In this article
About this release
On October 13, 2026, we released version 4.2.16 of Segura® Platform. This release includes 36 changes across 11 modules.
- Release date: 2026-10-13
- Patch: segura | v4.2.16-1
For information on how to update Segura® Platform, see Update Segura®.
Release highlight
JIT privilege grant on the target device: elevate existing domain credentials only where they are used
Just-in-time (JIT) credentials can now grant privilege to an existing domain credential directly on the device where the session starts. Until now, choosing where the JIT automation runs was available only for credentials that create a new account for each session.
Many organizations require administrators to work with their own personal domain account, so that every action traces back to a person, and to hold administrative privilege only while they need it. With the Privilege grant JIT type running on the Target device, privilege is granted on the session's device when the session starts and revoked when it ends, with no new account and no wait for Active Directory replication.
What's new
- The JIT execution setting now applies to the Privilege grant JIT type. With Target device selected, the grant and revocation templates run on the device where the session starts. Domain device remains the default.
- The setting is available in both the credential and the credential profile.
- With Target device, the same domain credential can be used in simultaneous sessions on different devices, and each session grants and revokes privilege only on its own device. On the same device, one session runs at a time.
- The JIT types have clearer names, Privilege grant and Ephemeral credential, and each shows a help note that explains which credential the session uses. JIT execution now sits right below the JIT type.
Customer impact
Users keep their own identity in privileged sessions. The same personal domain credential is used in every session, and it holds administrative privilege only on the device being accessed and only for the length of the session. This narrows the reach of administrative privilege without introducing temporary accounts that are hard to trace back to a person.
For more details, see JIT credential models and session lifecycle and How to configure a JIT credential.
Changelog
API
Added
| Item |
Description |
| SSGR-8557 |
Added API v2 endpoints to create, rename, activate, and deactivate Network Connector agents. |
Fixed
| Item |
Description |
| SSGR-12190 |
Fixed an issue where devices with a custom device type and product could not be created or updated through the API v2 /api/v2/platform/devices endpoint. |
Certificate Manager
Fixed
| Item |
Description |
| SSGR-11546 |
Fixed an issue where the Revoke certificate action was missing from the Actions menu for individual certificates in the SSL/TLS inventory. |
| SSGR-11595 |
Fixed an issue where requesting a certificate from Let's Encrypt through the Network Connector failed with an account-not-found or connection error. |
| SSGR-11860 |
Fixed an issue where certificate publication to Nginx, Apache, or Tomcat could fail or report an incorrect status for some device access credentials. |
| SSGR-12184 |
Fixed an issue where automatic certificate renewal through the DigiCert CA got stuck in "Request Approved" and did not complete signing. |
Discovery
Fixed
| Item |
Description |
| SSGR-11927 |
Fixed an issue where Discovery scans of a Windows domain did not display the IP address of discovered devices. |
| SSGR-12320 |
Fixed an issue where devices imported in bulk through Discovery did not appear in the PAM Core device list. |
| SSGR-12712 |
Fixed an issue where Discovery logged that certificate scanning was disabled when a certificate search in Microsoft Azure failed. |
EPM Admin Web Interface
Fixed
| Item |
Description |
| SSGR-12039 |
Fixed an issue where the Enable Automatic Elevation parameter was displayed in Portuguese regardless of the configured language. |
EPM Windows
Changed
Fixed
| Item |
Description |
| SSGR-11761 |
Fixed an issue where EPM Windows session recordings did not cover the entire session. |
| SSGR-12300 |
Fixed an issue where the EPM Windows agent installer, when blocked by an unexpected server response, presented only two possible causes as if they were the only ones and did not show the full address it queried. |
| SSGR-12492 |
Fixed an issue with how the Product name criterion in application access lists identifies applications. |
Executions
Fixed
| Item |
Description |
| SSGR-12344 |
Fixed an issue where executions, such as password changes, failed during execution template validation for some credentials. |
| SSGR-12363 |
Fixed an issue where SQL Server password changes failed on devices associated with a Network Connector and did not use the port configured in the device's connectivity. |
| SSGR-12504 |
Fixed an issue where the cURL executor did not send requests through the Network Connector, causing executions on devices associated with a connector to fail. |
Framework
Fixed
| Item |
Description |
| SSGR-11916 |
Fixed an issue where users were logged out of the web interface when starting a session through the Web Proxy with the MySafe extension connected. |
Orbit
Fixed
| Item |
Description |
| SSGR-12507 |
Fixed an issue where the manual failover in Orbit Server Manager did not run when triggered on the secondary instance. |
| SSGR-12840 |
Fixed an issue where the direct upgrade from version 3.32 to 4.2 failed while stopping services. |
PAM Core
Added
| Item |
Description |
| SSGR-12703 |
Added the option to run the Privilege grant JIT automation on the session's target device, so that an existing domain credential receives privilege only on the device where it is used. See the documentation: How to configure a JIT credential. |
Changed
| Item |
Description |
| SSGR-11979 |
Added a system parameter to set the maximum duration of temporary tokens for proxy access, from 1 to 24 hours; values above the 8-hour default require explicit risk acceptance. |
| SSGR-12075 |
Improved JIT sessions so that abandoned accesses are released automatically. |
| SSGR-12704 |
Improved the JIT settings of credentials and credential profiles with clearer names for the JIT types, a help note for each type, and the JIT execution field right below the JIT type. |
| SSGR-12777 |
Improved JIT Privilege grant sessions so that the same domain credential can be used on different devices at the same time when the automation runs on the target device. |
Fixed
| Item |
Description |
| SSGR-12072 |
Fixed an issue where the Remote Desktop option appeared in the credential actions menu only when RDP was the first connectivity in the device's list. |
| SSGR-12227 |
Fixed an issue where a session started from a RemoteApp used the configuration of another RemoteApp linked to the same credential. |
| SSGR-12271 |
Fixed an issue where Ad Hoc sessions to devices not registered in PAM Core showed an empty Devices field on the home page. |
| SSGR-12277 |
Fixed an issue where users without super admin permission could not select the Main device when editing an SSH key. |
| SSGR-12371 |
Fixed an issue with the user status filter in the synchronized users report. |
| SSGR-12691 |
Fixed an issue where RDP sessions through the Web Proxy and the RDP Proxy displayed the Segura appliance's time zone instead of the user's, even with time zone redirection enabled on the Windows target. |
| SSGR-12708 |
Fixed an issue where mouse wheel scrolling in Windows sessions through the RDP Proxy lagged or stopped momentarily. |
Proxy
Fixed
| Item |
Description |
| SSGR-9850 |
Fixed an issue where accented characters could not be typed on macOS in sessions through the Web Proxy. |
| SSGR-11073 |
Fixed an issue where users could not log in to the Terminal Proxy when pasting the password from terminals with Bracketed Paste Mode enabled. |
| SSGR-12264 |
Fixed an issue where the RDP Proxy selection screen hid RemoteApps beyond the eighth, and the screen now lists only the connectivity options and RemoteApps compatible with the selected access. |
User Behavior
Fixed
| Item |
Description |
| SSGR-10759 |
Fixed an issue where re-authenticating through Continuous Identification inside a modal redirected the entire page instead of returning to the modal. |