Administration logs by user on SQL Server databases using case-sensitive collation.
• Core - Fixed the "dvls-admin" user on Basic installations being able to bypass the required password change by closing the browser.
• Core - Fixed the Public API returning a 404 error instead of a 400 error for malformed request bodies.
• Core - Fixed users without System Vault entry edit permission being able to edit System Vault entries through their regular entry permissions.
• Gateway - Fixed an issue where "Force Gateway rulesets" could be bypassed when a connection explicitly targeted a physical gateway.
• Gateway - Fixed rejected Devolutions Gateway certificates being incorrectly reported as unreachable domain controllers in Active Directory domain configurations.
• PAM - Fixed Active Directory and Windows providers being unable to use a Devolutions Gateway in LDAPS mode with an already trusted certificate.
• Web - Fixed notification settings not being saved when exactly two available actions were selected.
• Web - Fixed renamed custom field titles not being retained when confirmed with the checkmark in the entry edit dialog.
• Web - Fixed trailing spaces being saved in tags and "Exact expression" notification subscription filters despite appearing to be removed in the interface.
• Web - Multiple UI fixes.

• Added options to customize the selected tab's accent color and thickness in the Tabs options.
• Enforced going through the required check-out when revealing sensitive fields of information type entries such as credit cards.
• Improved "Submit a support ticket" so screenshots and files can be attached (or pasted with Ctrl+V), and the main application stays usable while the window is open.
• Improved context menus with a more compact item height that matches the ribbon menus.
• Improved the SSH session monitoring bar, which now shows the host, CPU, memory and swap, upload and download rates, uptime, logged-in users and disk usage, with details in tooltips.

• Fixed a comment in a PowerShell entry's embedded script preventing all of the following commands from running.
• Fixed a forced default status message being saved as empty when editing an entry, and the status message being editable on pending approval entries without the required permission.
• Fixed an embedded RDP session turning white when switching back to its tab.
• Fixed an expired check-out on DVLS releasing the user's still-active check-out of the same entry, and the navigation tree and ribbon not refreshing when a check-out expires.
• Fixed clearing an AI Assistant chat open in an undocked window: the cleared window now closes and focus moves to the empty chat instead of duplicating it.
• Fixed clicking anywhere in the auto-hidden navigation bar no longer prompting the navigation pane.
• Fixed closing an RDP session in a background tab switching away from the active session and breaking auto focus.
• Fixed dismissing a warning on the dashboard overview reloading the whole dashboard.
• Fixed double-clicking a cell in a password list copying the value of the wrong column after the columns were reordered.
• Fixed EC2 instances not loading in the AWS console entry.
• Fixed embedded sessions not receiving keystrokes after switching back to the application or clicking an SSH or Telnet session toolbar button, until the session was clicked again.
• Fixed filtering the navigation tree hiding the sub-entries of matching entries.
• Fixed GitHub Enterprise users seeing no Copilot models and being unable to use the AI Assistant after signing in.
• Fixed images in Markdown documentation not appearing until the viewer was resized.
• Fixed new Word (.docx) documents showing white text on a white page in the dark theme.
• Fixed searching in the User vault and System vault not automatically selecting the first matching entry.
• Fixed security keys not being supported when logging in to Keeper.
• Fixed several dashboard action buttons not running with the correct context.
• Fixed the "Last opened entries" prompt at startup blocking the rest of the application until it was closed.
• Fixed the entry dashboard switching back to a default tab instead of keeping the tab you had selected.
• Fixed the navigation pane sliding out behind open sessions when revealed in auto-hide mode.
• Fixed the navigation tree losing its selection, and the dashboard reloading, when revealing an auto-hidden navigation pane.
• Fixed the navigation tree sometimes loading with an expanded root folder that appeared empty.
• Fixed the option to auto-focus the navigation tree item when selecting a tab not working for website, CyberArk and AI sessions.
• Fixed the system setting that prompts for two-factor authentication before going offline being ignored.
• Fixed the Up and Down arrow keys not moving through the navigation tree's results while typing in the tree filter prompt.
• Fixed tile vertically layout not splitting sessions into equal-sized windows when opening multiple entries.
• Fixed unpinned navigation bar panels, such as the vault selector, opening at the wrong size.
• Fixed website entries using an SSH tunnel, including over Devolutions Gateway, failing to load because the application's website proxy setting overrode the tunnel's proxy.
• Fixed yes/no warnings, such as the one shown when launching multiple entries, opening without a default button selected.

• Added a group policy to control the clipboard clearing delay.
• Added an option to move the quick search box from the title bar to the status bar.
• Added the "Offline security" panel to the launcher options, so enhanced offline security can be configured when a workspace requires it before sign-in.
• Improved Microsoft SQL Server workspaces by restoring connection pooling with Windows authentication, with clearer messages when the connection fails.
• Improved session tab behavior, so tabs size consistently, resist accidental undocking while dragging, and stay in sync with the Tab list pane.
• Improved the CyberArk error message shown when an account has no connection component available, instead of failing silently.
• Improved the ribbon to be more compact, moving overflowing groups into a popup.

• Fixed a crash when closing the undocked session tab menu.
• Fixed being prompted twice for the email address when signing in to a Devolutions Account.
• Fixed browsing SecureCRT session names raising an error instead of opening the session browser.
• Fixed copy actions being hidden on the credential and data entry dashboards.
• Fixed CyberArk single sign-on failing.
• Fixed docking the navigation pane into the session tab area.
• Fixed embedded web views losing their state when a session tab was undocked or re-docked.
• Fixed entry names containing square brackets being truncated in the navigation tree.
• Fixed ProtonPass login failing.
• Fixed re-docked session tabs being forced to the first index.
• Fixed session recording producing blank captures for SSH and Telnet sessions.
• Fixed session tabs starting an unwanted drag and undocking themselves after a missed mouse button release.
• Fixed switching the active icon buttons inside fields not working when pressing the tab key.
• Fixed terminal sessions losing keyboard focus after the multi-line paste warning was dismissed.
• Fixed the background color of the Quick start page.
• Fixed the embedded web browser resizing its page when hovering a link; the link target now appears in the browser's own status bar when that option is enabled.
• Fixed the entry tree scrolling back to the selected entry every time it refreshed.
• Fixed the error shown when opening the current page of an embedded web session in an external browser, which now uses the system default browser.
• Fixed the File Explorer session being unable to navigate to shared network paths.
• Fixed the filter results popup not appearing when the navigation pane was hidden.
• Fixed the PIN requirement prompt reappearing on Devolutions Cloud workspaces when the configured iteration count was below the minimum the workspace requires.
• Fixed the ribbon height to match the previous version's layout.
• Fixed the universal installer shipping only the build machine's native components, leaving other architectures without the components they need.
• Fixed unpinned auto-hide panels opening with the wrong dimensions.
• Fixed Windows Terminal sessions closing when the session lost focus.

Server

• Core - Password generation now honors custom characters defined in Devolutions Cloud password policies.
• Core - Updated Public API vault type filters to correctly filter PAM vaults.
• PAM - Gateway rulesets are now enforced before detecting the domain controller.
• PAM - PAM license auto-assignment now considers provider-level role permissions.
• Web - Users can now launch sessions without the "View password" permission.

Server

• Core - Fixed an issue where Devolutions Send attachments were incorrectly limited to 1 MB instead of 30 MB.
• Core - Fixed an issue where Devolutions Send emails were not sent from Remote Desktop Manager.
• Core - Fixed an issue where Devolutions Send failed from Remote Desktop Manager when DVLS did not have a valid license.
• Core - Fixed an issue where moving a single entry to another vault placed it at the vault root instead of preserving its source folder.
• Core - Fixed an issue where non-admin users did not receive the "Warn if already opened" prompt and closed RDP sessions remained marked as open.
• Core - Fixed an issue where privileged account entries with a missing provider link loaded indefinitely without feedback.
• Core - Fixed an issue where roles assigned to the "Everyone" user group were not applied to all users.
• Core - Fixed an issue where scheduled Active Directory synchronization did not work with linked vault credentials.
• Core - Fixed an issue where the "Allow drag and drop" setting remained set to "None" and "Primary workspace owner" was not applied.
• Core - Fixed an issue where trailing spaces were saved in tags and the "Exact expression" notification subscription parameter.
• Core - Fixed Domain authentication and PAM Domain Provider failures after an upgrade when the domain controller's LDAPS certificate was not trusted by the DVLS server.
• Core - Fixed errors when granting permissions to user groups.
• Core - Fixed intermittent Linux build failures in the CI pipeline.
• Core - TLS certificate validation is now enforced when connecting to Active Directory.
• Gateway - Fixed an error when trusting a gateway certificate on DVLS running under Kestrel.
• Gateway - Fixed an issue with certificates stored in the Windows certificate store.
• Multiple UI fixes.
• PAM - Fixed a TLS certificate error when browsing containers from the quick start.
• PAM - Fixed an error when browsing domain containers during a quick scan.
• PAM - Fixed an incorrect launcher message when a contractor lacked the required permissions on a PAM vault or entry.
• PAM - Fixed an issue when assigning an Active Directory user as a reviewer.
• PAM - Fixed an issue where moving an entry to a vault failed when the destination path was a folder.
• PAM - Fixed an issue where the PostgreSQL provider was missing from the quick start.
• PAM - Fixed an issue where updating a provider's managed account corrupted its password.
• PAM - Fixed an issue where usage policies could be bypassed using inherited credentials.
• PAM - Fixed the Import button activation in delta scan results.
• Web - Fixed a scrolling issue on the PAM providers page.
• Web - Fixed a WebSocket connection leak when terminal sessions were closed by the server.
• Web - Updated the Telnet web client to fix terminal teardown and resizing issues.

Console

• Fixed Basic Console installation failures caused by an unsupported bundled SQL Server installer version.

• Added a "customize dashboard actions" screen in the dashboard options, to choose which action buttons appear on each kind of entry dashboard.
• Added support for the proxy excluded list in website entries, so addresses listed there now bypass the proxy in the embedded browser.
• Improved Devolutions Cloud workspace responsiveness.
• Improved the all-vaults search field with arrow-key navigation through results and context menu options that reflect the current state.
• Improved the CyberArk account selection dialog so the search filter queries the server across every page instead of filtering only the page on screen.
• Improved the privileged access management (PAM) managed account card to read "Checked out by me" when the current user is the one holding the checkout.

• Fixed "Don't show again" on a Devolutions Cloud system message not being remembered.
• Fixed a crash when the recording indicator was shown on a session tab more than once.
• Fixed a possible crash after closing an RDP, VNC or iLO session opened in a tab.
• Fixed a possible crash when opening a popup menu on Windows Server 2019 and Windows 10 1809.
• Fixed application freezing on the startup screen when opening a DVLS workspace with no internet connection.
• Fixed clicking a workspace in the workspace selector while a filter is active doing nothing instead of switching to it.
• Fixed duplicate root creation errors caused by one vault's root entry being adopted while loading another vault.
• Fixed errors and long freezes when closing RDM.
• Fixed folders in the tree view ignoring the sort priority set on them, so they sorted alphabetically instead of ahead of lower-priority folders.
• Fixed Keeper SSO login.
• Fixed pressing Enter in the search filter not launching the selected entry.
• Fixed RDP sessions failing to open when the selected ActiveX RDP version is unavailable; RDM now falls back to a version that is installed.
• Fixed the "Recovery key expiring" dashboard banner appearing for Devolutions Cloud owners who had already generated a real recovery key; it now shows only while the temporary key from setup is still in use.
• Fixed the automatic flag as closed cleanup.
• Fixed the keep tab on disconnect setting being ignored by SSH sessions, whose tab closed anyway when the session ended.
• Fixed the Keep tab opened on disconnect setting being ignored on terminal entries and when inherited from a parent folder.
• Fixed the navigation pane minimum width being too large.
• Fixed website sessions so the tab menu's "New tab" and "Close tab" work.

Server

• Core - Added a new encryption format for RDM export files.
• Core - Added a one-time self-service extension for expired trials.
• Core - Added custom user tags for filtering, sorting, reporting, and conditional access.
• Core - Added granular administrative roles for more precise permission management.
• Core - Added individual forbidden password rules with configurable matching modes.
• Core - Added PostgreSQL support as a Devolutions Server database backend.
• PAM - Added an option to keep Microsoft 365 and Active Directory JIT accounts between checkouts.
• PAM - Added self-rotation for PAM provider credentials.
• PAM - Added the ability to extend active PAM checkouts without checking in and requesting access again.
• PAM - Merged PAM and shared vaults, allowing PAM credentials to be stored in regular high-security vaults.
• Web - Added a compact kiosk view displaying web-launchable sessions as tiles.
• Core - Added a setting to configure how long log files are retained on disk.
• Core - Added checkout support for folders and multiple selections.
• Core - Added expiration dates for user accounts.
• Core - Added missing Remote Desktop Manager variables so scripts and entries now resolve them correctly.
• Core - Added paging for large Active Directory group lists used by automatic user creation filters.
• Core - Added SSH key support to Bitwarden synchronization.
• Core - Added the ability to check out linked entries directly from the overview.
• Core - Hidden the "Submit a support ticket" action when internet features are disabled.
• Core - Imports now warn about entries with forbidden or policy-violating passwords instead of blocking them.
• Core - Improved performance when moving entries to vaults containing thousands of entries.
• Core - Improved support for vault templates when saving system settings.
• Core - Linked credentials are now automatically checked out when used.
• Core - Prevented connection logs linked to session recordings from being archived or purged.
• Core - Removed unusable PSU licenses from the interface.
• Core - Trimmed leading and trailing spaces from usernames during emergency login.
• PAM - Added a dedicated permission for manually creating PAM accounts.
• PAM - Added an option to skip TLS validation for the Windows provider.
• PAM - Added AnyIdentity provider support through Devolutions Gateway and on Linux using cross-platform PowerShell remoting.
• PAM - Added on-demand account discovery directly from the PAM providers list.
• PAM - Added visibility of inherited checkout policy values.
• Web - Added a session recording log viewer with an activity timeline.
• Web - Added support for DVLS Privileged Account credentials.
• Web - Added the "Allow password in variable" security setting to username and password credentials.
• Web - Added the ability to delete multiple attachments at once.
• Web - Added the ability to download multi-part session recordings as a single ZIP file.
• Web - Added the ability to run saved Scripts/Macros entries in web PowerShell and SSH terminals.
• Web - Added the ability to run scripts in PowerShell sessions opened through Devolutions Gateway.
• Web - Converted legacy Website entries to the current entry type.
• Web - Improved AI Assistant answer and approval prompt positioning.
• Web - Improved the search and advanced search experience.
• Web - Refreshed the user menu side panel layout.
• Web - Restored ticketing administration for Jira, ServiceNow, and HaloPSA.

Server

• Core - Fixed a SQL timeout when renaming folders containing more than 3,500 entries.
• Core - Fixed administrators being unable to reset a contractor's password.
• Core - Fixed an issue where moving entries between vaults failed and could break linked credentials.
• Core - Fixed an issue where moving entries to another vault no longer worked.
• Core - Fixed an issue where the "Force MFA" setting could remain enabled after migrating from SQL to DVLS with no way to disable it.
• Core - Fixed an issue where the server could remain permanently in maintenance mode after an interrupted maintenance run.
• Core - Fixed automatic database retention cleanup not running when using a non-English SQL login.
• Core - Fixed contractors being able to change or remove their own 2FA configuration without re-entering their password.
• Core - Fixed database upgrades timing out during long-running steps, particularly on Azure SQL.
• Core - Fixed notification preference emails containing a mix of translated and English text.
• Core - Fixed partially translated email notifications and improved their date formatting.
• Core - Fixed renamed folders and their contents disappearing from the connection tree.
• Core - Fixed scheduled database retention incorrectly archiving or purging records within the configured retention period.
• Core - Fixed support ticket submissions reporting success without creating a support case.
• Core - Fixed the offline synchronization document size limit exceeding the value supported by Remote Desktop Manager.
• Core - Fixed the scheduler service crashing when a custom log retention policy contained invalid values.
• Core - Fixed the User column appearing blank in Global Open Sessions when Remote Desktop Manager was connected to a Devolutions Server data source.
• Core - Fixed ticket prompts accepting free-form text when an existing ticket was required.
• Core - Fixed user vault entry errors after migrating a SQL data source to DVLS.
• Core - Fixed vault and folder password complexity policies being displayed as inherited without being enforced.
• Core - Harmonized checkout and check-in behavior across platforms.
• Gateway - Fixed an error when trusting a Devolutions Gateway certificate on Kestrel-hosted instances.
• Gateway - Fixed incorrect gateway host and port resolution for native iLO and SQL Server sessions.
• Gateway - Fixed session recording failures for Active Directory Console entries using a Devolutions Gateway farm.
• Gateway - Fixed session recordings being larger than expected because configured frame rate and resolution settings were ignored.
• PAM - Fixed accounts incorrectly appearing as Out of sync in Remote Desktop Manager.
• PAM - Fixed Active Directory discovery, OU browsing, and group lookups failing with trusted domain controller certificates.
• PAM - Fixed Active Directory TLS certificate validation and trusted certificate issues affecting discovery, OU browsing, and group retrieval.
• PAM - Fixed an error when filtering containers during account discovery.
• PAM - Fixed an issue where Active Directory account discovery returned no accounts for child domains when the forest root was unreachable.
• PAM - Fixed an issue where moving a PAM entry to a folder in another vault failed.
• PAM - Fixed checkouts not expiring and scheduled password rotations not running when many accounts were checked out simultaneously.
• PAM - Fixed Cisco and MySQL password reset providers being uneditable after creation and restored the Cisco username field.
• PAM - Fixed PAM account lifecycle and checkout policies being creatable without a valid PAM license.
• PAM - Fixed PAM accounts incorrectly appearing as "Out of sync" in Remote Desktop Manager.
• PAM - Fixed the "Automatically check in PAM account" setting displaying the wrong value.
• PAM - Fixed the total checkout time being displayed incorrectly when an account was automatically checked in.
• PAM - Fixed the View and Copy one-time password actions being unavailable in Remote Desktop Manager for checked-out PAM accounts with OTP configured.
• PAM - Fixed users with a PAM provider role losing access to the Privileged Access section.
• Web - Fixed closing a session from the kebab menu redirecting to Administration > Vaults instead of the current vault, and corrected the disconnect message.
• Web - Fixed entries disappearing from the Connections tree when moved by drag and drop while a filter was active.
• Web - Fixed long entry names being truncated in the Sessions tree and hiding the session recording indicator.
• Web - Fixed Telnet sessions terminating unexpectedly.
• Web - Fixed terminal sessions leaving network connections open after being ended from the server side.
• Web - Fixed the "Find by name (user vault)" dialog displaying irrelevant results when no entry matched.
• Web - Fixed the Connections tree not refreshing after deleting an entry while a filter was active.
• Web - Fixed the Credentials dropdown offering "Linked (cross vault)" for user vault entries when the option was disabled.
• Web - Multiple UI fixes.

Console

• Fixed a "Could not apply least permissions" error when updating a server instance.
• Fixed an error when editing and saving a Kestrel instance in maintenance mode.
• Fixed an upgrade removing the scheduler account's permissions on the encryption configuration file.
• Fixed duplicate Light and Dark theme options under Support > Options > Theme.
• Fixed server instance changes made from the Console not being saved.
• Fixed the command-line interface crashing when upgrading a server instance.
• Fixed upgrades removing the scheduler account's permission to access the encryption configuration file.

• Added a customizable toolbar interface mode, with a customization view for choosing which buttons appear and how they are labelled.
• Added a new Raw Terminal entry type.
• Added a Webcam asset type to IT Asset entries.
• Added a Windows DNS dashboard entry type.
• Added back the Tera Term Pro add-on.
• Added Jira ticketing dashboard as a new connection type, allowing users to view and manage Jira tickets directly within RDM.
• Added a "Show hidden files" option for FTP entries.
• Added a content preview to the entry overview so note, document and script content can be read without opening the entry.
• Added a group policy to enforce the Enhanced security option of the offline mode.
• Added a Help menu tool that captures a performance dump and sends it to support.
• Added a keep password in memory option and a configurable multi-factor authentication delay for CyberArk credentials.
• Added a loading indicator on the entry tree when switching workspace or vault, naming what is loading instead of showing an empty tree.
• Added a loading indicator when switching vaults so the delay is no longer silent.
• Added a new Hybrid mode for CyberArk credentials that uses a PSM proxy connection for supported session types (RDP and web) and falls back to credential injection for others.
• Added a quick connect button for when the status bar is too narrow to show the full control.
• Added a refresh of access requests when manually refreshing the vault.
• Added a restriction preventing privileged accounts from being added without a license.
• Added a right-click menu to the Password Analyzer for quicker access to actions.
• Added a terminal colors page to the Launcher options so terminal color overrides can be configured there.
• Added an expired/expiring badge to password list entries.
• Added an option to include the mouse cursor in RDP session recordings.
• Added an option, also enforceable by policy, to reposition or hide the Domain field in the RDP credential prompt.
• Added archive support and sort/filter options to the AI chat list.
• Added automatic clearing of completed transfers in the file explorer, along with an option to control it.
• Added automatic migration of legacy website entries to the current website session type.
• Added certificate trust management for Active Directory privileged account (PAM) providers, so domain controller certificates can be reviewed and trusted from the provider settings and the PAM onboarding wizard.
• Added chart editing to the spreadsheet editor for document entries.
• Added Chat and Remote Log modes for ControlR entries.
• Added clickable links for URL hosts shown in the password list entry overview.
• Added CPU and memory usage display for Hyper-V virtual machines.
• Added Description and Username columns to the Passwordstate account selection list, making it easier to pick the right account.
• Added Devolutions Cloud maintenance and outage details to connection error notifications, pointing you to the status page during a service disruption.
• Added Devolutions Gateway routing for PowerShell and SSH script tools, so scripts can now reach hosts that are only accessible through a gateway.
• Added drag multi-selection to the file explorer entries (selection square).
• Added error handling to the Submit ticket flow so failures now report a message instead of failing silently.
• Added HaloPSA as a ticketing vendor.
• Added local caching and cache cleanup for contact entry avatar (Gravatar) images.
• Added main menu items, shortcuts, and reports to the quick search (Ctrl+K).
• Added more drag and drop support to the embedded file explorers, including Amazon S3 and Azure Blob Storage.
• Added OTP support for Hudu entries.
• Added PAM checkout extension support for Devolutions Cloud workspaces, letting users request an extension on an active checkout and approvers review, approve, deny, or assign a reviewer.
• Added PAM default settings for DVLS workspaces.
• Added Password Depot REST API v2 support.
• Added per-column search in the application's data grids.
• Added possibility to manage cached authentication for Secret Server and CyberArk credentials.
• Added PowerShell Remoting over SSH support, using RDM's own SSH and gateway flow with native host-key prompts.
• Added security key support to the Keeper sign-in flow.
• Added SSH key support to the Bitwarden synchronizer.
• Added support for configuring a custom AI proxy provider (with custom headers) in the AI assistant settings.
• Added support for local and user-specific settings in the Launcher.
• Added support for tags in the Proxmox dashboard.
• Added support for upgrading PostgreSQL workspaces.
• Added symbolic link icons for linked folders and files, plus broken link indicators in SCP entries.
• Added the ability to download a whole session recording as a single ZIP file from the recordings list.
• Added the ability to extend your trial period.
• Added the ability to import and export vaults that contain privileged account (PAM) entries; PAM accounts and providers are excluded automatically, with a caution banner when any are left out of an export.
• Added the ability to print or save your Devolutions Cloud recovery key as a PDF, and redesigned the recovery key validation screen.
• Added the ability to select a host entry as a template in host entries.
• Added the configuration state of each YubiKey slot, so you can see which slot is already programmed before overwriting it.
• Added the Devolutions Desktop Extension, letting Windows applications and browsers use passkeys stored in RDM.
• Added the user vault to the tray icon menu.
• Added the username format option to My Privileged Account and My Personal Credentials modes.
• Added ticketing operations (list pending tickets, look one up, add comments, log work, and change status) to the AI assistant.
• Added trial status screens shown when your trial is active or has expired.
• Added voice dictation to the AI assistant chat input and the contextual AI prompt.
• Further improved the trial workflow, refining the messaging and available actions on the license and trial screens.
• Improved application startup performance.
• Improved compatibility when the embedded terminal launches a Windows Terminal profile, including Store-installed profiles and profiles that run elevated.
• Improved entry loading speed by no longer re-requesting attachment and documentation counts that were already retrieved.
• Improved error handling when 1Password authentication fails due to a missing dependency.
• Improved extracting a credential entry so it copies the owner entry's permissions to the new credential.
• Improved favicon, Gravatar, and contact image caching while offline.
• Improved link handling when opening a browser, now restricting URLs to HTTP/HTTPS and defaulting to HTTPS when no scheme is provided.
• Improved session recording performance.
• Improved startup time by no longer running the application signature check unless analytics are actually being sent.
• Improved startup time by no longer waiting on the Devolutions Account check at launch, so an unreachable account service no longer delays the application.
• Improved the automation experience by splitting the combined Macro, Script & Tools area into separate Tools and Automation sections.
• Improved the check-out selection prompt to expand all folders when it opens.
• Improved the dark theme to use the Devolutions dark blue palette.
• Improved the existing log file prompt in SSH entries with an explicit "Proceed without logs choice", while Cancel now aborts the connection.
• Improved the layout of the application logs view.
• Improved the quick search results experience.
• Improved the session comment dialog to load ticketing-system tickets in the background, so it no longer stalls while opening.
• Improved the startup experience so the toolbar and search bar stay hidden until the app finishes loading, showing a "Loading..." title in the meantime.
• Improved VNC server key trust so a key you approve for a host is now recognized by every VNC engine instead of only the one you approved it with.
• Made the status-bar license indicator clickable to open license details.
• Merged PAM vaults with regular vaults for Devolutions Cloud workspaces.
• Moved the account view into the main window title bar.
• Multiple startup performance improvements.
• Prevent the application from stealing focus when launching.
• Renamed the "Linked (external vault)" label to "cross vault".
• Removed support for RDM Jump - Use Devolutions Agent instead.
• Deprecated FortiClient SSL VPN mode.
• Removed RDM Jump as a log-off method for RDP entries.
• Removed the deprecated PAM dashboard.
• Removed the legacy Text add-on; existing entries are now prompted for conversion.
• Removed the obsolete "Open embedded" option from the Quick Connect user interface settings.
• Removed obsolete local and user-specific settings for information type entries.
• Removed the check-out status row from folder overviews.
• Removed the Jump Approach selector so all jumps now use the Devolutions Agent, and existing entries keep working automatically.

• Fixed 403 error during Devolutions Cloud workspace login.
• Fixed a black artifact appearing when opening a dialog.
• Fixed a failed SFTP file drop giving no error.
• Fixed a linked credential being ignored as the Azure Bastion sign-in hint.
• Fixed a possible crash when loading the root dashboard.
• Fixed a possible crash when opening RDM in offline mode.
• Fixed a possible error during quick connect in a terminal services session.
• Fixed a potential crash when closing the application.
• Fixed Advanced Options being cleared unexpectedly.
• Fixed application freezing while waiting on 1Password.
• Fixed application not closing when it was exited while still waiting on a background task.
• Fixed Azure Bastion tunnels interfering with each other when several sessions are opened at the same time.
• Fixed buffer size error in PowerShell Terminal (Remote) when the window size exceeded 1920x1080.
• Fixed converting a synchronized entry with a template so the entry is still recognized on the next synchronization.
• Fixed Devolutions Cloud privileged entry no longer working.
• Fixed Duo automatic action setting not being respected when 'None' was selected.
• Fixed entries not refreshing after batch editing their hosts.
• Fixed free Devolutions Cloud users being unable to start a trial while working in their user vault.
• Fixed FreeRDP sessions reconnecting endlessly when smart reconnect is enabled.
• Fixed handbook images not being imported when importing from Devolutions Server into Devolutions Cloud.
• Fixed issues connecting with the Veeam add-on.
• Fixed keyboard input lag in other applications while the application was starting up.
• Fixed loading speed for Devolutions Cloud users without access to any shared vault.
• Fixed MCP OAuth issues including blank page, crash, and silent DCR failures.
• Fixed Microsoft sign-in being prompted again for every session opened through a shared Azure Bastion entry.
• Fixed offline data becoming unreachable for the whole workspace after switching to a vault that has offline access disabled.
• Fixed opening RDM in offline mode with Hub data sources.
• Fixed PAM Just-in-Time replication time being triggered even when Just-in-Time was disabled.
• Fixed PasswordState v10 deprecated endpoints and added My Account settings support.
• Fixed RDP sessions showing password and certificate prompts, or reconnecting, on a tab that was already closing.
• Fixed Secret Server entries that connect through a proxy showing the proxy address instead of the original host in the session tab information.
• Fixed session recording through MsRdpEx failing because a required native component was missing from the installation.
• Fixed shortcut keys not always being displayed correctly after they were modified.
• Fixed temporary access ending at the time originally requested instead of the time the approver granted.
• Fixed the $HOST$ variable resolving to the proxy address instead of the entry's original host when resolving CyberArk and Secret Server credentials.
• Fixed the calendar date picker not respecting the user's culture.
• Fixed the Delinea Secret Server single sign-on flow stalling on the intermediate login page instead of continuing automatically.
• Fixed the DVLS login loop and the freeze after cancelling a login.
• Fixed the privileged account (PAM) check-out prompt refusing a start time scheduled later than the current time.
• Fixed the Secret Server account selection dialog listing every account twice on first load.
• Fixed the thumbnails view not showing previews for RDP sessions that use the new ActiveX client.
• Fixed web autofill field discovery to honor the connection's Ignore certificate errors setting, so fields can now be detected on sites using self-signed certificates.

• Installer - Configure Agent Tunnel and its UDP listening port during setup.
• Service - Connect to Hyper-V virtual machines through RDCleanPath.
• Service - Download every clip from a multi-part recording as a ZIP archive.
• Service - Enable target-side Kerberos credential injection without debug flags.
• Service - Route JMUX sessions through matching connected agents.
• Service - Use Agent Tunnel as a stable, opt-in feature with authorization that persists across restarts.
• Service - Make Agent Tunnel DNS route matching explicit and predictable.

• Service - Flush JMUX messages promptly to improve round-trip-dependent traffic such as HTTP/2 uploads.
• Service - Keep both credential-injection CredSSP connections on the same authentication protocol.
• Service - Preserve credential injection across native RDP reconnects.
• Service - Request credential-injection Kerberos tickets for the Gateway hostname.

Server

• Core - Added the missing variables to the Variable Manager so it matches the set available in Remote Desktop Manager.
• Core - Improved the performance of moving entries to another vault, preventing SQL timeouts in vaults holding several thousand entries.
• Core - Improved Emergency Login by trimming leading and trailing spaces from the username, so a copied and pasted username no longer fails to sign in.

Console

• Made a minor update.

Server

• Core - Fixed the vault entry listing returning passwords and sensitive information to users who only had permission to view entry names, bypassing the "View password" permission.
• Core - Fixed the scheduler service crashing when a custom log retention policy was saved with invalid values.
• Core - Fixed the forced data source MFA setting being incorrectly carried over after a SQL to Devolutions Server migration, which left users locked out with no way to disable it.
• Core - Fixed valid licenses disappearing after an update when an expired license was present in the list.
• Web - Fixed live session shadowing gradually falling behind the source session during sustained screen activity.
• Core - Fixed the User column being blank in the Global Open Sessions view when Remote Desktop Manager is connected to a Devolutions Server data source.
• PAM - Fixed the Windows User provider always using the in-house WinRM client for discovery and heartbeat, with no way to switch back to the legacy Windows WSMan client.
• Core - Fixed automatic database retention cleanup silently doing nothing on servers whose SQL login language is not English, leaving tables to grow indefinitely with the error visible only in the Windows event log.
• Core - Fixed scheduled database retention archiving or purging every row in a table regardless of the configured age, while "Clean up now" behaved correctly.

• Added PKCE to the Devolutions Account sign-in flow.
• Improved security in the SonicWall NetExtender add-on, where the VPN is now not passed through the command line and visible to other processes.

• Fixed "Always ask for password" Password Depot credentials failing with an authorization error.
• Fixed a crash when signing in to a Keeper account that only allows security key authentication.
• Fixed a jump session being left running on the jump host after disconnecting the session opened through it.
• Fixed an undocked RDP session with automatic log off sometimes logging off the local computer instead of the remote session.
• Fixed duplicated web entries that use a Devolutions Gateway never loading.
• Fixed entries failing to open on Devolutions Cloud workspaces.
• Fixed Password Depot sign-in failing with an untrusted certificate error you could not act on; retrying now re-opens the certificate trust prompt.
• Fixed Psono credential entries failing to sign in and retrieve secrets.
• Fixed raw HTML appearing in the Test connection result for Devolutions Cloud workspaces.
• Fixed session recording settings not being inherited correctly when a session is started from the Favorites view.
• Fixed session recordings not being saved in the configured folder.
• Fixed several issues with the SonicWall NetExtender VPN add-on.
• Fixed the Netwrix Password Secure integration using outdated Netwrix client.
• Fixed the Secure note View pane not allowing text selection or use of its scrollbar.
• Fixed the SSH interactive authentication prompt masking the user name; only the prompts the server marks as secret are hidden now.
• Fixed website entries failing to load when their browser cache folder path was too long, by shortening the generated cache and profile folder names.

• [CVE-2026-78417] Added a prompt to review and trust unknown or changed VNC server RSA-AES keys before connecting.
• Added a cancellable progress window while authenticating to Keeper, so RDM no longer becomes unresponsive during Keeper login, two-factor, and device approval prompts.
• Added a creation time, CPU usage and assigned memory columns to the Hyper-V virtual machine list.
• Added a smart card Kerberos certificate logon option for RDP entries, along with the group policy that turns it off.
• Added handling for OpenSSH certificate signed for an sk-ed25519 and sk-ecdsa key.
• Added informational tooltips to Passwordstate fields.
• Improved the SSH shell logging prompt so you can proceed without logging instead of having to cancel the connection.
• Redirected user, vault, user group management to the web interface when on a DVLS workspace and RDM is a 2026.2 version while the server is 2026.3.

• Fixed an unhandled error when pasting into the AI Assistant chat input.
• Fixed Devolutions Cloud activity log entries showing raw internal names instead of readable, translated messages.
• Fixed DVLS embedded login not loading entries after using the "Have trouble logging in" link.
• Fixed focus issues when opening entries as undocked windows.
• Fixed FreeVNC file transfer issues with drive listing, remote paths, and the overwrite prompt.
• Fixed Intel AMT entries connecting to localhost instead of the target host.
• Fixed intermittent flickering when using multiple SSH Shell entries together.
• Fixed nmon rendering incorrectly in SSH terminal entries.
• Fixed RDM freezing on startup when connecting to a Devolutions Server workspace.
• Fixed SFTP not preserving timestamps in certain cases.
• Fixed SSH Shell multi-line copy of ANSI-colored terminal output drops spaces around colored tokens.
• Fixed terminal rendering to apply anti-aliasing settings which are without effect right now.
• Fixed terminal sessions using both a gateway and session recording failing when interactive authentication took longer than the gateway's recording timeout.
• Fixed the 1Password results window opening behind the main application window.
• Fixed the 1Password window prompt opening behind the RDM main window.
• Fixed the Devolutions login window not accepting keyboard or mouse input when RDM is used through a remote session.
• Fixed the Password Depot credential picker so folders can be expanded and entries inside them selected.
• Fixed the x64 and ARM64 app launchers being built against the wrong .NET runtime.
• Fixed unsupported (out-of-date) RDM versions still being able to load vaults when blocked by minimum-version requirements.

Console

• Made a minor update.

Server

• Core - Fixed an invalid license error when connecting from Remote Desktop Manager or the Launcher to servers using PAM package licenses with auto-assign enabled.
• Core - Fixed an issue where System Settings couldn't be saved from Remote Desktop Manager when a ticketing system was configured.
• Core - Fixed an issue where User Vault credentials couldn't be set in user-specific settings when entry creation was restricted to templates only.
• PAM - Fixed an issue where the Get-DSPamVault PowerShell cmdlet returned errors or no results when listing accessible PAM vaults.
• Web - Fixed an issue where spaces couldn't be entered when renaming an entry or folder from the right-click menu.
• Web - Fixed an issue where the "User vault" label wasn't displayed in the configured language until the page was refreshed.
• Web - Multiple UI fixes.

Server

• Core - Improved automatic cleanup of website backup files on Linux.

Console

• Made a minor update.

Server

• Core - Fixed domain users not being added to their groups when some group members couldn't be resolved.
• Core - Fixed scheduled Users reports failing when no tags were selected.
• PAM - Fixed password reset failing for Cisco accounts.
• Web - Fixed the documentation panel not using the full available height.

• Added validation of URLs before they are opened in a browser, hardening against malformed or unsafe links.
• Added an "All virtual machines" folder to the VMware dashboard and improved its performance.
• Added GitHub Enterprise Copilot authentication for the AI assistant.
• Improved the AI assistant to gracefully recover from malformed JSON returned by tools.
• Made NetBox token a sensitive property.

• Fixed inherited credentials failing to resolve for entries that use an SSH private key.
• Fixed manual logging in the SSH Shell creating empty log files.
• Fixed privileged account (PAM) entries not appearing when browsing them from an entry's user-specific override credentials on Devolutions Cloud, for users with entry-level (non-admin) access.
• Fixed search results in the user vault not focusing the correct entry to launch when the navigation pane is hidden.
• Fixed the dashboard disappearing after closing an opened connection.
• Fixed the DVLS login prompt reappearing when switching workspaces after canceling login.
• Fixed the password list search not matching with certain fields such as the description.
• Fixed the system message not being shown when connecting to a workspace through Devolutions Launcher.
• Fixed variables in an entry's Log filename property not resolving when the log path uses a hidden network share.
• Fixed variables not working in custom fields.
• Fixed variables that could stop resolving when multiple variable resolutions in a row were required for the same entry.

• Service - Added support for Session Recording Log (.slog) recording artifacts.
• Service - Automatically retry transient Kerberos (KDC) connection drops to avoid occasional authentication failures.
• Service - Write a boot stack trace file when running as a service, making startup failures easier to diagnose.

Server

• PAM - Password history now requires the appropriate password permissions, preventing unauthorized access to previous passwords.
• Web - Added RustDesk entry details to the web interface.
• Web - Users with the Password Policies permission can now edit the password template directly from the password generator.

Console

• Made a minor update.

Server

• Core - Fixed a privilege escalation issue where non-administrators could add themselves to administrator groups.
• Core - Fixed an issue where the NetBox synchronizer API token was visible to users with view-only access.
• Core - Fixed an issue where custom permission sets could be removed when saving unrelated system settings.
• Core - Fixed an issue where domain users could not be linked to user groups.
• Core - Fixed an issue where Passwordstate v10 entries incorrectly required an API key when saving.
• Core - Fixed an issue where the Duo automatic multi-factor preference was not retained after login.
• Core - Fixed an issue where the Duo SMS button did not send passcodes from the login window.
• PAM - Fixed an error that prevented editing PAM accounts from Remote Desktop Manager.
• PAM - One-time password secret keys are no longer sent to clients; codes are now always generated by the server.
• Web - Fixed an issue where permission changes could not be saved from the batch grant access dialog.
• Web - Fixed an issue where the password generator ignored the parent folder's password policy when creating entries.

• Added Keeper importers (CSV and JSON) for importing entries from Keeper.

• Fixed a tile disappearing from a custom tile layout after it was closed.
• Fixed browsing for accounts failing in 1Password when using 'My account settings'.
• Fixed connecting to a 1Password account protected by Duo, where a loading indicator could stay stuck after the Duo prompt completed.
• Fixed Devolutions Cloud workspaces set to always prompt for login (Force login) re-prompting repeatedly while resolving privileged account (PAM) credentials.
• Fixed DVLS workspaces immediately prompting to reconnect right after clicking Log Off.
• Fixed session recording not starting for Devolutions Cloud entries that connect through the Devolutions Gateway.
• Fixed the Devolutions Cloud dashboard switching on its own to a different vault while left idle.
• Fixed the File Explorer local pane opening as a separate window on another monitor.
• Fixed the one-time password (OTP) timer for sessions linked to privileged account (PAM) credentials.
• Fixed the Privileged Account credential mode missing from user-specific settings for users without a PAM license.

• Added back Impero Connect (Netop) support.
• Added several AI Assistant improvements, including configurable chat panel positioning, toolbar overflow fixes, reduced SSH command lag, and on-demand Copilot CLI download.
• Added support for using an asset's serial number as a variable in entry names.
• Updated the DVLS new-version notification to open the release notes.

• Fixed "Open link in new window" changing focus to the new window for website entries.
• Fixed a pagination issue when browsing Entra ID tenants.
• Fixed an error that could occur when canceling the account sign-in prompt during startup; the application now continues loading normally.
• Fixed an issue where remote PowerShell scripts could run locally instead of on the target machine.
• Fixed an unhandled error when the cloud account login returned a 403 Forbidden response.
• Fixed clickable links being hard to read in certain text views.
• Fixed Launcher access being blocked for users whose RDM platform access was denied; Launcher is now gated on its own access right.
• Fixed multiple errors that occurred when changing a workspace's host and logging in.
• Fixed multiple issues in the Amazon S3 file explorer.
• Fixed right-click actions being disabled in the remote file explorer's file grid.
• Fixed smart card certificate and PIN RDP logon that was broken by Windows update KB5066835.
• Fixed some remote tools ignoring the entry's configured username format and always falling back to domain\user.
• Fixed the AI assistant's entry search to respect each user's view permissions, so entries a user cannot view are no longer returned.
• Fixed the Dashlane integration by prompting for a device registration token during login.
• Fixed the Devolutions Cloud username prompt requiring a password when only a username was needed.
• Fixed the login page becoming non-interactive on RDS/Citrix sessions.
• Fixed the SFTP local pane not restoring the opened folder after a refresh.

Server

• Core - Added a Devolutions Send region selector in Server settings for .com and .eu regions.
• [CVE-2026-15058] Core - Improved security by preventing users from deleting another user's messages.
• [CVE-2026-15637] PAM - Improved security by preventing unauthorized access to SSH private keys.
• [CVE-2026-15641] Core - Improved security by preventing users from approving their own pending access requests.

Console

• [CVE-2026-15642] Core - Improved security by preventing Azure Key Vault secrets from being exposed in recovery kits when sensitive data is excluded.

Server

• Core - Password policy validation errors now provide clear, actionable feedback instead of a generic server error.
• PAM - Fixed an issue preventing users with PAM management permission from selecting JIT groups.
• PAM - Fixed an issue where previously selected JIT elevation groups could appear blank or disappear.
• PAM - Fixed an issue where SSH provider timeout settings were ignored, causing endless loading when a host was unreachable.
• Web - Fixed the Logs dashboard menu positioning for the "Last 7 days" filter.

• Service - Improved diagnostic logging for sessions to make troubleshooting easier.

• Service - Fixed terminal session live-view (shadowing) display sizing and a crash that could occur with very long output lines.

• Added multiple tools, including custom installer.
• Removed the Go-offline option for PAM vaults in Devolutions Cloud.

• Fixed a crash caused by an inherited password policy with an unsupported mode.
• Fixed a crash when reloading a DVLS workspace after saving.
• Fixed a DVLS login loop that opened multiple browser windows during authentication.
• Fixed a memory leak when closing undocked containers.
• Fixed an error after switching accounts in Devolutions Cloud.
• Fixed Azure SQL Active Directory Interactive login.
• Fixed issue where you could filter by passwords in the Password List overview.
• Fixed SSMS entries with Integrated Security opening the usage/help screen instead of connecting (SSMS v20).
• Fixed Terminal command entry script execution on Before Close events.
• Fixed the missing Last Comment button and search in session comment dialogs.
• Fixed the RDP logoff action on Windows Core servers.

Server

• PAM - Improved the Grant temporary access screen by fixing scrolling when browsing the list.
• PAM - Reduced Active Directory lookups when resolving approvers, improving responsiveness during approval actions.
• Web - Added support for X.509 certificate credentials, allowing certificate entries created in Remote Desktop Manager to be viewed and used in the web interface.

Console

• Made a minor update.

Server

• Core - (CVE-2026-14536) Fixed an issue where MFA policies were not enforced when no default MFA method was configured.
• Core - Fixed an intermittent login loop affecting YubiKey and MFA users.
• Core - Fixed an issue where users using Alternate Email MFA were no longer recognized as having MFA enabled after updating.
• Core - Fixed duplicated telemetry events and improved cleanup of outdated events.
• Core - Made multiple UI fixes.
• PAM - Fixed a missing Checkout permission message when approving a checkout without the required permission.
• PAM - Fixed an issue where users without the required vault access could appear as approvers.
• Web - Fixed a loading overlay that blocked interaction with the compromised password dialog.
• Web - Fixed an issue preventing Equivalent URLs from being configured on Web Browser entries.
• Web - Fixed the Copy to clipboard action in the password list.

• Removed an unnecessary password field from the Pleasant Password Server two-factor authentication dialog.

• Fixed a crash at login when using Devolutions Cloud workspaces with no favorites configured.
• Fixed a deadlock that could cause WinRM connections to stop responding.
• Fixed a deadlock that could occur when closing a Hyper-V session tab.
• Fixed a potential crash when unlocking the application.
• Fixed an autofill issue with special characters in the OpenVPN GUI.
• Fixed an issue where enabling "Prompt for credentials on client" on an RDP entry caused saved credentials to be ignored.
• Fixed an issue where opening an SSH connection collapsed all items in the user vault.
• Fixed an issue where right-clicking after opening a session with double-click would unexpectedly steal the screen focus.
• Fixed certain file dialogs not allowing files to be saved with names that do not yet exist.
• Fixed ControlR dashboard entries failing to open when the Use My Account Settings option is enabled.
• Fixed Devolutions Agent jumped connections not respecting the configured embedded or external display mode.
• Fixed entries in Devolutions Cloud workspaces with User Specific Settings not appearing in the password manager browser extension.
• Fixed expired ControlR authentication tokens failing to refresh automatically.
• Fixed folder and file pickers crashing when a network path was selected.
• Fixed the automatic reconnect on activity feature in the user vault.
• Fixed the Bitwarden synchronizer creating shortcuts on workspaces that do not support them.
• Fixed User Vault forcing a full data reload on every refresh in DVLS workspaces.

Server

• Core - Improved Brandfetch icon display to better match the active application theme.
• Core - Improved service security by correcting the DVLS Scheduler service registration path.
• Core - Updated the OTP authentication mode name from "Username and password" to "Configured" for consistency with Remote Desktop Manager.
• Core - Added a clearer message when the DVLS Free user limit is reached during first-time SSO sign-in.
• PAM - Added a Message column to recent activities exports to include elevation request details.
• PAM - Improved security of Active Directory browse endpoints against credential-coercion and unauthorized-access attacks.

Console

• Made minor updates.

Server

• Core - Fixed Active Directory synchronization and domain configuration errors in environments with overlapping domain names.
• Core - Fixed an issue preventing users from changing the preferred domain controller when the current controller was unavailable.
• Core - Fixed syslog messages that could fail RFC 5424 validation and interfere with event processing.
• Core - Made multiple UI fixes.
• PAM - Fixed Azure account password resets.
• Web - Fixed an issue where the Launch button could disappear when an entry was checked out by another user.
• Web - Fixed log comment edits being lost after refreshing the page.
• Web - Fixed the System Settings search box not returning results.

• Added back the Caps Lock indicator on the application login prompt.
• Added back the Parallels 2X Client add-on.
• Added Proxmox credential type support in the free version.
• Improved ControlR add-on authentication by replacing privileged access token login with Username, Password, and Bearer Token options.
• Improved performance on Devolutions cloud workspace.
• Removed the no longer functional "Show Application Tools Tab" option from the UI layout settings.
• Removed the SFTP panel splitter when the section is hidden.

• Fixed a crash that could occur when a window was closed during initialization.
• Fixed a crash when the DisableToolsMenu group policy was enabled.
• Fixed a data refresh issue with Devolutions cloud workspaces.
• Fixed a possible crash caused by invalid color conversion.
• Fixed an issue where only one Windows Terminal process could be opened at a time.
• Fixed embedded RDP sessions not filling the screen in full screen mode when using Smart Sizing.
• Fixed GPT 5.5 model availability in the AI Assistant.
• Fixed Hub workspace entries becoming inaccessible.
• Fixed integrated security not filling the username automatically.
• Fixed PowerShell sessions launched with Run As credentials to display a proper error message when the launch fails instead of silently failing.
• Fixed several UI issues in the prompt for pasting multi-lines in terminals.
• Fixed single-line break pasting triggering a multi-line warning in terminals.
• Fixed SQL Server workspace being incorrectly forced into in-memory caching mode after an edit.
• Fixed SSH Shell issue where selecting the tab did not properly focus the terminal.
• Fixed the calendar date picker watermark to use the current culture instead of the operating system culture.
• Fixed the default paths for the SCCM add-on.
• Fixed the linked picture not being saved when adding a new contact entry.
• Fixed undocked sessions pulling the main window to the front.

Server

• Core - Website Legacy entries can no longer be edited and must be converted before use. The option to permanently dismiss the conversion notice has also been removed.
• Core - Improved loading performance for repository assignments, including the Batch Grant Access window.
• PAM - Added requested elevation details to reports.
• PAM - Added visibility into which approvers received temporary access and PAM checkout requests.
• PAM - Prevented users from approving their own checkout requests through linked accounts when self-approval is disabled.

Console

• Made minor updates.

Server

• Core - Fixed a security issue where ticketing service credentials (ServiceNow and Jira) could be viewed by authenticated users through data source settings.
• Core - Fixed a security issue where duplicating a folder could expose attachments and handbook pages to users without access to the original content.
• Core - Fixed an issue where social-login entry metadata could be visible to vault members who were explicitly denied access to those entries.
• Core - Fixed a privilege escalation issue that could allow users creating vaults or PAM providers to assign themselves System Administrator rights.
• Core - Fixed a performance regression that caused system permission changes to take longer than expected to save.
• Core - Fixed a synchronizer error that occurred when nested groups were deleted in Entra ID (Azure AD).
• Core - Fixed an issue preventing orders from being created when they contained both a starter pack and additional licenses.
• Core - Fixed an issue where changing a password on first login after a basic installation could fail.
• Core - Fixed an issue where exported attachments and documents could become unusable after re-importing with attachments included.
• Core - Fixed an issue where the "Template list only" mode was not enforced, allowing entries to be created without a template.
• Core - Fixed an issue where variables were not resolved when unsealing entries or sending related notifications.
• Core - Fixed false password-change audit logs and notification emails when updating non-credential Website entry settings.
• PAM - Fixed missing permission checks on discovery scan results, ensuring only authorized users can access discovery data.
• PAM - Fixed PostgreSQL accounts incorrectly appearing out of sync after successful password resets.
• PAM - Fixed the "MFA on checkout" default setting not being saved.
• Web - Fixed a JavaScript error when viewing entry details containing deserialization errors under Reports > Diagnostic > Entries.
• Web - Fixed an issue where deleting an entry could trigger an error and leave the connections tree in an incorrect state until the page was refreshed.
• Web - Fixed an issue where unsupported AI Assistant providers appeared blank in the edit dialog and could cause the wrong provider to be saved.
• Web - Fixed Synchronizer entries becoming unusable in the web interface when the synchronization mode was set to manual or inherited manual.
• Web - Made UI fixes.

• Hardened autofill and connection handbook input handling to prevent injections.
• Added a "v9 deprecated" banner for v9 PasswordState entries.
• Added the ability to use Yubikey PIV/PKCS as SSH key.
• Added column sorting to the Favorites panel.
• Added optional Username and Description columns to the Favorites panel.
• Improved performance when filtering a vault.
• Improved VPN image overrides to be less invasive and added an option to hide the overlay entirely.
• Restored the Ivanti Secure Access Client add-on (previously known as Juniper Junos Pulse).
• Restored the SCCM add-on.

• Fixed a Social Login spoofing vulnerability.
• Fixed a crash in the AI Assistant when using an Ollama model that does not support tools.
• Fixed a crash in the logs tab on a cloud workspace with no shared vault.
• Fixed a crash when opening a contextual menu.
• Fixed a crash when opening the Launcher without any workspaces.
• Fixed a DVLS login loop that opened multiple browser windows.
• Fixed an infinite loop when launching a host via a template.
• Fixed an issue where the tray icon context menu could not be opened.
• Fixed batch edit forcing host input when the host was linked or inherited.
• Fixed CPU saturation issues in terminal servers.
• Fixed favorites being empty in a Cloud workspace.
• Fixed favorites not loading connections properly when they came from external vaults.
• Fixed Hub workspaces making web calls while in offline mode.
• Fixed PAM permission sets on temporary access approval.
• Fixed Social Login having trouble detecting certain Twitter login buttons.
• Fixed template selection when using a host with Devolutions Agent.
• Fixed underscores and other special characters being skipped in entry names when browsing from Favorites.
• Fixed undocked sessions not saving their size and position per connection.

• Service - Restored compatibility with version 1 update manifests so update checks work correctly with newer agents.

• Added a system setting to hide the vault size warning banner.
• Added support for opening entries from notifications across multiple vaults.
• Added the ability to use a linked account (user vault) for the Run as tab.
• Added XLSX export for report grids.
• Improved agent connections to survive RDP reconnections.
• Improved the Docker container shell to open in an embedded tab.
• Improved the Docker container shell to prefer bash over /bin/sh.
• Removed automatic license assignment for new DVLS users.

• Fixed a command injection vulnerability caused by an unquoted SSH elevation username.
• Fixed a crash in the Secret Server account selection dialog.
• Fixed a PowerShell injection issue in VMware Remote Console connections.
• Fixed a regression that disabled IME input in password fields.
• Fixed an issue where embedded opened entries were disabled when opened from the user vault.
• Fixed an issue where the User Principal Name could cause the application to hang when it was recognized as a group.
• Fixed double-click handling for non-RDP entries in the CyberArk dashboard.
• Fixed several issues with favorites treeview.
• Fixed temporary access not working for inherited VPNs.
• Fixed text color for entries in the Favorites view.
• Fixed the $HOST$ variable being incorrectly trimmed in Microsoft SQL Server connections.
• Fixed the rename login button incorrectly appearing for workspaces that don't support it.

Server

• Core - Secured ticketing integration credentials so they are no longer visible to non-administrative users.
• Core - Restricted access to deleted user group details to authorized administrators only.
• Core - Added a global setting to disable the AI Assistant for all users.
• Core - Added AI Assistant controls to Entry Type Availability settings for easier administration.
• Core - API messages now match the language used in the web interface.
• PAM - Password Rotation Schedules now follow your configured date and time format.
• PAM - Improved the message shown when a password update is still pending, replacing provider errors with clearer information.
• Web - DVLS now automatically uses your browser's language when you sign in, unless you have selected a different language.

Console

• Made minor updates.

Server

• Core - Fixed an issue where updating the server could cause valid licenses to disappear when an expired license was present.
• Core - Fixed password rotation issues affecting shared SQL accounts across multiple DVLS instances.
• Core - Fixed SQL connection string passwords being written to logs in plain text during configuration reloads.
• PAM - Fixed a script injection vulnerability in built-in PAM provider scripts.
• PAM - Fixed adding PAM accounts to existing vaults without a valid PAM license.
• PAM - Fixed an issue where Azure SQL accounts in the infrastructure vault were incorrectly shown as out of sync.
• PAM - Fixed an issue where scans of unresponsive Windows targets could block future account scans.
• PAM - Fixed SSH provider connections through the Gateway.
• PAM - Fixed the Default Security section appearing for administrators without System Settings access.
• Web - Fixed an error when closing web remote sessions and corrected the displayed hostname on disconnect.

• Installer - Added certificate checks during installation so invalid certificate setups are caught earlier.
• Service - Added experimental Kerberos-based credential injection support (behind unstable option).
• Service - Added experimental transparent routing through the Agent Tunnel.
• Service - Improved network scanning with better targeting and more consistent scan results.
• Service - Reject recording uploads when recording storage is full to prevent incomplete recordings.

Server

• Core - Added a certificate-based Conditional Access Policy for certificate authentication.
• Core - Added a dedicated AI Assistant entry in DVLS.
• Core - Added a new credential mode to save and autofill social logins with the Password Manager extension.
• Core - Added in-app notifications when a new DVLS server version is available.
• Core - Added support for Microsoft Entra ID authentication using delegated permissions.
• Core - Added the ability to configure the number of simultaneous checkouts allowed for an entry.
• PAM - Added the ability to configure a default elevation group during checkout.
• PAM - Added the option to require MFA when checking out a PAM account.
• Web - Added Brandfetch auto-complete support when creating website entries.
• Core - Added a search bar in the user selection dialog when creating a new domain user, searchable by sAMAccountName, displayName and OU.
• Core - Added CVE vulnerability checks on the security dashboard with upgrade recommendations.
• Core - Added the ability to filter entries by connection type through the REST API.
• Core - Email notifications now use the user's configured language preference.
• Core - Improved contractor user management with a redesigned onboarding experience, automatic password generation, and clearer disabled user indicators.
• Core - Reduced the in-app trial period from 30 days to 14 days.
• PAM - Added a "Skip TLS validation" option for the Windows provider.
• PAM - Added support for using the provider account for SSH password heartbeat when target accounts have SSH access disabled.
• PAM - Enhanced password rotation scheduling with more flexible configuration options.
• PAM - Improved access requests to include the full hierarchy of linked connections.
• Web - Added a button to clear all user notifications.
• Web - Added a Convert button to the legacy website banner for faster entry conversion.
• Web - Added a notification in the Administration Dashboard when a new DVLS version is available.
• Web - Added vertical navigation in the Administration and Reports areas to make settings easier to find.
• Web - Extended user synchronizer support in the web interface.

Console

• The passwords file generated during a Basic Install now includes the SQL Express server/instance name for easier follow-up installs.

Server

• Core - Fixed a missing translation when requesting access to available vaults.
• Core - Fixed a NullReferenceException that could occur when a deleted connection notification was processed.
• Core - Fixed a portable license error ("Invalid license: RDM") on first login.
• Core - Fixed a regression where Custom permissions behaved as Denied in web and RDM clients.
• Core - Fixed a regression where vault assignments were not applied during user group import.
• Core - Fixed a SQL timeout when renaming folders containing a large number of entries.
• Core - Fixed an Access Denied error when non-admin users tried to add an entry from a template.
• Core - Fixed an error when opening Duo MFA settings and improved invalid credential validation.
• Core - Fixed an error when starting a trial with an no email address.
• Core - Fixed an issue where duplicating a folder did not copy sub-entries.
• Core - Fixed an issue where entry types disappeared from Type Availability when the last selected vault was content-restricted.
• Core - Fixed an issue where removing an expired license incorrectly prompted for DVLS Free.
• Core - Fixed attachments being lost when moving entries to another vault.
• Core - Fixed DVLS being unable to connect to SQL Server on Linux when TLS encryption was enabled.
• Core - Fixed Entra App Proxy pre-authentication failing when the DVLS account had MFA enforced.
• Core - Fixed linked external vault information not being saved when linking an SSH key.
• Core - Fixed missing translation and username details in temporary access approval emails.
• Core - Fixed Syslog over TCP messages not being RFC 6587 compliant, preventing ingestion by some collectors.
• Core - Fixed the "Do not show again" option not working in the Clipboard Privacy warning dialog.
• Core - Fixed trailing spaces being saved in Tags and in Notification Subscription "Exact expression" parameters.
• Core - Fixed User Settings Vault and Global settings not working for non-admin users in RDM.
• Gateway - Fixed an issue where "Ping all Gateways" incorrectly reported failures.
• Gateway - Fixed an issue where Gateway vault security incorrectly applied to PAM providers.
• Gateway - Fixed GatewayManager creating a short-lived, undisposed HTTP client for every request, which could lead to socket exhaustion.
• Gateway - Fixed the Update button remaining disabled after deleting a configured Gateway.
• PAM - Fixed a regression where inherited OTP no longer worked on PAM accounts.
• PAM - Fixed an issue where admins appeared as approvers even when disabled in settings.
• PAM - Fixed an issue where approval through role/group permissions did not work.
• PAM - Fixed checkout approvers not appearing in the approvers list when no PAM license is assigned.
• PAM - Fixed having to scroll to access buttons in Reports > PAM Check-out requests.
• PAM - Fixed incorrect "license required" messages shown to licensed PAM users.
• PAM - Fixed PAM account details remaining visible while the account was checked out.
• PAM - Fixed the PAM scheduler hanging on local Windows account scans when the target stopped responding.
• PAM - Fixed the Windows Local Account provider template scan returning no results.
• Web - Fixed a toast notification incorrectly showing "Not found" when deleting entries.
• Web - Fixed a TypeError when opening Advanced Search as a user without a user vault.
• Web - Fixed RDP/VNC/ARD left mouse clicks triggering a right-click in the web client when running in Firefox.
• Web - Fixed the SSH web app not prompting for the private key passphrase when one was required.
• Web - Fixed unnecessary icon cache fetches caused by virtual scrolling.
• Web - Fixed web RDP sessions not invoking the KDC Proxy, causing Kerberos authentication to fall back to NTLM.
• Web - Made multiple UI fixes.

Console

• Core - Fixed additional access URIs not being editable in the Kestrel.
• PAM - Fixed an issue where account discovery results were not always re-encrypted after an encryption key change.

• Added a gateway connectivity test to the PAM service.
• Added a group policy to hide the Quick Connect prompt confirmation message.
• Restored the 'Open as SFTP/SCP' option for all session types.

• Fixed passwords being loaded into Quick Search for users who lack the required permissions.
• Fixed a 1Password single sign-on error that could occur after multiple logins.
• Fixed a 403 error on startup when loading Hub permission assignments.
• Fixed a PowerShell injection vulnerability in VMRC connections.
• Fixed agent connections so they survive an RDP reconnect.
• Fixed an incorrect argument passed to SSMS after its latest updates.
• Fixed an issue when moving or duplicating a folder that contains a virtual folder.
• Fixed an issue where a user with the "Deleted entries" permission could not restore or delete history.
• Fixed license assignment when editing a user in DVLS.
• Fixed loss of Linked (vault) credentials, SSH keys, proxies, and gateways when a Hub Personal data source is converted to Hub Business.
• Fixed management views opening the same window multiple times on the Free edition.
• Fixed the private key dropdown not loading keys when on the User Vault tab.
• Fixed the proxy bypass list not handling regular expressions correctly.

Console

• Made minor updates.

Server

• Core - Fixed a security issue where duplicating a folder could expose attachments and handbook pages to users without access to the original content.
• Core - Fixed a security issue where ticketing service credentials (ServiceNow and Jira) could be viewed by authenticated users through data source settings.
• Core - Fixed an issue where the "Template list only" mode was not enforced, allowing entries to be created without a template.
• Core - Fixed login failures when using MaxMind GeoLite2 with location-based access policies.
• PAM - Fixed missing permission checks on discovery scan results, ensuring only authorized users can access discovery data.
• Web - Fixed an issue where deleting an entry could trigger an error and leave the connections tree in an incorrect state until the page was refreshed.
• Web - Made UI fixes.

Server

• Core - Secured ticketing integration credentials so they are no longer visible to non-administrative users.
• Core - Restricted access to deleted user group details to authorized administrators only.

Console

• Made minor updates.

Server

• Core - Fixed an issue where updating the server could cause valid licenses to disappear when an expired license was present.
• Gateway - Fixed false "Gateway down" notifications that could occur during periods of heavy load.
• PAM - Fixed a script injection vulnerability in built-in PAM provider scripts.
• PAM - Fixed an issue where Azure SQL accounts in the infrastructure vault were incorrectly shown as out of sync.
• PAM - Fixed an issue where scans of unresponsive Windows targets could block future account scans.

Server

• [CVE-2026-9522] PAM - Fixed an access control issue affecting account discovery scan configurations.
• [CVE-2026-9590] Core - Fixed a permission issue that could allow asset sections to be modified through the API without proper authorization.
• Core - Fixed synchronizers running against sealed credentials without prompting for unsealing first.
• Core - Fixed an error that prevented starting a trial when an invalid email address was entered.
• Core - Fixed sign-in issues when using Entra App Proxy with MFA and pre-authentication enabled.
• PAM - Fixed a regression where the OTP field was not displayed for checked-out accounts using inherited OTP settings.
• Web - Fixed the Clipboard Privacy warning dialog's "Do not show again" option not being respected.
• Web - Fixed trailing spaces being saved in Tags and Notification Subscription exact-match filters.

Console

• Core - Fixed the inability to edit additional access URIs in the Kestrel configuration.

• Fixed a "no license found" error when losing connection to the data source.
• Fixed DUO errors and redirect failures during 1Password authentication.
• Fixed error when the Hub data source connection dropped where the tray notification would not prompt in some cases.
• Fixed issue in SSH entry where entering your 2FA would disconnect the session.
• Fixed issue where terminal command script configured in the "Before open" section of the entry events was not executed before closing an SSH session.
• Fixed RDM failing to connect when DVLS requires MFA.
• Fixed synchronizer failure when an entry in the current vault uses the CURRENT_CLIPBOARD variable.

• Added automatic recovery from corrupt offline files.
• Added SSMS 21 and SSMS 22 default paths for SQL Server Management Studio entries.
• Improved error message details when a PowerShell session fails to launch.
• Removed non-user fields from X.509 credential settings.

• Fixed a security vulnerability in OpenMcdf.
• Fixed Applications assignment opening in a different UI window.
• Fixed context menu duplication issue in the filter dialog.
• Fixed dialogs to respect the top-most state of the owner window.
• Fixed display issue at non-default scaling on the background services page.
• Fixed Forbidden Passwords from shared sources not being taken into account in the password generator.
• Fixed infinite loading indicator when running synchronizers.
• Fixed LastPass single sign-on error caused by mismatching username in JWT.
• Fixed LastPass single sign-on issue for non-PKCE modes.
• Fixed template display mode being lost during NetBox sync.
• Fixed the notification tray not showing prompts.
• Fixed typing macro not firing in SSH terminal.
• Potential fix for SSH Terminal crash with 'Disconnect action' at 'Reconnect'.

Server

• Core - Added audit logging for Send Copy actions so administrators can track who shared entries and with whom.
• Core - Hardened the authorization cache key to prevent any future cache-poisoning regression (follow-up to CVE-2026-1768).
• Core - Improved authentication security to prevent external-provider sessions from bypassing password authentication under a different login method.
• Core - Improved Active Directory user creation performance.
• PAM - Added an option to skip TLS validation for the Windows Provider.
• Web - Added Command key support for multi-selection in the web interface, allowing Mac users to extend selections with Cmd-click.

Console

• Made minor updates.

Server

• CVE-2026-5171 Core - Fixed an issue where users without Activity Logs permission could still retrieve entry logs through the API.
• CVE-2026-7325 PAM - Fixed an LDAP coercion issue that could force DVLS to authenticate against a malicious LDAP server.
• CVE-2026-8477 Core - Fixed a security issue where sealed entries could be accessed through the partial sensitive-data endpoint without triggering unseal notifications.
• CVE-2026-9047 Core - Fixed an issue where adding an additional MFA factor could remove an existing MFA key.
• CVE-2026-9223 Core - Fixed a missing permission check that could allow users to create a new vault when importing an .rdx file referencing a non-existent vault.
• CVE-2026-9224 Core - Fixed an issue where Active Directory accounts could modify their own profile data through the API despite UI restrictions.
• CVE-2026-9245 Core - Fixed an open redirect vulnerability during external OAuth sign-in failures or cancellations.
• CVE-2026-9246 Core - Fixed an issue where handbook content and attachment metadata from sealed entries could be accessed without following the unseal workflow.
• CVE-2026-9247 Core - Fixed an issue where sealed credentials could be unsealed in another DVLS instance without notifying administrators, and improved handling of linked sealed credentials after import.
• CVE-2026-9248 Core - Fixed an issue where duplicating a connection could copy handbooks and attachments from entries the user could not access.
• CVE-2026-9249 Core - Fixed a password change bypass that allowed users to change passwords without providing the previous password.
• CVE-2026-9251 Core - Fixed an issue where non-admin users could bypass the Pending Approval flow by changing an entry's status.
• Core - Fixed a NullReferenceException in the notification processing service that could leave notifications stuck in an unprocessed state.
• Core - Fixed an issue where Linked (External) credentials were not saved correctly on SSH entries linked to an SSH Key.
• Core - Fixed attachments being lost when moving an entry to another vault.
• Core - Fixed folder duplication so sub-entries are duplicated along with the parent folder.
• Web - Fixed a TypeError when opening the Advanced Search dialog as a user without a User Vault.

• Added a group policy to control the visibility of the 'Copy to YubiKey' option.
• Added convert action for deprecated embedded credentials plus quick access through overview warning.
• Excluded PAM vaults from secure message vault selection.
• The SSH terminal compact display now remembers the last selected folder between sessions.
• Updated Netwrix Password Secure integration for the 2026 version.

• Fixed a possible login issue with 1Password.
• Fixed a potential error with custom folders in favorites.
• Fixed an issue where system proxy mode "No Proxy" silently bypasses Devolutions Gateway.
• Fixed crash for missing session type in NetBox synchronization.
• Fixed crash when copying a password with missing source IDs in Hub data sources.
• Fixed duplicate built-in PAM providers appearing in the Add Provider list.
• Fixed filter prompt not appearing when using the shortcut.
• Fixed freeze issue when the DVLS pre-authentication proxy fails.
• Fixed freeze when canceling the Azure VMs sync login.
• Fixed password list items requiring an item selection when opening history from an item.
• Fixed performance issues when filtering entries and when importing large .rdm files.
• Fixed possible crash when loading the cache.
• Fixed SSH entries not supporting certain PuTTY extensions.
• Fixed SSH sessions not being able to scroll up when using Codex or BYOBU.
• Fixed Tasks no longer showing up for SQLite data sources.
• Fixed templates with "prompt with list" credentials not loading the prompted folder.
• Fixed the Zoho Vault credential integration and added region selection and CAPTCHA support.

Server

• CVE-2026-5146 Core - Closed a security gap allowing notification actions without authentication.

Console

• Core - Added a support package generator to quickly collect diagnostics and configuration for faster issue resolution.

Server

• Core - Fixed a configuration error causing app settings to fail loading.
• Core - Fixed admins receiving expiration alerts for other users' vault items.
• Core - Fixed an issue where deleting a user could remove all users from the list.
• Core - Fixed incorrect backup failure alerts and cleanup issues on Linux/Docker.
• Core - Fixed unreliable installation of IIS ASP.NET Core Module on new Windows Server setups.
• PAM - Fixed visibility selector closing too early when creating a new vault.
• Web - Fixed "Disable MFA" dialog not closing after confirmation.
• Web - Fixed default authentication method being ignored in Domain mode.
• Web - Fixed empty notification banners appearing across admin pages.
• Web - Fixed error dialogs showing blank content instead of messages.
• Web - Fixed incorrect warning when saving entries with compromised passwords.
• Web - Fixed login page defaulting to Domain authentication when set to "None".
• Web - Fixed reveal/copy actions targeting the wrong field after sorting entries.
• Web - Fixed Security Dashboard crash when navigating after resolving ignored issues.
• Web - Multiple UI improvements and fixes.

• Added organizational unit (OU) support to the Netwrix Password Secure integration.

• Fixed Hub attachments not being viewable after moving an entry to a different vault.
• Fixed log cleanup discrepancies that could occur when coming back online after offline mode.
• Fixed possible freeze on startup when taskbar visibility setting is set to "Never".
• Fixed synchronization when using inherited credentials in Hub data source.
• Fixed various VMware entry types not working when custom attributes are configured.

Server

• CVE-2026-6706 Core - Added missing authorization check to prevent unauthorized access to handbook pages.
• Core - Renamed Read-Only and Restricted user types to Legacy and removed Read-Only from default user templates.
• Web - Updated third-party dependencies to address security issues, including a reported lodash vulnerability.

Console

• Made minor updates.

Server

• Core - Allowed CyberArk entries to be saved without a username when using OIDC authentication.
• Core - Fixed the Buy a License flow so licenses can be purchased and retrieved properly.
• Core - Prevented permission set changes from being lost when saving after navigation.
• Core - Resolved issue preventing administrators from removing user subscriptions.
• Web - Ensured Reset Password prompt appears above Emergency Login prompt.
• Web - Fixed Hide/Reveal behavior on sensitive fields after table sorting.
• Web - Hid unsupported System Dashboard options in Customize Layout dialog for restricted vaults.

• Added SSO mode support to LastPass credential entries.
• Improved the SSH embedded session so that toggling off SFTP also hides the file transfer window.

• Fixed 1Password SSO login issue when using non-default domains.
• Fixed an issue where clearing the cache on close did not always work for website entries.
• Fixed an issue where SSH KeyAgent did not always detect user vault keys when started at application launch.
• Fixed CyberArk sessions not being saved to connection history.
• Fixed dynamic credentials not working when used in templates.
• Fixed issue with resolving the credentials of a synchronizer in Hub data sources.
• Fixed password generator behavior when the same character was added to both the include and exclude lists.
• Fixed RDP display scaling for custom Windows DPI settings.

• Service - The Gateway and Agent now support automated and scheduled Agent self-updates. Administrators can query update status and configure update schedules via new API endpoints.

• Service - Fixed a startup failure on Windows Server 2016 caused by a missing Windows Error Reporting API; the service now starts correctly on all supported Windows versions.
• Service - Fixed missing disk space metrics in the heartbeat response when the recording directory has not yet been created.
• Service - Fixed silent shadow recording failures (close code 4002) that produced no log output; warning logs are now emitted on all internal error paths.
• Service - Fixed systemd startup failures on RHEL/Rocky Linux and improved RPM/DEB package lifecycle handling (correct enable/restart/disable behavior on install, upgrade, and removal).

Server

• Core - Added option for admins to reset a user's dashboard layout.
• Core - Improved LDAP group handling to support users with over 1,000 groups.
• PAM - Improved loading speed of Azure AD groups and user auto-creation.
• Web - Session names now show the connection name instead of the host name for better consistency.

Console

• Made minor updates.

Server

• Core - Fixed error preventing MFA settings from being saved in user administration.
• Core - Fixed false nightly "user modified" alerts during directory sync (Entra ID, AD, Okta, PingOne).
• Core - Fixed Linux issue where access URL didn't update after setting a custom domain.
• Core - Fixed login failure after upgrade caused by improperly migrated security key data.
• Core - Fixed login issue for contractor users when Devolutions authentication was disabled.
• Core - Fixed MFA policy bypass allowing users to delete their own MFA methods.
• Core - Fixed unintended default vault access granted to imported domain users.
• RestAPI - Fixed sort order parameter not applying correctly in vault endpoint.
• RestAPI - Fixed vault filter to correctly return Infrastructure vaults.
• Web - Fixed authentication filter not resetting properly in Users list.
• Web - Fixed error when clicking info icon in Entra ID configuration.
• Web - Fixed Linux issue causing repeated dashboard widget duplication.
• Web - Multiple UI fixes and improvements.

• Deprecated the PAM dashboard entry type.
• Added dynamic credential linking for Docker SSH key sessions.
• Added support for direct keyboard macro injection in VNC and derivative sessions.
• Improved batch edit image color.

• Fixed 1Password login issue where an invalid token caused too many requests to be sent.
• Fixed 1Password vaults failing to load when macOS access restrictions are configured.
• Fixed a null error in custom PowerShell reports.
• Fixed a potential crash on application startup.
• Fixed a potential crash related to temporary access requests.
• Fixed active directory only showing the lastname when assigning AD security groups.
• Fixed app proxy blocking background operations when the user is already authenticated.
• Fixed drag and drop of folders from remote to local not always working with certain operating systems with SFTP panel opened in SSH terminal entries.
• Fixed Elevate Shell incorrectly showing a timeout prompt on sessions that don't require passwords.
• Fixed import license issue when in offline mode.
• Fixed issue where launching an external web browser session using the system default would not take into account settings like incognito mode.
• Fixed issue with two factor authentication with SSH terminal entry towards a Linux host.
• Fixed keys incorrectly activating during terminal scrollback reset.
• Fixed last focused tab not always being restored when the dashboard is not present.
• Fixed Linked (External vault) credential selection incorrectly showing PAM vaults.
• Fixed multiple 1Password issues.
• Fixed OpenVPN entries incorrectly using the UDP protocol.
• Fixed optional check-out mode not requiring check-out when editing the properties of an entry that is checked-out by someone else (when multi check-out is enabled).
• Fixed possible duplicate entries in user/global vault.
• Fixed possible issue where user overrides were not saved.
• Fixed potential error when changing the application theme while an RDP session is open.
• Fixed RDM freezing after clipboard operations in the terminal.
• Fixed issue where the refresh button sometimes disappears.
• Fixed removing a folder from favorites not properly removing the folder itself.
• Fixed SonicWall NetExtender compatibility issues with version 10.3.4 and later.
• Fixed SSH connections failing due to an unsupported MAC algorithm.
• Fixed system permissions given to a regular user not being taken into account on Hub data source.
• Fixed the permissions report displaying credentials in the session section.
• Fixed unlock not working in a locked vault.
• Fixed user management window automatically re-opening when launching RDM if it was opened before closing.
• Fixed vault selection dropdown not responding to enter and arrow keys.

• Installer - Added German language support.
• Installer - Certificates that fail validation are now shown with a warning icon instead of being silently hidden from the list.
• Service - Credentials stored in memory are now encrypted at rest, protecting against exposure in memory dumps.
• Service - Reduced log noise: a missing recording storage disk is now only reported once at warning level instead of repeatedly.
• Service - Session recordings now use periodic key frames for improved seek performance during playback.

• Installer - Fixed an issue where semi-colons in certain configuration values could cause installation failures.
• Service - Fixed an issue where certain service sub-commands were not recognized correctly.
• Service - Fixed recording storage space reporting for network drives and UNC paths on Windows.
• Service - Fixed recording storage space reporting for network file systems (NFS, Samba) on Linux and macOS.
• Service - Fixed RPM package installing web application files under incorrect directory names.
• Service - Fixed session recording playback failing with a "media could not be loaded" error.
• Service - Fixed the Debian package incorrectly declaring a minimum system library version, preventing installation on some Linux distributions.
• Service - Fixed video playback freezing during live session shadowing after brief recording pauses.

Server

• Core
  • Added dashboard layout reset capability allowing administrators to reset a user's corrupted or misconfigured dashboard layout back to defaults.

Server

• Core
  • Fixed a security issue where MFA check could be bypassed when Emergency Code authentication was disabled.
  • Fixed an issue where OAuth session reuse could allow user impersonation, including administrators.
  • Fixed a security issue where MFA could be bypassed using an alternate authentication cookie.
  • Fixed an issue allowing users to remove their own MFA despite enforced restrictions.
  • Fixed an issue where users with management permissions could access other users' MFA secrets.
  • Fixed an issue where the gateway health check could be exploited for server-side request forgery (SSRF).
  • Fixed a regression where Microsoft User synchronization failed with an error reading 'UserCleanupDelta'.
  • Fixed an issue where approving temporary access requests did not work when only groups were set as approvers.
  • Fixed an issue where the contractor welcome email redirect did not work if the user was already logged in.
  • Fixed KeePass XML import incorrectly creating Legacy Website entries instead of the correct entry type.
  • Fixed Public API path query parameter filtering to work correctly with encoded URLs and nested paths.
  • Fixed the scheduler service crashing when custom log retention policy configuration contained invalid data.
• Gateway
  • Fixed a server-side request forgery vulnerability in the gateway health check route.
  • Fixed an issue where new vaults could not be selected when changing the member filter in a gateway farm.
  • Fixed session recording not working when the session does not connect through a gateway.
  • Fixed the gateway going offline when a connection to a session fails due to a Virtual Gateway rule or other reason.
• Web
  • Fixed a regression where the "All vault" button in the search stopped working.
  • Fixed an issue where Domain/AD users could not be added by browsing and selecting them.
  • Fixed normal users receiving an "Unable to save" error in the customize dashboard layout when a default dashboard exists.
  • Fixed the credit card edit component missing a reveal sensitive data button.
  • Fixed the entry security analyzer where the "Pwned" password filter was not working.
  • Fixed the TOTP window display being broken.

Console

• Core
  • Fixed a regression where SQL-to-DVLS migration silently failed to decrypt User Vault (private) entries, causing users to see empty vaults after migration.

• Added clipboard monitoring support for TeamViewer secure copy actions.
• Added possibility to hide the download section of an SSH entry that has the SFTP tab activated.
• Improved profiler traces to help identify performance issues.
• Deprecated: Disabled hub personal creation in RDM.

• Fixed a regression where passwords could appear in plain text when using Post-login commands in SSH Terminal.
• Fixed "Copy to Yubikey" menu item can cause high idle CPU usage in RDS environments.
• Fixed "Is vault owner" not updating in RDM when vault permissions change in Hub web client.
• Fixed issues related to the "Use this computer's credentials as the application password" setting.
• Fixed potential edge session freezing the application.
• Fixed potential issue when a theme change happens while Windows is locked.
• Fixed potential RDP freeze on disconnect.
• Fixed Serial port entry causing RDM to crash when closing the session.
• Fixed small input delay in SSH entry.
• Fixed some key presses interfering with scrollback in SSH entry when they should not.
• Fixed some system permissions not working when on a Hub data source.
• Fixed SSH key decryption bug with MAC ciphers (like chacha-poly).
• Fixed user management window automatically re-opening when launching RDM if it was opened before closing.

• Added a credential injection option to gateway security settings.
• Added a sign-out button to the Entra ID console.
• Added an option to allow empty DNS entries for WireGuard split tunneling scenarios.
• Added option to force a fresh browser cache in incognito mode when launching the same entry multiple times.
• Added two-factor authentication support for ISL AlwaysOn sessions.
• Hub data sources now falls back to the user vault when no shared vaults are available.
• Improved most recently used (MRU) connection list and connection override behavior.
• Improved the local file explorer context menu with additional actions.

• Fixed 'Always ask for password' not working correctly for Password Depot entries.
• Fixed a cache conflict that could cause browser-based session types to fail.
• Fixed a possible crash when refreshing your entries.
• Fixed a refresh issue that could occur after moving entries between vaults.
• Fixed a sign-in issue with 1Password SSO where the authentication redirect token could be missing.
• Fixed an issue where tools were available in a credential entry's dashboard when switching between session and credential type entries.
• Fixed Batch Edit not properly refreshing VPN mode options when the VPN type is changed.
• Fixed entering name of VM doesn't work with 'Always prompt for VM Name/ID'.
• Fixed folder template group not being preserved on Hub data sources.
• Fixed Hub data sources to resolve variables in linked host names.
• Fixed issue that could cause duplicate files in the local SFTP explorer.
• Fixed keyboard shortcuts not working in Default mode.
• Fixed license detection on first login to a new DVLS.
• Fixed local file explorer actions being unavailable when no file is selected.
• Fixed RDP plugin paths having an unintended leading space.
• Fixed secure gateway behavior inconsistencies between Chrome and Edge, and fixed Local mode for secure gateway SSH tunnels.
• Fixed the host field being disabled when adding a new Hub Business data source.

Server

• Core - Added "Show Release News" preference to control release notification visibility.
• Core - Free License users now appear disabled with a clear visual indicator to explain login restriction.
• Core - Renamed "System Dashboard" to "Administration Dashboard" for clearer terminology.
• Gateway - Added update notification to System Dashboard.

Console

• Core - Hide certificate passwords when updating Gateway certificates.

Server

• Core - Fixed "Allow API Key" setting not persisting after save.
• Core - Fixed "Apply Least Permissions" failing when permissions were preconfigured.
• Core - Fixed "Unable to save" error when users customize dashboards with a default dashboard set.
• Core - Fixed clipboard restrictions not applying in RDP web sessions.
• Core - Fixed contractor users unable to launch RDP sessions via permalink.
• Core - Fixed error when running Last Usage Logs report for regular users.
• Core - Fixed inability to update password generator templates.
• Core - Fixed inability to view inherited OTP codes from root.
• Core - Fixed intermittent dashboard widget reordering not applying.
• Core - Fixed missing activity logs for User Group restore and delete actions.
• Core - Fixed new users not being enabled by default when created.
• Core - Fixed performance issues with Conditional Access Policies enabled.
• Core - Fixed session termination redirecting incorrectly in Active Sessions view.
• Core - Fixed user edits unintentionally removing assigned licenses.
• Core - Fixed vault permissions appearing disabled for non-admin users.
• Core - Resolved SQL collation issues during database and web backups.
• Gateway - Fixed advanced domain settings not saving.
• Gateway - Fixed drain mode and scan option issues in Gateway farms.
• Gateway - Fixed inability to terminate sessions using credential injection.
• Gateway - Fixed session launch failures with inherited Gateway Rule Sets.
• PAM - Fixed duplicated parent folders during account import.
• PAM - Fixed incorrect error title on recurrent SSH key scan failure.
• PAM - Fixed missing out-of-sync icon for SSH key accounts.
• PAM - Fixed module admins unable to see external vaults during import.
• PAM - Fixed PAM logs and rotation reports stuck loading on refresh.
• PAM - Fixed SSH checkout approval error with "Yes, unless it's JIT" option.
• PAM - Fixed unauthorized users appearing in checkout approver list.
• PAM - Restored custom fields visibility in connection overview.
• Web - Fixed "Access Denied" error for non-admin session launches with credential injection.
• Web - Fixed PAM checkout redirect causing 404 error.
• Web - Fixed Remote PowerShell entries not launching in web client.

Console

• Core - Fixed error when editing Certificate Store locations.
• Gateway - Fixed inability to add certificates when editing Gateway.

• Added multi-session support for AI Assistant.

• Fixed a possible loss of user specific settings on after creating an instance of a DVLS data source and connecting to it.
• Fixed Active Directory Dashboard duplicating group membership when editing a group.
• Fixed issue where Typing Macros executed through "Execute in the current tab page" run several times.
• Fixed issue where unlocking RDM could lead to everything being disabled and unusable until a force refresh.
• Fixed issue with opening multiple embedded Windows Terminal entries.
• Fixed possible crash after modifying data sources.

• Added export functionality to the System Diagnostics and About dialog list views.
• Improved error handling when importing an RDD file during the onboarding process.
• Updated the default image for Netwrix Password Secure entries.

• Fixed a crash in Netwrix Password Secure when the window was already closed.
• Fixed a policy categorization issue in the Group Policy administrative template.
• Fixed a potential freeze when opening connections.
• Fixed a regression where importing .rdm files would fail.
• Fixed an issue with node loading when launching the application.
• Fixed and improved certificate sending via Devolutions Send.
• Fixed embedded applications launched via Command Line Tool entries not always displaying at the correct size when used through a remote RDM instance.
• Fixed loading errors for Hub Business entries with malformed data.
• Fixed missing permission validation for editing the system dashboard.
• Fixed the {DELAY} command handling in terminal typing macros.
• Fixed the empty folder's documentation tab not opening in a separate window when double-clicking.
• Fixed the Multivault Advanced Search using OR instead of AND as the logical operator for DVLS data sources.

• Added a Just-In-Time (JIT) authorization tab for Hub AD/EntraID PAM entries.
• Added Active Directory and Entra ID group management support.
• Added auto-mode to the performance profiler.
• Added configurable wait time before attempting to embed an application launched by the Command Line Tool entry.
• Added elapsed time display to the system information view.
• Added Group Policy settings to control visibility of AI features and contact support options.
• Added missing PAM usage policies validation when going through the PAM dashboard.
• Added persistence of the AI assistant chat session between application restarts.
• Extended the HideDevolutionsContactSupport Group Policy to also hide the survey button.
• Improved favorites tab loading performance.
• Improved the data migration progress message to display in the status bar.
• Improved the resize handle area on forms to make window resizing easier.

• Fixed a crash when creating a documentation page in a Hub data source.
• Fixed an issue preventing custom widget display before a pending database upgrade is applied.
• Fixed an issue where viewing a password conflicted with the append OTP to username feature.
• Fixed Docker management entries not saving correctly with inherited credentials; added multi-authentication support.
• Fixed inherited PAM permissions not being correctly resolved.
• Fixed Jump Host connection not working.
• Fixed keyboard shortcuts (Enter, Ctrl+Backspace, and others) not working correctly in some forms.
• Fixed multiple memory leaks that could affect performance over time.
• Fixed multiple prompts appearing when copying a one-time password (OTP).
• Fixed possible freeze (deadlock) at start of RDM and/or vault refresh.
• Fixed SQL Server 2014 compatibility with database upgrade operations.
• Fixed the scrollbar not appearing in the vault picker.
• Fixed the splash screen not hiding when prompted to unlock a vault at startup.
• Fixed undocked dashboard windows preventing the tabbed view from being properly closed.
• Fixed virtual gateways appearing twice in the Hub data source list.
• Fixed VPN connections sometimes showing no name in the opened connections list.

Server

• Core - Added an option to hide the domain login method when domain SSO is enabled.
• Core - Dynamic IP Lists are now generated by the server so they work correctly in the web interface and all clients.
• Core - Expired entry lists and scheduled reports now display the full folder path for better context.
• Gateway - In RDM, the Gateway section is only available for vaults with Gateway access.

Console

• Added SQL database compatibility level verification during updates to prevent upgrade failures.

Server

• Core - Fixed path filtering behavior in the Public API, including support for empty paths returning root entries.
• Core - Fixed a crash when editing unsupported entry types.
• Core - Fixed a failure when moving entries between vaults with folders sharing the same name in RDM.
• Core - Fixed activity logs showing identical active time and duration values when switching tabs.
• Core - Fixed an incorrect message indicating DVLS would revert to the free version after deleting a license.
• Core - Fixed errors triggered by the "Buy now" button in the licenses section.
• Core - Fixed missing activity log events when deleting or restoring user groups.
• Gateway - Gateway-managed sessions from user vaults now correctly display the user's identity.
• PAM - Fixed an empty approver list in the checkout approval dialog for certain SSH account configurations.
• PAM - Fixed an issue where the default Gateway was not saved when enabling Gateway usage on a PAM provider.
• PAM - Fixed domain PAM provider connection tests incorrectly falling back to the parent domain.
• PAM - Fixed missing password reset after failed JIT elevation for non-provisioning accounts.
• PAM - Fixed OTP prompt appearing for brokering-only PAM accounts.
• PAM - Fixed vault owners missing from checkout request approver lists.
• PAM - Fixed visual issues in the propagation template interface.
• Web - Fixed a blank tree view that appeared when editing entries near the bottom of the scroll position.
• Web - Fixed a Content Security Policy issue preventing RDP connections in the web client.
• Web - Fixed an error when saving user vault entries for accounts without a user vault.
• Web - Fixed live session recordings showing an empty dialog in the web client.
• Web - Fixed SSH session recordings not opening in the web interface.
• Web - Fixed the "Reveal password" button failing when creating a Password List entry.

Console

• Fixed an installation failure during SQL Server Express setup caused by generated passwords containing single quotes.

• Added AI configuration dialog for managing AI assistant settings.
• Added PowerShell script execution support through Devolutions Gateway.
• Allow RDM to fill a Yubikey slot with a checked out PAM password.
• Improved PAM dashboard loading performance.

• Fixed 'View entries' permission toggle not appearing enabled in vault settings.
• Fixed an issue when opening files from the tabbed view.
• Fixed crash when closing a serial port entry session.
• Fixed custom system proxy settings not being applied to DVLS and certain Hub data source requests.
• Fixed display issues for icon buttons embedded in text boxes.
• Fixed Docker entries failing to load embedded SSH keys.
• Fixed entry search in the MCP server for SQLite data sources.
• Fixed file contents not saving when using File > Save in the text editor entry.
• Fixed Hub data source not always resolving user principal names correctly.
• Fixed Import multiple vault not working in Hub data source.
• Fixed macros/scripts/tools entries not working when launched from an opened entry's embedded tab's right click menu.
• Fixed password encryption issue with empty passwords set on attachments.
• Fixed status bar persisting under certain conditions in website entries.
• Fixed tag ordering issue in the overview.
• Fixed variable resolving for Alarm, Door Code, and Other entry types.

• New features
  • Added a way for an administrator to create a preset dashboard for their users.
  • Added ControlR entry type.
  • Added Docker management console entry.
  • Added domain registrar as a new information entry type.
  • Added GetScreen entry type.
  • Added JWT credential entry type.
  • Added local recording support for all free data sources.
  • Added PGP credential entry type.
  • Added PowerShell Universal entry type.
  • Added UniGetUI as an available application tool.
• Improvements
  • Deprecated Cryptocurrency cold storage entry type is deprecated.
  • Deprecated Deprecated Spiceworks import - Use the generic CSV importer instead.
  • Deprecated Deprecated spiceworks tool.
  • Deprecated Deprecated TrueKey entry.
  • Deprecated Replaced Winget dashboard with UniGetUI.
  • Added 'show advanced columns' to VMWare dashboard in SOAP API mode.
  • Added "Hide toolstrip" option to Apple Remote Desktop entry settings.
  • Added "Linked (External vault)" mode to OTP selection in entry properties.
  • Added "Open in background" option in the advanced section of entries.
  • Added "Prompt on connection" option to linked VPN.
  • Added "Search all" option in Advanced Search custom fields to search across all custom field values at once.
  • Added /ConfigPath command-line switch to specify a custom configuration directory for RDM.
  • Added a Group Policy setting to control automatic logoff when disconnecting an RDP session.
  • Added a link for external login in the embdded Devolutions login.
  • Added a new Markdown editor with preview mode and syntax highlighting that adapts to light and dark themes.
  • Added a PAM feature discovery screen when PAM is not yet configured.
  • Added a recording gateway setting to connection entries.
  • Added a setting to the VMWare synchronizer to exclude hosts by name.
  • Added a visual security indicator on embedded sessions when credential injection is active.
  • Added ability to edit risk levels for Active Directory and Entra ID security groups and roles in PAM providers.
  • Added AD authentication mode for OneIdentity.
  • Added additional Active Directory user edit fields.
  • Added API key support to credential selection for AI assistant entry.
  • Added better messaging support when DVLS is in maintenance mode.
  • Added certificate file support to SSH key credentials and improved support in SSH terminal entries.
  • Added Copy email to default credential entry overview.
  • Added Copy OTP action in the after connection events.
  • Added Copy to Clipboard credential events for After Open actions.
  • Added disconnect action inheritance for terminal entries.
  • Added disconnect button availability for additional connection types.
  • Added documentation search button to the main filter menu.
  • Added DPI awareness support for RDP external connections (mstsc).
  • Added escape key support to close the vault selector dialog.
  • Added file size column to file explorer entries.
  • Added filtering and role support to NetBox synchronization.
  • Added first implementation of Devolutions Agent DVC to RDM.
  • Added gateway session termination when the PAM account is checked in.
  • Added group membership support to Azure PIM entry.
  • Added group policy option to enforce 'Show folder details as selected' setting.
  • Added host field source setting to the VMware synchronizer.
  • Added HP iLO (Native) support for Devolutions Gateway.
  • Added Internet Protocol to SCP properties.
  • Added linked credential selection for the API key in the AI assistant.
  • Added live chat support button to the ribbon for quick access to customer support.
  • Added markdown document entry type.
  • Added max length to passphrase for Password Generator.
  • Added MCP client support in AI Assistant with OAuth authentication, file attachments, and drag-and-drop functionality.
  • Added MCP tools for creating, reading, updating, and deleting entry documentation.
  • Added multi-instance RDM mode for Now Agent Jump.
  • Added OIDC authentication support for CyberArk.
  • Added option to automatically switch to dashboard when closing a session.
  • Added PAM onboarding "Get started" experience.
  • Added Passwordstate integration to include MFA handling for APIs.
  • Added possibility to configure the default behavior for "Automatically check in PAM account when closing entry".
  • Added Proxmox as a new synchronizer option.
  • Added read-only and destructive operation indicators to AI assistant tools.
  • Added remote time zone support in entry logs for displaying activity in the remote machine's local time.
  • Added reset scrollback on keypress setting in terminal sessions.
  • Added reveal button for more fields in devo send.
  • Added security groups risk analysis for Hub Business data sources.
  • Added service principal authentication support to the Azure VM synchronizer.
  • Added single sign-on support to 1Password entries.
  • Added SSH support to OneIdentity entries.
  • Added support for AES192 and AES256 for SNMP.
  • Added support for custom OpenAI endpoints.
  • Added support for including the password as a variable in synchronizer configurations.
  • Added support for linked owner custom field variables (e.g., $LINKED_OWNER_CUSTOM_FIELD1$).
  • Added support for privileged accounts in Active Directory dashboard connections.
  • Added support for SSO in LastPass integration.
  • Added support for tag inheritance as a setting in the vault and system settings.
  • Added support for using CyberArk Connect with shared playlists.
  • Added tab group multi select by holding the Ctrl key.
  • Added tab title and tab color override to User/Local specific settings.
  • Added temporary access feature to PAM accounts.
  • Added terminal command macros to After Open and Before Close events.
  • Added the data-ciphers property to OpenVPN.
  • Added time-based color coding when viewing OTPs.
  • Added variable resolution support in PAM service for network, VPN, and host-based configurations.
  • Added web autofill security and navigation controls.
  • Allow to reuse the same cache between Web sessions when connecting via Gateway.
  • Changed default value of entry security settings to use inherited values.
  • Changed the default data source login behavior to use the embedded browser instead of external.
  • Changed the vault dropdown to remember the last selected tab instead of defaulting to "All Vaults".
  • Disabled password-related features when password saving is turned off.
  • Implemented GitHub Copilot SDK integration to AI Assistant.
  • Improved "One Identity Safeguard for Privileged Passwords" entry to support Privileged Passwords and Privileged Sessions - The entry was also renamed to "One Identity Safeguard".
  • Improved "view password" behavior on attachments to look at the attachment permissions instead of the main entry permissions.
  • Improved AI assistant interface with additional text formatting options.
  • Improved AI Assistant layout with better model name display, text wrapping, and screenshot button availability.
  • Improved clipboard behavior for more reliable password clearing.
  • Improved double-click behavior to navigate and launch entries by default in multi vault and advanced search results.
  • Improved error handling for gateway permission failures.
  • Improved error handling for Microsoft SQL Server connections.
  • Improved error handling when CSV file cannot be read.
  • Improved error messaging when creating a Hub with an invalid or already-taken name.
  • Improved IP list filtering functionality.
  • Improved license management interface and updated legacy key icon.
  • Improved offline mode reliability and error handling.
  • Improved OTP generation to automatically trim spaces from the secret key, preventing incorrect codes from being generated.
  • Improved performance when loading global and user vaults by loading them asynchronously.
  • Improved performance when switching between vaults.
  • Improved Proxmox to support adding new virtual machines.
  • Improved quick search user experience with better keyboard navigation.
  • Improved tag search functionality in quick search.
  • Improved the first launch experience: new installations now display quick connect buttons for RDP, SSH, VNC, ARD, and web connections when no entries exist.
  • Improved the onboarding experience with UI enhancements and added the ability to configure multiple Hub Business instances at once.
  • Improved the visual design of the AI Assistant.
  • Improved user experience for sealed entries in quick search.
  • Launching RDP as Undocked and Full Screen will now hide the taskbar and display the undocked menu.
  • Linked External vault now supported in SSH Terminal and SSH Port forward for SSH Key.
  • Merged advanced search and multi-vault search into one.
  • Optimized autofill element detection in WebView2 when only name or placeholder attributes are present.
  • Removed gateway selection from Quick Connect for Hub Personal data sources.
  • Renamed 2xclient connection type to Parallels Client.
  • Renamed Teradici PCoIP client add-on to HP Anyware PCoIP client.
  • Unified the terminology for "Keep tab opened on disconnect" for sessions and "Disconnect action" for SSH.
  • Updated application splash screen.
  • Updated Markdown viewer with syntax highlighting.

• Fixed keep in memory option for Delinea Secret Server "My account settings".
• Fixed $MACRO_PASSWORD$ variable not working correctly in high security vaults on Devolutions Server.
• Fixed a crash when disconnecting an AI Assistant session using the session menu.
• Fixed a display glitch in the AI Assistant chat when using screenshots.
• Fixed a LastPass DUO login failure when a linked device had no available two-factor authentication methods.
• Fixed a refresh issue in the script dashboard.
• Fixed a text highlighting issue in SSH sessions when scrolling.
• Fixed actions not working in TN3270 and TN5250 terminals.
• Fixed an issue where connections that do not support PAM credentials could be opened with a PAM credential.
• Fixed an issue where credentials were not saved correctly in FortiClient connections.
• Fixed an issue where Devolutions gateways were incorrectly fetched for Hub Personal data sources.
• Fixed an issue where keys pressed while disconnected from an SSH entry were sent to the session after reconnecting.
• Fixed an issue where PAM connections could be incorrectly checked in or marked as closed while still running.
• Fixed an issue where some entry actions weren't working from the group dashboard.
• Fixed an issue where SSH tunnels using the parent host would fail when in a folder containing variables.
• Fixed an issue where the UPN username format was not applied correctly when using a PAM credential entry with a Hub data source.
• Fixed an issue with Hyper-V entry filtering that broke virtual machine selection.
• Fixed an issue with SOCKS5 connections when using an existing gateway tunnel.
• Fixed an issue with the code editor showing incorrect modified state.
• Fixed and issue where inherited credentials resolving could result in a crash.
• Fixed automatic check in not working when using SSH Key Privileged account.
• Fixed automatic synchronizers logging a close event even when they weren't opened.
• Fixed certificate expiration date not properly removing time component when auto-populating from certificate.
• Fixed check in issue when opening connections from PAM vault.
• Fixed crash that occurred during LAPS password decryption.
• Fixed default SSH template selection in PAM checkout settings.
• Fixed dropdown selectors losing their selected value when switching tabs.
• Fixed enter key behavior and translation issues in TLS Diagnostics window.
• Fixed error after connecting to a Hub data source with a user that has no execute permission on at least 1 synchronizer in the active vault.
• Fixed errors in Devolutions Send feature.
• Fixed errors when connecting to a hub business free for the first time.
• Fixed events macros causing RDM hangs when macros would be set to launch session.
• Fixed gateways being loaded for data sources that don't support them.
• Fixed Hub trial expiration notification to show on data source change.
• Fixed issue where Hub PAM entries prompted for checkout even when checkout mode was disabled.
• Fixed issue where PAM JIT provisioning accounts were not displaying passwords.
• Fixed issue with Dashlane email MFA.
• Fixed issue with duplicate user information history records.
• Fixed issue with variable in data source username and log off data source.
• Fixed issues with one-time password (OTP) variable resolution and credential interactions.
• Fixed JIT account selection in PAM provider.
• Fixed LAPS secret decryption method signature for compatibility with SSPI library.
• Fixed non-default folder type templates not appearing when adding entries from templates.
• Fixed null reference exceptions when closing the application.
• Fixed offline backup behavior for Hub Personal data sources.
• Fixed PAM features not being available when using a DVLS data source.
• Fixed PAM providers not being added to PAM vault.
• Fixed PAM SSH account checkout functionality.
• Fixed possible application crash when double clicking a .rdx file.
• Fixed possible issue closing entries over VPN.
• Fixed potential memory leak caused by trayicons.
• Fixed progress bar display in advanced search.
• Fixed quick connect dashboard loading gateways too frequently.
• Fixed SSH JIT template retrieval when no default template is configured.
• Fixed styling and alignment issues for section separators.
• Fixed TeamViewer connections to properly handle special characters in passwords.
• Fixed template groups being visible in contexts where they are not supported.
• Fixed the 'Open (Select Credentials)' action not working.
• Fixed the About dialog for the Launcher.
• Fixed the application language not loading correctly.
• Fixed the script editor's syntax highlighting not updating when switching between light and dark themes.
• Fixed transparency issue with the most recently used list.
• Fixed View Password visual refreshing issue when OTP was Append/Prepended.
• Fixed viewing credentials not working in secure vaults for DVLS.
• Fixed virtual gateway connections to enforce server-side token validation.

Server

• New Features:
  • Core - Added custom vault dashboard widgets with drag-and-drop reordering.
  • Core - Added Just-in-Time (JiT) access for SSH (sudo) sessions.
  • Core - Added new Contractors account type with expiration date support.
  • Core - Added support for SSH key certificates in the web.
  • Core - Added vault priority sorting.
  • Core - Admins can create preset dashboards for users.
  • Core - Licenses can now be purchased directly within DVLS.
  • Core - Multiple Improved and fixed with the synchronizer where they was mismatch with RDM.
  • Core - Users can now request a trial directly from the application.
  • Core - Users can now request sudo access when requesting checkout.
  • Gateway - Added RDP credential injection for more secure session launches.
  • Gateway - Added traffic event logs to privileged session monitoring.
  • PAM - Added MongoDB provider support.
  • PAM - Added PowerShell session recording.
  • PAM - Added the ability to automatically terminate active sessions when a PAM account is checked in.
  • PAM - Added UI to assign and manage risk levels for roles.
• Improvements:
  • Core - Added "Prompt on connection" support for linked VPN/SSH/Gateway sessions, matching the behavior already available for linked credentials.
  • Core - Added launch links on connections for quick session sharing.
  • Core - Added missing fields in the "Advanced" tab for SFTP connections.
  • Core - Added OTP support for linked external vaults.
  • Core - Added support for editing Delinea Secret Server entries directly within DVLS.
  • Core - Admins can set the default behavior for automatically checking in PAM accounts when closing entries.
  • Core - Corrected inaccurate syslog messages that reported successful logins incorrectly.
  • Core - Entra ID now enforces secret expiration with banner and email warnings.
  • Core - Entry security settings now use inherited values by default.
  • Core - Error reports now include connection type details.
  • Core - Improve Entry Security Analyzer report to include all relevant fields, matching the information already available in RDM.
  • Core - Improved license management, disabling a user now automatically removes their assigned licenses.
  • Core - Improved performance for access requests in RDM.
  • Core - Linked vaults can now point to entries in the same folder.
  • Core - Public API now supports CRUD operations for folders and vaults.
  • Core - Renamed Log Retention Policies to Database Retention Policies and added retention options for connection history, remote sessions, and traffic events.
  • Core - Simplified license assignment in data sources.
  • Core - Synchronizers now support scheduling by hour.
  • Core - Tags can now be used with inheritance rules.
  • Core - The public API now supports full CRUD operations for vaults, allowing administrators to create, read, update, and delete vaults programmatically.
  • Core - Users can now configure multiple MFA methods at once.
  • Gateway - Renamed "Virtual Gateway" to "Gateway ruleset".
  • Gateway - Sessions can now be recorded on a different gateway than the launch gateway.
  • Gateway - The Gateway Diagnostic window now displays whether Devolutions Agent is installed and running.
  • Gateway - The gateway list now automatically refreshes after an update request completes.
  • PAM - Added "Create folder" option when importing PAM accounts.
  • PAM - Added "Skip TLS validation" option in PowerShell provider settings.
  • PAM - Added "Workspace" as a supported application option in the PAM usage policies admin section.
  • PAM - Improved error message when no provider is specified on a PAM account.
  • PAM - Renamed "Scan" to "Account Discovery".
  • PAM - Users without a PAM license can now perform basic PAM operations, such as checking out PAM credentials, without requiring a full PAM license Assignment.
  • Web - Added a warning in the web interface when an OTP account name contains a colon (":"), consistent with existing behavior in RDM.
  • Web - Administrators can now set permissions on entry types that are not technically supported on the web.
  • Web - Users can now customize the "Add connection" favorites section.
  • Web Client - Multiple UI improvements.
  • Web Client - Updated dark theme.

Console

• Improvements:
  • Core - Improved performance for static resource loading by enabling HTTP/2 support when anonymous authentication is configured in IIS.
  • Core - Renamed the "Stable" release channel to "Extended maintenance" in the console to better reflect its support lifecycle.
  • Gateway - Added a new System Certificate Store configuration key for Devolutions Gateway in the console.

Server

• Core - Fixed a regression where it was no longer possible to set a user as an administrator.
• Core - Fixed a scheduler timeout error that could cause scheduled tasks to fail intermittently.
• Core - Fixed an error occurring when too many vaults were present.
• Core - Fixed an error that occurred when editing account login information on a deprecated entry type.
• Core - Fixed an issue where exported logs from the DVLS Console were being cropped and truncated.
• Core - Fixed an issue where forbidden passwords could still be saved in a password list entry.
• Core - Fixed an issue where new Active Directory user accounts were not appearing in DVLS, preventing the auto-create on first login feature from Working correctly.
• Core - Fixed an issue where OAuth token rejections were incorrectly returning HTTP 200 with an empty response instead of a proper error code.
• Core - Fixed duplicate vault cards appearing on the dashboard.
• Core - Fixed notification emails being sent in English for users configured in French.
• Core - Fixed repeated migration attempts after SQL migration and server restart.
• Gateway - Fixed a issue where clicking "Close" from the session kebab menu did not always close the session on the first attempt.
• Gateway - Fixed a missing configuration option in the Web UI for allowing additional hosts through Devolutions Gateway.
• Gateway - Fixed an inconsistency in how Gateway tunnels were configured and displayed between RDM and the Web UI.
• Gateway - Fixed an issue where enabling vault-level security on a gateway prevented it from being used in gateway farms and PAM providers.
• Gateway - Fixed an issue where virtual gateways were not automatically deleted when their associated physical gateway was removed, leaving orphaned entries that no longer functioned.
• PAM - Fixed "Nobody" account appearing when "Ignore system users" was enabled.
• PAM - Fixed a security issue where non-administrator users could view other users' PAM actions in the Privileged Access logs.
• PAM - Fixed account discovery failure caused by circular security group membership.
• PAM - Fixed an error that occurred when attempting to add a folder to a newly created PAM vault during the import process.
• PAM - Fixed an issue where Domain Quick Scan was no longer working.
• PAM - Fixed an issue where groups located in the Builtin organizational unit were not visible when selecting groups for JIT (Just-In-Time) elevation.
• PAM - Fixed Local Windows scan failure when credentials were linked.
• PAM - Fixed SSH scan failure when sudo was configured with NOPASSWORD.
• Web - Fixed inconsistent rendering of secure notes set as Markdown across different platforms.
• Web - Fixed the Notification Subscriptions filter not working correctly.
• Web - Multiple UI fixes.

Console

• Core - Fixed basic installation failure when a generated password contained a single quote (').
• Gateway - Fixed an issue in the console where certificate configuration was cleared when editing a gateway, requiring users to re-enter the certificate.

• Service - Added options to use a dedicated certificate for CredSSP credential injection.
• Service - Improved Gateway now auto-generates a self-signed certificate for CredSSP when no TLS certificate is configured.
• Service - Improved real-time performance of session shadowing.

• Added Devolutions Gateway support to SSH PAM providers.
• Improved double-click behavior in "all vaults" and advanced search to both navigate to folder and launch entries by default.
• Improved how CyberArk session expiration is handled.

• Fixed 'Mandatory on JIT elavation' issues on a PAM SSH account's checkout.
• Fixed 'Unable to connect to your data source' prompting after losing connection even when you switched to another data source.
• Fixed $SESSION_ID$ returning wrong ID when PowerShell macro is executed from RDP session's context menu.
• Fixed ALT + ASCII code combinations not producing any characters in SSH terminal.
• Fixed connection loss that could occur when refreshing access requests.
• Fixed empty credential names in Passbolt when using encrypted metadata.
• Fixed error in Hub data source when starting an entry from the favorites tab while not in the vault of the entry.
• Fixed error when creating new containers in Azure Blob Storage file explorers.
• Fixed error when opening Teamviewer with a bad ID.
• Fixed host variable resolution issue in website connections when using custom ports.
• Fixed issue where a force refresh is needed to be able to see a PAM provisioner account's password in Hub data source.
• Fixed issue where external RDP connections could fail due to missing a temp folder.
• Fixed issues with SSPI module for SSH entry.
• Fixed Jump sessions failing to launch.
• Fixed loss of connection with the data source triggering resizing issues.
• Fixed missing access rights when working in the User Vault.
• Fixed remote services failing to load.
• Fixed SSH account checkout not working correctly with JIT elevation.
• Fixed SSH Key credentials stored in the User Vault not working correctly when used through inheritance.
• Fixed SSH timeout of 300 seconds not being respected when the connection is really long to establish.
• Fixed the Bitwarden synchronizer creating shortcuts on data sources that do not support them.
• Fixed UPN username format not being applied correctly when using PAM credential entries.
• Fixed VPN auto-close not correctly updating the connection's opened state.

• Installer - You can now allow downloading keys even when the certificate isn't trusted (useful in restricted/air-gapped environments).
• Service - Added credential injection support for RDCleanPath.
• Service - Added outbound HTTP/HTTPS/SOCKS4/SOCKS5 proxy configuration support.
• Service - Added ARM64 Docker image support (run natively on ARM hosts).
• Service - Reduce noisy logs: benign client disconnects are now logged as DEBUG instead of ERROR.

• Installer - Fixed the handling of certificate passwords containing single quotes.
• Service - Fixed certificate store resolution error logging to include clearer failure details.
• Service - Fixed Docker image build to correctly generate a self-signed TLS certificate.
• Service - Fixed Linux container startup to honor the TCP_PORT environment variable.

Console

• Made minor updates.

Server

• Security Fix: Core - Fixed sensitive credential exposure through API endpoints for users with View-only permissions.
• Security Fix: Core - Enhanced database security by encrypting previously cleartext personal credentials storage.
• Core - Fixed crash in Reports > Entry Diagnostic page.
• Core - Fixed credential prompt appearing unexpectedly when sessions inherit credentials from parent folders.
• Core - Fixed issue where MFA reset option was not working properly for user accounts.
• Core - Fixed issue where some user vault entries were permanently lost when deleting a user and transferring their vault.
• Gateway - Fixed PAM sessions remaining open in Gateway when PAM operations fail, preventing session accumulation.
• Linux - Fixed error when configuring Active Directory authentication on Linux servers.
• PAM - Fixed password reset not being triggered after importing Entra ID accounts.
• Web - Fixed character encoding issues in Active Directory Console displaying special characters incorrectly.
• Web - Fixed infinite resize loop causing flickering or grey screen when switching from Dynamic Resizing to Actual Size mode.
• Web - Fixed tag autocomplete not filling in the rest of the tag name when selecting from dropdown suggestions.
• Web - Fixed tree view crash.

• Added button in About page to copy version number to clipboard.
• Added error clarifications for OneIdentity Safeguard when connection issues occur.
• Improved error messaging when connecting to SSH terminal.
• Improved Updater to notify users when required .NET runtime is missing.
• Removed MFA prompt for unsupported data sources.
• Removed need to input a character to enable pressing OK in the SSH interactive authentication prompt.

• Fixed caps lock key state does not toggle properly during VNC sessions.
• Fixed copying version number from about page triggering clipboard timer.
• Fixed FreeVNC cannot connect to Vino server with encryption enabled.
• Fixed gateway settings not being saved in website entry's SSH VPN configuration.
• Fixed issue in SSH entry where some special characters would not appear unless pressed multiple times.
• Fixed issue where cloud backup option remained visible when unsupported.
• Fixed issue where Hub provisioner just-in-time accounts could be checked out without selecting required groups.
• Fixed locked status staying active after editing an entry.
• Fixed password generation issues when password complexity is set to inherited.
• Fixed script execution from command palette when using "allow open multiple connections" setting.

Server

• Core - Added the ability to request a trial directly from the application.
• Core - Added connection type information to error reports for better troubleshooting.
• Core - Updated DUO MFA integration.

Console

• Made minor updates.

Server

• (Security Fix) Core - Fixed SQL injection vulnerability in remote sessions API.
• (Security Fix) Gateway - Fixed issue where virtual gateway deny IP and DNS rules are being bypassed using linked host entries in user vaults.
• Core - Fixed issue where syslog timestamp format is invalid in certain locales, such as Finland.
• Core - Fixed issue where vault filter is not being applied correctly in PAM recent activities scheduled reports.
• Gateway - Fixed issue where variables are not being resolved in privileged session monitoring.
• PAM - Fixed issue where password is being updated in the database even when scheduled reset fails on the target system.
• PAM - Fixed issue where Windows local account scans are failing on non-English operating systems.
• Web - Fixed issue where sessions are failing to launch from web interface when user-specific settings are disabled globally.

• Added checkout section to entries in Hub data sources.
• Added possibility to force refresh in launcher.
• Updated DUO client version.

• [Security Fix] Fixed an issue with Team Viewer password visibility.
• Fixed alternate host prompt appearing twice for host entries.
• Fixed an SSH terminal rendering issue where background colors were not correctly cleared during scrolling (BCE support), causing display artifacts in applications such as Vim.
• Fixed clipboard encoding for VNC connections.
• Fixed error 403 in Hub when trying to get Gateway health information.
• Fixed error when exporting a custom report with duplicate columns.
• Fixed gateway list to show only virtual gateways when force virtual mode is enabled.
• Fixed interaction between disabling all macro/script/tools in availability and remote tools display.
• Fixed issue with CTRL key getting stuck in SSH entry.
• Fixed issue with escape function and keyboard mapping not working in SSH.
• Fixed issue with SSH connections not working when using a password variable in post-login commands.
• Fixed possible error when closing application during windows theme change.
• Fixed possible issue when moving a documentation page in Hub.
• Fixed potential FAIL_PROTOCOL_ERROR in SSH entries.
• Fixed SSH interactive authentication prompts to remove confusing popup behavior.
• Fixed SSH terminal issue with keyboard shortcuts.
• Potential fix for out of memory error when theme changes.