In this article
About this release
On November 3, 2026, we released version 4.2.17 of the Segura™ Platform. This release includes 126 changes across 19 modules, primarily fixes (65) and additions (61).
- Release date: 2026-11-03
- Patch: segura | v4.2.17-1
For information on how to update Segura™, see Update Segura™.
Release highlights
Access Review and Certification: periodic user access reviews for any customer
User access review campaigns are now available as a product feature. Administrators assign reviewers directly on each user record or through user groups, scope campaigns to specific users or groups, and track progress with a dedicated report.
What's new
- Reviewer field on user records and user groups.
- Campaign scoping by specific users or specific user groups.
- Multiple reviewers per user — the first to complete closes the review.
- Users by reviewer report showing each assignment's origin.
- Campaign pause when no active global approver, with automatic resume.
Customer impact
Organizations that require periodic access reviews for compliance frameworks such as ISO 27001 or SOC 2 can now run them entirely within Segura™, with a full audit trail. Campaigns no longer depend on identity integration to assign reviewers.
For more details, see Access review and certification.
Self-service access requests: request access policies across modules
The Self-service portal now supports access policy requests for Cloud IAM, DevOps Secret Manager, Task Manager, Certificate Manager, and PAM Core in the dynamic access policy model, each with its own card and list of requestable policies.
What's new
- Access policy request cards for five additional modules.
- Access Self-service shortcut in the user menu.
- Navigation path back to the panel from every Self-service screen.
Customer impact
Users across modules can request access through a single portal instead of relying on an administrator to grant it manually. This reduces the time between a user needing access and getting it, while keeping the approval workflow in place.
For more details, see Self-service requests.
Ad Hoc access: sessions to unregistered devices across Proxy 2.0
Ad Hoc access is now generally available on all three Proxy 2.0 surfaces — Web Proxy, RDP Proxy, and Terminal Proxy. Users connect with a domain credential to a host not registered as a device, optionally through a Network Connector, with full Access Policy enforcement.
What's new
- Ad Hoc sessions on RDP Proxy and Terminal Proxy, in addition to Web Proxy.
- Access Policy controls — justification, approval, ITSM governance, time restrictions, and emergency access — applied before each Ad Hoc session.
- Single Enable Ad Hoc access toggle for all three proxies, with audit trail.
- (Ad Hoc) marker and filter in the Remote sessions report.
Customer impact
Infrastructure teams that need quick access to devices not yet registered in Segura™ can now do so without bypassing the PAM. Sessions stay inside the product with approval, recording, and audit, eliminating the need for direct SSH or RDP access outside the platform.
For more details, see Ad Hoc access.
Device Code Flow: authenticate proxy sessions with your identity provider
RDP Proxy and Terminal Proxy now support device authorization sign-in (OAuth 2.0 Device Authorization Grant). Users scan a QR code or open a link shown in the session, approve the sign-in on any device through their organization's OpenID identity provider, and the session opens.
What's new
- Device authorization sign-in on RDP Proxy and Terminal Proxy.
- QR code and link displayed in the session for approval on any device.
- Provider-level configuration validation and audit trail for provider changes.
Customer impact
Organizations with mandatory SSO policies no longer need to create exceptions for native RDP and SSH clients that cannot perform browser-based redirects. Privileged session authentication goes through the same identity provider used for every other corporate application.
For more details, see Device authorization.
Network Connector for Certificate Manager: manage on-premises certificates from SaaS
Certificate Manager integrations with certificate authorities and publishing targets now route through the configured Network Connector, covering 12 publishing targets and 3 CA integrations.
What's new
- Network Connector routing for publishing to Apache, F5 BIG-IP, IIS, Kubernetes, Tomcat, WebSphere, NetScaler, Palo Alto, and Windows.
- Network Connector routing for Let's Encrypt, DigiCert, and Microsoft CA integrations.
- Post-publish verification through the Network Connector where applicable.
Customer impact
SaaS customers whose certificate authorities and servers are on-premises can now manage the full certificate lifecycle — issuance, publishing, and verification — through their existing Network Connector, without requiring direct network access from the Segura™ SaaS instance.
For more details, see Certificate Manager.
Changelog
API
Added
| Item |
Description |
| SSGR-13023 |
Added A2A authorization scoping to the API v2 user group access policy endpoints, which bind, list, and remove only the PAM access policies released to the application. |
| SSGR-12173 |
Added credential and SSH key creation, editing, and checkout to API v2, including TOTP and certificate settings for credentials; checkout and checkin now require the new Allow checkout and checkin option in the application's A2A authorization, which is off by default. |
| SSGR-12174 |
Added remote session opening and closing to API v2, with automatic or explicit credential selection; session links generated by API v1 and API v2 are single-use, so integrations must request a new link for each session. |
| SSGR-12175 |
Added Access Policy management in both the static and dynamic models to API v2, including users and approvers and, in the static model, administrators and directly associated credentials and devices. |
| SSGR-12176 |
Added authorization scoping for devices, access policies, and rotation jobs to API v2, so that each application works only with the records granted in its A2A authorization. |
| SSGR-12177 |
Added a single date format to API v2, ISO 8601 in UTC across all resources, along with standardized field selection and an SSH key detail aligned with the credential detail; dates recorded through API v2 now match the time shown in the web interface. |
| SSGR-12179 |
Added idempotent retries to API v2: every POST request accepts the Idempotency-Key header, and a retry with the same key is never executed twice. |
| SSGR-13058 |
Added credential profile, password policy, and password strength management to API v2, with read-only queries for credential types, execution plugins, and execution templates; changes to these settings require the new Credential profile option in the application's A2A authorization. |
| SSGR-13231 |
Added user listing and user detail queries to API v2, returning the user ID that access policies, user groups, and credential owners use. |
Fixed
| Item |
Description |
| SSGR-10568 |
Fixed an issue where the main device of an SSH key was not added to the key's device list, which prevented starting a session on that device with the key. |
| SSGR-13629 |
Fixed an issue where creating or updating credentials through the A2A API did not save additional settings such as the credential owner and server path. |
Approval Workflow
Added
| Item |
Description |
| SSGR-12208 |
Added the Reviewer field to the user record to set each user's direct reviewer for user review campaigns. See How to manage users. |
| SSGR-12209 |
Added the Specific users scope to user review campaigns, to review only the users you select. See Create a user review campaign. |
| SSGR-12273 |
Improved the user review screen so that it follows the platform's standard layout. See Review a user's access. |
| SSGR-12280 |
Added the Reviewer field to the user group so that the group's reviewer also reviews its members in user review campaigns. See User group. |
| SSGR-12282 |
Added multiple reviewers per user in user review campaigns, where the first reviewer to complete the review closes it for the others. See Reviewers and global approvers. |
| SSGR-12283 |
Added the Users by reviewer report, which lists each user's reviewers, where each assignment comes from, and the users who have no reviewer. See Users by reviewer. |
| SSGR-12284 |
Added a global approver safeguard to user review campaigns, which pause when the User Management module has no active global approver and can be resumed once one is added. See Campaign. |
| SSGR-12285 |
Added a way back from the review screens to the list of users to review, keeping the filters and page in use. See Review a user's access. |
| SSGR-12416 |
Added the Specific user groups scope to user review campaigns, to review the active members of the user groups you select. See Create a user review campaign. |
| SSGR-12461 |
Added Self-service access policy requests for Cloud IAM, DevOps Secret Manager, Task Manager, and Certificate Manager, and for PAM Core in the dynamic access policy model, each product with its own card and its own list of requestable access policies. See Request access through Self-service. |
| SSGR-12567 |
Added reviewer-based access to user reviews, so that each reviewer opens and saves only the reviews assigned to them. See Review a user's access. |
| SSGR-12630 |
Added a check that prevents creating a user review campaign when the User Management module has no active global approver. See Create a user review campaign. |
| SSGR-12732 |
Added the Access Self-service shortcut to the user menu and a path back to the panel from every Self-service screen, and updated the layout of the panel cards. See Self-service panel and request screens. |
Authentication
Added
| Item |
Description |
| SSGR-12739 |
Improved user batch import so that the import ends with the Error status when any line is rejected, and the message identifies the line. See How to batch import users. |
| SSGR-12740 |
Added access policies inherited from user groups to user review, with the reviewer's removals applied when the review is approved. See Users review and certification. |
Fixed
| Item |
Description |
| SSGR-10283 |
Fixed an issue where the authentication test in the Active Directory settings affected a local user with the same login name. |
Certificate Manager
Added
| Item |
Description |
| SSGR-12469 |
Certificate publishing to F5 BIG-IP now supports routing through a Network Connector for devices without direct network access. See the documentation: Configure F5 BIG-IP. |
| SSGR-12470 |
Issuing and revoking certificates through the Microsoft CA integration now routes through the Network Connector configured on the credential's device. See the documentation: How to integrate with a Microsoft CA. |
| SSGR-12471 |
The DigiCert CA integration now uses the configured Network Connector for all communication. See the documentation: How to integrate with a DigiCert CA. |
| SSGR-12473 |
Apache certificate publishing now uses the device's Network Connector for post-publish verification, fixing failures on networks reachable only through it. See the documentation: How to configure Apache. |
| SSGR-12474 |
Certificate publishing to Tomcat now supports routing through a Network Connector. A new optional Port field verifies the published certificate on the server before completing; when omitted, publication completes without verification. See the documentation: How to configure Tomcat. |
| SSGR-12475 |
Certificate publishing to IIS now supports routing through a Network Connector, covering both installation and post-publish verification. See the documentation: Configure IIS. |
| SSGR-12476 |
Certificate publishing to WebSphere now supports routing through a Network Connector, covering both installation and post-publish validation. See the documentation: Configure IBM WebSphere. |
| SSGR-12477 |
Added Network Connector routing to certificate publishing on Kubernetes, with an error reported when a secret or redeploy update fails. See the documentation: Configure Kubernetes. |
| SSGR-12478 |
NetScaler certificate publishing now routes through the device's configured Network Connector. See the documentation: How to configure NetScaler. |
| SSGR-12479 |
Nginx certificate publishing now uses the same device Network Connector for post-install verification as for installation, fixing failures on networks reachable only through it. See the documentation: How to configure Nginx. |
| SSGR-12480 |
Certificate publishing to Palo Alto devices now supports routing through the device's configured Network Connector. See the documentation: Configure Palo Alto. |
| SSGR-12481 |
Certificate publishing to Windows now supports routing through the device's configured Network Connector. See the documentation: Configure Windows. |
| SSGR-12482 |
The Let's Encrypt CA integration now routes both certificate-authority communication and domain-validation file uploads through the configured Network Connector. See the documentation: How to integrate with a Let's Encrypt CA. |
| SSGR-9973 |
Added support for GlobalSign's Managed SSL (MSSL) API, enabling immediate OV certificate issuance. See the documentation:
- Sign a certificate with GlobalSign.
- SSL/TLS. |
Fixed
| Item |
Description |
| SSGR-12608 |
Fixed an issue where publishing a certificate to Nginx failed due to an incorrect temporary file path. |
| SSGR-12979 |
Fixed an issue where linking a device to a certificate failed on the Link devices screen. |
| SSGR-13021 |
Fixed an issue where publishing a wildcard certificate to a Palo Alto firewall or Panorama failed with a generic error. |
| SSGR-13029 |
Fixed Domain Discovery certificate import skipping the remaining certificates after one failed (e.g., missing Common Name or already imported); all selected certificates are now imported correctly, with per-certificate results available in the renamed Domain Discovery Logs screen (formerly Executions; the View executions action is now View Logs) and in the new Import details screen. See the documentation:
- Domain discovery.
- Domain Discovery Logs.
- Certificate List.
- Import details. |
| SSGR-13214 |
Fixed an issue where reissuing a GoDaddy certificate with multiple SANs dropped the newly added names, keeping only the original common name. |
| SSGR-13623 |
Fixed certificate import failing when the certificate chain included an ECC (ECDSA) certificate. |
Cloud IAM
Fixed
| Item |
Description |
| SSGR-13042 |
Fixed an issue where creating or updating an AWS integration in Cloud IAM failed even when a valid key was provided. |
Database Proxy
Fixed
| Item |
Description |
| SSGR-12841 |
Fixed an issue where MS SQL Server Management Studio could not connect to MS SQL Server databases through Database Proxy. |
Discovery
Fixed
| Item |
Description |
| SSGR-12321 |
Fixed an issue where devices imported through Discovery were not visible to users in environments that use the static access model. |
| SSGR-12382 |
Fixed an issue where URL certificate discovery through a Network Connector set in the general parameters returned incorrect results. |
| SSGR-12975 |
Fixed an issue where certificate discovery against Microsoft CA (AD CS) was interrupted on large volumes, discarding the certificates already collected. |
| SSGR-12978 |
Fixed an issue where some Microsoft Azure Federated SSO certificates found by Discovery had no X.509 data and failed to import. |
| SSGR-12984 |
Fixed an issue where device discovery by IP range could get stuck mid-scan, blocking the automatic certificate scan triggered through Network Connector. |
| SSGR-13621 |
Fixed an issue where Microsoft Azure discovery reported the enterprise applications scan as disabled after failing to fetch enterprise applications, without showing the reason for the failure. |
Domum Remote Access
Fixed
| Item |
Description |
| SSGR-13378 |
Fixed an issue where the time limitation of a third-party access request in Domum Remote Access did not follow the time zone of the request, which prevented users from starting sessions within the configured time range. |
| SSGR-13602 |
Fixed an issue where LDAP/AD group synchronizations removed manually added users from a Domum group when Domum synchronization was deactivated. |
EPM Windows Admin Interface
Fixed
| Item |
Description |
| SSGR-12122 |
Fixed an issue where application elevation settings defined in EPM Windows segregated parameters for a user or device were not applied to the workstation. |
| SSGR-13123 |
Fixed an issue where saving the EPM Windows global parameters could fail intermittently. |
| SSGR-13409 |
Privilege elevation with impersonation in EPM now works for users with session start permission on the credential, without requiring password view permission. |
| SSGR-8867 |
EPM Windows directory and file scan rules segregated by device now keep their devices when edited and saved. |
| SSGR-9466 |
Fixed an issue where the Record session for these applications option appeared for Denylist policies in EPM Windows application access policies. |
EPM Windows
Added
| Item |
Description |
| SSGR-12741 |
Added per-action access policy checks to the Endpoint Privilege Manager Windows agent vault, so that each action on a credential follows the policy that grants it. See Vault. |
Fixed
| Item |
Description |
| SSGR-12221 |
Fixed an issue where an application run from a network share in EPM Windows could start from a path other than the one selected. |
| SSGR-12253 |
Fixed an issue where list headers in the EPM Windows client were displayed in the system default color instead of their defined color, and validation error messages below the authorization field were no longer displayed in red. |
| SSGR-12259 |
Fixed an issue where automatic update in EPM Windows failed after an interrupted download. |
| SSGR-12261 |
Fixed an issue where EPM Windows applied the recording setting of a non-governing access policy when two policies matched the same application; existing policies may record more executions after the update. |
| SSGR-12263 |
Fixed an issue where EPM Windows did not record some executions of applications covered by an access list with recording enabled. |
| SSGR-12299 |
Fixed an issue where automatic update was blocked by the compatibility check with the server, leaving workstations on their current version. Workstations running an earlier version must be updated once with the registration token, for example msiexec /i <package>.msi TOKEN=<token> /qn; after that, automatic updates complete normally. |
| SSGR-12365 |
Fixed an issue where the EPM Windows service did not start on workstations without internet access. |
| SSGR-12559 |
Fixed issues where Microsoft Management Console (MMC) consoles took up to two minutes to open when an access list elevated and recorded them, and where Execute with EPM did not open the selected console file. |
| SSGR-8852 |
Fixed an issue where the Enable multifactor authentication to elevate applications? parameter in EPM Windows requested the MFA code for applications that were not being elevated. |
| SSGR-8892 |
Fixed an issue where terminal blocking by EPM Shell commands in EPM Windows did not take effect as soon as a terminal opened. |
Executions
Added
| Item |
Description |
| SSGR-12730 |
Added support for password rotation on Oracle databases over a secure TLS connection, using an Oracle Wallet uploaded in the device's Certificate section. See Device registration. |
Framework
Added
Fixed
| Item |
Description |
| SSGR-12454 |
Fixed an issue where the notification about a change to a user's Ignore MFA option showed unreadable text. |
| SSGR-12604 |
Fixed an issue where a notification without a title was logged as an unexpected system error. |
| SSGR-13286 |
Fixed an issue where expired access requests in Domum Remote Access were not correctly updated to show the Expired status. |
| SSGR-13618 |
Fixed an issue where the Date/Time filter of the Access control report showed an invalid period when the report was opened from the Access history report. |
| SSGR-6299 |
Fixed an issue where the master key ceremony details cut off the ceremony start and end times. |
Network Connector
Fixed
| Item |
Description |
| SSGR-12707 |
Fixed an issue where syslog messages forwarded through Network Connector were sent over the wrong protocol. |
Orbini Services
Fixed
| Item |
Description |
| SSGR-12409 |
Fixed an issue where the inbox displayed the wrong date and time for emails received through IMAP. |
| SSGR-12603 |
Fixed an issue where an asynchronous task could be discarded under concurrent processing. |
Orbit
Added
| Item |
Description |
| SSGR-13156 |
Added a destination check to the appliance backup, which copies only to a remote backup partition that is mounted and responding. |
| SSGR-13157 |
Added a new appliance backup engine that stores encrypted database dumps of active tenants; before the next Rsync backup, trust the remote server's host key on the appliance, and save again in Orbit any settings that use the removed TAR, SCP, or FTP modes. |
| SSGR-13158 |
Added a lock that allows only one backup at a time on the appliance, so the scheduled backup waits for one already running, and the daily backup now runs at the hour set with orbit backup time. |
| SSGR-13160 |
Added the Backup failed incident to Orbit, which opens when a backup fails or backups stop running, and closes after the next successful backup. |
| SSGR-13226 |
Added the option to change the password, protocol, or destination of a mounted remote backup partition from the Orbit backup settings; when the new partition cannot be mounted, the previous configuration is restored and the request is marked as an error. |
Fixed
| Item |
Description |
| SSGR-13601 |
Fixed an issue where the Device Domain Controller filter did not work on the LDAP / Active Directory tab of the System parameters screen. |
PAM Core
Added
| Item |
Description |
| SSGR-12167 |
Added the credential's Access Policy controls, such as justification and approval, to Ad Hoc sessions in Web Proxy, RDP Proxy, and Terminal Proxy in Proxy 2.0. See Ad Hoc access. |
| SSGR-12168 |
Added Ad Hoc access to the RDP Proxy lobby in Proxy 2.0, so that users connect with a domain credential to a host and port not registered as a device, optionally through a Network Connector. See How to connect to a remote device with RDP Proxy via Proxy 2.0. |
| SSGR-12169 |
Added Ad Hoc support to Terminal Proxy in Proxy 2.0, with the adhoc and connectors commands, which open SSH or Telnet sessions with a domain credential to a device not registered in Segura™, optionally through a Network Connector. See Start an Ad Hoc session with Terminal Proxy. |
| SSGR-12170 |
Added the Enable Ad Hoc access on Web, RDP and Terminal Proxy? parameter, which turns Ad Hoc access on or off for all three Proxy 2.0 surfaces and records each change in the audit trail; accounts that already used Ad Hoc keep the state they had on Web Proxy, now applied to all three. See Ad Hoc access and System parameters - Remote Session. |
| SSGR-12202 |
Added support for lowercase TOTP secret keys in credentials, so keys entered as displayed by providers such as Microsoft Entra ID now generate valid codes. See Credentials registration. |
| SSGR-12579 |
Added a new Ad Hoc Connection screen to Web Proxy in Proxy 2.0, which opens inside the application and lets users choose a registered device or enter a host and port, with an optional Network Connector and field validation before the session starts. See Start an Ad Hoc session with Web Proxy. |
| SSGR-12735 |
Added the (Ad Hoc) marker next to the destination of Ad Hoc sessions and an Ad Hoc filter to the Remote sessions report. See Remote session. |
| SSGR-12737 |
Improved exceptional access so that it also applies to credentials that have an owner, except personal credentials, including access through Endpoint Privilege Manager. See Exceptional Access. |
| SSGR-12738 |
Added session control to emergency panel freezing in both access policy models, which blocks new sessions on frozen devices and, for immediate freezing, ends ongoing sessions. See How to use the emergency panel. |
| SSGR-13359 |
Improved device batch import so that, when the access policy mode is static, each line accepts a single access policy and a different policy moves the device to it. See Batch import. |
| SSGR-6709 |
Added a Start session on another device shortcut for domain credentials on the PAM Core Home and the Access panel, which opens the Domain credentials screen already filtered by that credential. See How to use domain credentials. |
Fixed
| Item |
Description |
| SSGR-10013 |
Fixed an issue where starting an RDP Proxy session on an ad hoc device with a domain credential that requires justification failed instead of asking for the justification. |
| SSGR-11217 |
Fixed an issue where batch imports could remain in progress indefinitely without reaching a final status. See Batch import. |
| SSGR-12090 |
Fixed an issue where removing the temporary user of a JIT credential failed when the credential's password contained certain special characters. |
| SSGR-12183 |
Fixed an issue where the ServiceNow ITSM integration failed to authenticate with OAuth 2.0 when the client secret, client ID, or user contained < or >; after updating, re-enter and save the client secret in existing ServiceNow connections. |
| SSGR-12773 |
Fixed an issue where the list command in the Terminal Proxy failed with a screen size error when the user had access to domain credentials registered on devices without connectivity. |
| SSGR-12831 |
Fixed an issue where the devices grid of a PAM Core access policy did not follow the parameter that restricts each entity to a single access policy. |
| SSGR-12877 |
Fixed an issue where the .rdp and PuTTY .bat files downloaded for local access from the default tenant did not include the configured proxy port. |
| SSGR-12922 |
Fixed an issue where the automatic device connectivity test ran less often than its daily schedule. |
| SSGR-12998 |
Fixed an issue where the device and credential criticality charts on the User posture dashboard counted sessions on items without a criticality as High instead of Undefined. |
| SSGR-13016 |
Fixed an issue where the Password changes dashboard did not load in large environments. |
| SSGR-13035 |
Fixed an issue where an approved command execution request did not allow the requested audited command to run in Terminal Proxy and Web Proxy sessions. |
| SSGR-13161 |
Fixed an issue where automated operations that do not set a new password, such as JIT credential activation and deactivation, failed when the stored password contained characters outside the allowed set. |
| SSGR-13249 |
Fixed an issue where retrieving a secret with sensitive-data encryption enabled failed for certain SSH private keys. |
| SSGR-13430 |
Fixed an issue where starting remote sessions with .rdp files downloaded from Segura™ could fail. |
| SSGR-13594 |
Fixed an issue where changing the password of a parent credential did not update its child credentials. |
| SSGR-13628 |
Fixed an issue where the Device field in credential and SSH key forms did not reflect the device filters of the user's access policy. |
Protected Information
Fixed
| Item |
Description |
| SSGR-12977 |
Fixed an issue where user groups linked to a Protected Information access policy could not be granted write permission. |
Proxy
Fixed
| Item |
Description |
| SSGR-12557 |
Fixed an issue where the RDP Proxy offered domain credentials for devices that only had web (HTTP/HTTPS) connectivity, which resulted in a black screen and disconnection when starting the session. |
| SSGR-12798 |
Fixed an issue where proxy sessions ended when the Session idle time period elapsed, even while the user was active. |
| SSGR-12895 |
Fixed an issue where switching the keyboard language with a shortcut during RDP sessions through Web Proxy kept typing in the previous language; to avoid this, select the new Unicode (follow the user's local keyboard) option in the Keyboard Layout parameter. |
| SSGR-13022 |
Keyboard shortcuts that use Ctrl, such as Ctrl+C and Ctrl+V, now work in Web Proxy sessions when the local computer uses a Cyrillic keyboard layout. |
SaaS
Fixed
| Item |
Description |
| SSGR-12333 |
Fixed an issue where log entries for rejected OAuth 2.0 token requests were incomplete. |