WALLIX Bastion 12.5.0 – Release Notes

Reference:	https://doc.wallix.com/en/bastion/12.5/rn-en-12.5.0.html
Date:	2026-10-21
Copyright:	© 2026 WALLIX

Contents

1 New functionalities and improvements
2 Bug fixes
3 Known issues
4 Known limitations

1 New functionalities and improvements

This version includes all the improvements and new features implemented from WALLIX Bastion 12.0 and listed in the sections below.

1.1 New functionalities and improvements in WALLIX Bastion 12.5

1.1.1 New features

1.1.1.1 WAB-7013: Audit > Current Sessions - Refactoring (REST API, GUI)

WALLIX Bastion's real-time session supervision interface has been redesigned to provide better visibility and enhanced control.

You can now terminate sessions directly, configure automatic refresh, monitor "4 eyes/4 hands" mode sessions, and benefit from dynamic search and filtering on users, targets, protocols, and IP addresses.

1.1.1.2 WAB-12680: VNC - File Transfer PI 2026 #2

WALLIX Bastion and WALLIX Access Manager now allow you to transfer files during VNC sessions on TightVNC and UltraVNC servers (up to version 1.6.4).

From WALLIX Access Manager, use the context menu to download or send files; from WALLIX Bastion, use the Ctrl+Alt+F7 shortcut to access the transfer window.

All transfers are tracked in the session video audit and can be verified through ICAP integration to strengthen your security.

1.1.1.3 WAB-15137: Support Web Sessions - Injection & Set Up & Audit Improvements

Improve access to web applications through Web Session Manager to provide a smoother, more secure experience and better compatibility with a wider range of applications. New configurable parameters are now available for each web application to improve compatibility and simplify user access, notably through automatic credential injection. In addition, improve the Web Session Manager installation process to facilitate deployment and reduce friction for administration teams.

1.1.1.4 WAB-17160: Audit log - New UI refactoring

WALLIX Bastion's new audit log interface simplifies compliance tracking with extended filters allowing you to view up to 1 year of history, global search, and a detailed table by timestamp, user, client IP, action, and object.

All columns are filterable and sortable, and data can be exported to PDF for your regulatory compliance needs.

1.1.1.5 WAB-19347: [RDP] Signature of the .rdp connection files generated by the Bastion

A recent Windows update causes mstsc to display a warning for any .rdp file not signed by a trusted publisher.

WALLIX Bastion now allows you to sign the RDP connection files it generates, preventing the Windows warning when they are opened with mstsc. The signing certificate is configured under Configuration / RDP file signature. The issuing certificate authority must be trusted on users’ Windows workstations.

1.1.2 Complete list of changes

The following features and improvements have been implemented in this version:

WAB-16053: Add the "wallix-quota" command-line tool to adjust the default disk quota values of WALLIX Bastion.
WAB-17229: Add real-time auditing of WALLIX Web Session Manager sessions. From the Audit ❭ Current sessions page, auditors can watch a running web session live, including in fullscreen.
WAB-18249: Improve the performance of the list of authorized targets for a user, on the My authorizations page and through the /api/sessionrights REST API endpoint, especially for large sets of targets.
WAB-18717: Improve the execution time of the GET /api/devices REST API request when there is a high number of devices.
WAB-19840: Add a Credential injection parameters section to the web application form.
WAB-20297: Add the auditd audit daemon, installed and enabled on the appliance, to provide a reliable audit trail for security-relevant system events (login activity, privilege escalation, and modification of sensitive system files).
WAB-20341: Add support for the hybrid post-quantum key exchange sntrup761x25519-sha512 (also named sntrup761x25519-sha512@openssh.com) in the SSH proxy. This method is active by default for SSH clients with the oss and low security levels, and toward targets in the default SSH connection policy. Hardened security levels and connection policy profiles remain unchanged.
WAB-20408: Add the configured WALLIX Web Session Manager hostname to the output of the "wallix-debug" tool.
WAB-20595: Improve the security and performance of the dashboards component. Dashboards now only show the data of the groups the user’s profile is limited to.
WAB-20765: Remove the axios component from the WALLIX Bastion web interface to fix the following security issues: CVE-2023-45857, CVE-2025-27152, CVE-2026-25639, CVE-2026-44490, CVE-2026-68943, CVE-2026-101902, CVE-2026-101908, CVE-2026-101909, MAL-2026-2307.
WAB-21030: Add the cron files /etc/crontab and /etc/cron.*/* to the output of the "wallix-debug" tool. The troubleshooting output now includes the configuration of scheduled tasks.

1.2 New functionalities and improvements in WALLIX Bastion 12.4.5

1.2.1 Complete list of changes

No improvement was part of this version.

1.3 New functionalities and improvements in WALLIX Bastion 12.4.4

1.3.1 Complete list of changes

The following features and improvements have been implemented in this version:

WAB-20000: Add the output of the "findmnt --raw" command to the wallix-debug output ("disk.txt" file) for WALLIX Bastion and WALLIX Access Manager. On WALLIX Bastion, this output indicates whether a remote storage is mounted in "/var/wab/remote/recorded".

1.4 New functionalities and improvements in WALLIX Bastion 12.4.3

1.4.1 Complete list of changes

The following features and improvements have been implemented in this version:

WAB-19516: Update the Debian base to version 12.15.

1.5 New functionalities and improvements in WALLIX Bastion 12.4.2

1.5.1 Complete list of changes

The following features and improvements have been implemented in this version:

WAB-17080: Add a synchronization button to the Targets ❭ Accounts ❭ Device accounts ❭ General page to decide and indicate whether the Account name and Account login fields are synchronized.
WAB-19260: Remove the Summary panel from Targets ❭ Devices ❭ General.

1.6 New functionalities and improvements in WALLIX Bastion 12.4.1

1.6.1 Complete list of changes

The following features and improvements have been implemented in this version:

WAB-15716: Add the "rdp" command to wallix-debug to scan TLS algorithms.
WAB-17805: Add the "ssh" command to wallix-debug to display Kex, Cipher, and Integrity algos of a remote peer with SSH connection.
WAB-17847: Add a default timeout of 20 seconds for SMTP connections.
WAB-19115: Add the applications field to the response of the GET /api/clusters API request.

1.7 New functionalities and improvements in WALLIX Bastion 12.4

1.7.1 New features

1.7.1.1 WAB-213: RDP & VNC Targets Authentication Through Certificates Authorities

Improve authentication on RDP and VNC servers by allowing the use of trusted X.509 Certificate Authorities (CA), simplifying configuration when server certificates rotate frequently.

1.7.1.2 WAB-9103: License Measure - Named Users Measure

Improve the "Named User" metric in the WALLIX licensing model to provide a more consistent and accurate view of actual usage. It now includes all primary users accessing the Bastion (local or from an IdP). The calculation is based on a rolling 30-day period: each user is counted only once within this period, and the license seat is automatically released if no connection has been recorded for more than one month. In addition, a new version of the WALLIX Bastion License page has been introduced and redesigned to improve readability and license consumption tracking for both SaaS and On-Premise solutions. It enables real-time monitoring of key indicators such as the number of "Named Users", "Concurrent Users", accessed "Resources", and the usage of paid options.

1.7.1.3 WAB-15137: Support Web Sessions - Injection & Set Up & Audit Improvements

1.7.1.4 WAB-16848: License Measure - Named Users Adaptations & Concurrent Users for WSM for OnPremise Licence

Add enhanced visibility on Web Session Manager usage on the WALLIX Bastion License page, with tracking for both Named users and Concurrent users, enabling more accurate monitoring and optimization of license consumption.

1.7.2 Complete list of changes

The following features and improvements have been implemented in this version:

WAB-8657: Add list of authentications performed from WALLIX Access Manager during the last three months to the output of wallix-debug.
WAB-17068: Improve the three Discovery scan configuration forms (Network, Active Directory, and Microsoft Azure). Each form is now embedded in a modal.
WAB-17075: Improve the Remove tags modal in the Devices and Applications tables.
WAB-17497: Add content of files /etc/sqlreplication/info.json and /etc/sqlreplication/servers_list in wallix-debug output.
WAB-17984: Improve execution time of the "/api/users" API endpoint when there is a high number of primary users.
WAB-18659: Add çView shared session status button in the Actions column of the Session history table to display shared session information, including message, start date, end date, and duration. The button is displayed only if the user session was shared with an auditor.
WAB-18660: Improve labels consistency across My authorizations and Authorizations pages.
WAB-18789: Update “Microsoft Azure“ scan configuration labels to “Microsoft Entra ID“.
WAB-18834: Add W1RA information to the output of wallix-debug.

1.8 New functionalities and improvements in WALLIX Bastion 12.3.6

1.8.1 Complete list of changes

The following features and improvements have been implemented in this version:

WAB-15967: Add list of processes using swap in wallix-debug output in sysinfo.txt file.
WAB-18348: Add default driver options in the Application path field of the standard application general form.
WAB-18460: Add last_password_change field in GET /api/users (REST API v3.12) and GET /scim/Users (SCIM API v2.0).

1.9 New functionalities and improvements in WALLIX Bastion 12.3.5

1.9.1 New features

1.9.1.1 WAB-213: RDP & VNC Targets Authentication Through Certificates Authorities

Improve authentication on RDP and VNC servers by allowing the use of trusted X.509 Certificate Authorities (CA), simplifying configuration when server certificates rotate frequently.

1.9.2 Complete list of changes

The following features and improvements have been implemented in this version:

WAB-11396: Add field “is_ghost” to the response of GET /api/sessions (API 3.12).
WAB-14072: Add VNC subprotocols.
WAB-15528: Add wsm_named_user and wsm_concurrent_user to the licenseInfo endpoint to get statistics about WSM usage.
WAB-15840: Add files rdpproxy.ini and sashimi.conf to the archive generated by wallix-debug.
WAB-16970: Add new parameter Translate RemoteApp with all RDP clients in RDP Connection Policy to improve compatibility with some target applications on Windows Server 2019.
WAB-17279: Improve location of Audit kill session lock user configuration option by moving it from Configuration ❭ Configuration Options ❭ GUI (Legacy) to Configuration ❭ Configuration Options ❭ Global.
WAB-17468: Improve error feedback latency when submitting an incorrect backup passphrase during restoration.
WAB-17953: Add HTTP header "x-date-format" to choose the date format returned by the API REST.
WAB-17969: Fix slowness on Targets ❭ Devices page when rendering 1000 items per page.

1.10 New functionalities and improvements in WALLIX Bastion 12.3.3

1.10.1 Complete list of changes

No improvement was part of this version.

1.11 New functionalities and improvements in WALLIX Bastion 12.3.2

1.11.1 New features

1.11.1.1 WAB-7947: Streamline available HA types and remove legacy DRDB code

Following the removal of the DRBD-based High Availability feature in Bastion 12, the eth1 network interface can now be configured and used like any other regular network interface.

1.11.2 Complete list of changes

No improvement was part of this version.

1.12 New functionalities and improvements in WALLIX Bastion 12.3.1

1.12.1 New features

1.12.1.1 WAB-208: Support Kerberos for Primary Authentication on RDP Proxy

WALLIX Bastion now supports Kerberos authentication on RDP Proxy primary connection. This provides single sign-on for Active Directory users.

1.12.2 Complete list of changes

The following features and improvements have been implemented in this version:

WAB-12944: Add GET /api/health REST API endpoint to get WALLIX Bastion health check status.
WAB-14815: Remove the Description field from Targets ❭ Devices ❭ Services, Targets ❭ Devices ❭ Local accounts and Targets ❭ Accounts Add to group windows. This field is not relevant when adding a target to a group.
WAB-15485: Improve protection of the web session access token.
WAB-15506: Added support for new audit messages for web sessions through Web Session Manager.
WAB-15777: Add a Login button identifier field to the Web application page. This field enables credential auto-injection for Web Session Manager sessions by allowing administrators to specify the HTML class of the login button on the associated login service page.
WAB-15787: Add a Login page URL field on the web application creation page. This field allows configuring the credential automatic injection for sessions using Web Session Manager. The specified URL corresponds to the authentication service associated with the web application.
WAB-15807: Add an Allow automatic injection of authentication information in non-POST forms option to the Web application page. This option allows the injection of authentication information related to the web application into authentication forms that use non-POST methods.
WAB-15813: Add a checkbox Allow automatic credential injection in non-POST forms to the Applications ❭ Web form. This setting enhances the security of automatic credential injection on the application’s authentication page. If the Login page URL field is not specified, the Application URL is used instead. Automatic injection is disabled if the authentication form does not use a POST request.
WAB-16176: Add a new Wrap metadata lines button in the Session Details modal. This option displays session metadata on multiple lines to prevent overflow and remove the horizontal scroll bar, both in the Metadata tab and in the Metadata section of the Replay tab. The preference is saved in the browser’s local storage.
WAB-16803: Add the target group name to the Add targets modal title on the Targets ❭ Groups page. Improve clarity by rewording the Add all results button label in the Add targets modal on the Targets ❭ Groups page.
WAB-17123: Add the PUT /api/configoptions API endpoint.
WAB-17341: Update the Begin and End column filters in the Session history table. They have been replaced with two filters located above the table to improve accessibility. These new filters also allow selecting the hour, minutes, and seconds for the start and end of a session.

1.13 New functionalities and improvements in WALLIX Bastion 12.3

1.13.1 New features

1.13.1.1 WAB-6997: Targets > Groups - WALLIX Bastion Refactoring (REST API, GUI)

Improve the Target groups configuration in WALLIX Bastion. It has been redesigned with a simplified, modern interface. Group configuration is now faster and more intuitive: targets can be added in just a few clicks, deletions are easier, and all actions are performed from a single, unified page.

1.13.1.2 WAB-8444: Audit > Session History > Listing - WALLIX Bastion Refactoring (REST API, GUI)

Improve session history in WALLIX Bastion. The new interface provides clearer and smoother monitoring of activities performed within a session. This redesign makes it easier to identify critical behaviors and delivers a more streamlined user experience.

1.13.1.3 WAB-11960: Increase Max Number of Local User Password History Limit

Increase the password history for WALLIX Bastion and Access Manager local accounts from 15 to 50, preventing reuse of old passwords and enhancing account security.

1.13.1.4 WAB-12939: Web Sessions - Notifications, Account Mapping & Transformation Rules

WALLIX Bastion now offers enhanced Web target administration and analysis, giving teams greater control and visibility. Web session activity can be exported in CSV format, making audits and analysis faster and more efficient. A new notification capability provides real-time monitoring of access to critical Web applications, strengthening security and operational responsiveness. Web access also supports account mapping through transformation rules, expanding authentication options and offering more flexibility in access management.

1.13.1.5 WAB-13005: Web Sessions - Audit (video, metadata) & SIEM

Web sessions managed with Web Session Manager now include advanced auditing capabilities. These capabilities include session video playback and metadata downloads, which improve traceability, compliance, and analysis of risky behaviors. Web session logs can also be forwarded to SIEM tools, enabling centralized visibility and enhanced incident detection.

1.13.1.6 WAB-15411: ICAP - Enable Big Files Analysis By Configuring Timeout

The analysis of large files in WALLIX Bastion is now optimized for all sessions supporting file transfers. A new parameter allows configuring the analysis timeout for ICAP server responses, ensuring reliable, complete, and secure transfers even for very large files.

1.13.1.7 WAB-15511: Ease Configuration of Kerberos Authentication

Deprecate the kerberos-password method in favor of the standard kerberos method for Kerberos authentication.

1.13.2 Complete list of changes

The following features and improvements have been implemented in this version:

WAB-10997: Add a notification system for connections to critical targets and for connection failures to secondary targets in WEBAPP targets.
WAB-12542: Add "Transformation rule" and "Vault transformation rule" in the WEBAPP connection policy.
WAB-12724: Add dynamic URLs for SAML and OIDC authentications.
WAB-13451: Add WSM session event logs to the SIEM export.
WAB-13533: Add API resources GET /api/passwordchangeplugins and GET /api/passwordvaultplugins to list password change plugins and external password vault plugins.
WAB-14012: Add options to return CSV in addition to JSON in REST API.
WAB-14408: Add OAuth2 workflow for the Office 365 SMTP service.
WAB-14740: Add two query string parameters to GET /api/devices and GET /api/applications: with_all_tags, which returns all devices or applications that have at least all of the specified tags, and with_any_tag, which returns all devices or applications that have at least one of the specified tags.
WAB-14743: Add support for tags on web and standard applications in the GUI.
WAB-14831: Add a parse parameter to the session metadata in the API resource sessions/metadata to parse it and transform it into a list of objects.
WAB-15445: The user group "Mappings" tab no longer contains a Profile select component. This select component has been moved to the user group General tab. A profile column has been added to the Mappings tab table and a disabled Profile field is now present in the Mapping modal.
WAB-15477: Add timeout parameters for the integration with external ICAP solutions to ensure correct analysis of large size files.
WAB-15547: Add API resource GET /api/sessions/files/ to retrieve the list of files transferred during a session. This endpoint requires a session_id.
WAB-15548: Add the ability to view and download files transferred during RDP, VNC, SSH, SFTP, RLOGIN, or TELNET sessions. From the Session history page, open the session details modal and switch to the Transferred files tab.
WAB-15655: Add the ability to check RAWTCPIP session details, including session attributes and metadata, from the Session history page. The RAWTCPIP session record can also be downloaded as a .pcap file if the session recording option is enabled in the related authorization.
WAB-15677: Add the video_resolution field to the GET /api/sessions API resource.
WAB-15678: Add the ability to view the session resolution for RDP, VNC, or WSM sessions. When session recording is enabled in the related authorization, the resolution (in pixels) is available from the Session history page in the Session attributes and Replay tabs of the Session details modal.
WAB-15720: Improve SSH key management for device account. The SSH private key tab has been transformed into a new SSH key tab removing the dropdown that forced users to choose between generating or importing a key. Users can now generate or import an SSH key, view the private key type and length, and see the associated public key, all from a single page.
WAB-16041: Add the target name to the title of the session details modal when opening a session from the Session history page.
WAB-16710: Add the force_screen_resolution field to the GET /api/sessionrights response. The field is always included, but its value is set only for RDP sessions, using the connection policy of the device service or application.
WAB-17140: Update underlying Debian distribution to 12.13 and Debian Security Advisory up to DSA-6114-1, refer to [https://lists.debian.org/debian-announce/2026/msg00001.html](https://lists.debian.org/debian-announce/2026/msg00001.html) and [https://lists.debian.org/debian-security-announce/2026/msg00023.html](https://lists.debian.org/debian-security-announce/2026/msg00023.html) for more informations.

1.14 New functionalities and improvements in WALLIX Bastion 12.2.3

1.14.1 Complete list of changes

The following features and improvements have been implemented in this version:

WAB-14947: Update the Debian base to Bookworm 12.12.
WAB-15755: Add an SQL query in wallix-debug to retrieve information on the most recent recorded sessions.

1.15 New functionalities and improvements in WALLIX Bastion 12.2.2

1.15.1 New features

1.15.2 Complete list of changes

The following features and improvements have been implemented in this version:

WAB-7897: Add clarification about the requested format for target account managed by WALLIX Bastion External Vault Plugin.
WAB-9982: Add the "wallix-debug" command called on the System ❭ Status page. This command creates a ZIP archive with debug information.
WAB-14618: Fix wording in "disk_space_critical" email template.
WAB-14667: Add CCN profiles to "WABSecurityLevel" and to connection policies. These profiles are similar to SOG-IS profiles, without DHE algorithms.

1.16 New functionalities and improvements in WALLIX Bastion 12.2.1

1.16.1 New features

No improvement was part of this version.

1.16.2 Complete list of changes

The following features and improvements have been implemented in this version:

WAB-15198: Slightly increase the /boot partition size to meet future update needs.

1.17 New functionalities and improvements in WALLIX Bastion 12.2

1.17.1 New features

1.17.1.1 WAB-171: Support Web Sessions with Web Session Manager on Bastion

The new WALLIX Web Session Manager solution provides secure access to web applications using remote browser isolation technology. Users can seamlessly access web targets directly from their browser via WALLIX Bastion, without needing plugins or add-ons. Credential can be injected securely to prevent user accessing them. This new native component integrates seamlessly into the WALLIX Bastion ecosystem. Additionally, administrators can control each session by preventing unauthorized redirections or allowing them and managing common behaviors within a user's web session, such as copy/paste, file upload/download, etc.

1.17.1.2 WAB-3123: API Key Associated With A Profile - Bastion

To enhance security and simplify access management, API keys can now be linked to profiles. Default profiles have been introduced to ensure a standardized, reliable configuration tailored to each ecosystem with Access Manager (compatibility starting from version WALLIX Access Manager 5.2).

When upgrading to this version, all existing API keys are automatically updated to use the product_administrator profile.

1.17.1.3 WAB-5327: Support of OpenID Connect (OIDC) - Bastion

WALLIX Bastion and WALLIX Access Manager now support integration with identity providers using the OpenID Connect (OIDC) standard. This enhancement facilitates centralized user management across the entire ecosystem, streamlining deployment within existing infrastructures. With OIDC, users can enjoy Single Sign-On (SSO), making access more seamless and efficient.

1.17.1.4 WAB-5359: Universal Tunneling - Unified UT Client With GUI for Bastion and Access Manager

The new WAMUT client is now available for managing Universal Tunneling sessions on your workstation. It features a graphical interface that enhances visibility into the current session state. Additionally, the user workflow is now unified across both WALLIX Bastion and WALLIX Access Manager.

1.17.1.5 WAB-6558: Universal Tunneling - New Seamless Connection Mode (No Admin Rights requirement and Other Benefits)

The Seamless Connection feature offers a new mode, which no longer requires admin rights on the user workstation. Users still enjoy the same seamless experience, making Universal Tunneling easy to adopt. This new mode also enhances user experience with fat clients using a static port on the user workstation (like TIA Portal, SoMachine, etc.). To enable the workflow for WALLIX Access Manager users, both WALLIX Bastion and WALLIX Access Manager must be upgraded to versions 12.2 and 5.2, respectively.

1.17.1.6 WAB-13752: Support User Authentication With FIDO2 Keys (SSH)

A new authentication for SSH proxy users based on FIDO2 hardware is available. Transfer with agent forwarding (SSH proxy to target) is also supported, if the client used supports it.

1.17.2 Complete list of changes

The following features and improvements have been implemented in this version:

WAB-8567: Improve storage space by adding a dedicated partition for log files.
WAB-9204: Upgrade third-party dependencies in Universal Tunneling client.
WAB-10120: Update of WALLIX's visual identity with the new logo.
WAB-10343: Add a folder dedicated to customers, which can be used to host ticketing script dependencies in Backup/Restore.
WAB-11686: Update "Universal Tunneling" to "WAMUT" in the admin guide.
WAB-11831: Improve the standard application creation form which is now based on the new WALLIX Bastion interface. Administrators can more easily choose from the list of associated target name/cluster fields, simplifying application configuration.
WAB-11832: Update the Targets > Applications page to the new web interface design.
WAB-12248: Add an option to simulate keystrokes in ApplicationDriver to fill the login and password fields of login forms.
WAB-12265: Improve the readability by changing the text for My authorizations tab to Client sessions on the My preferences page .
WAB-13603: Add the 'service_protocol' field in the GET /api/targets (API 3.12) response.
WAB-13636: Add TLS signature algorithm restrictions in Apache configuration, according to the security level.
WAB-13761: Add support of FIDO U2F SSH sk-ssh-ed25519@openssh.com and sk-ecdsa-sha2-nistp256@openssh.com keys.
WAB-13789: Add the ability for UI Automation script of Application Driver to populate the Windows Security window.
WAB-13921: Add Replication monitoring logs in the debug information downloaded from the System > Status page (when requesting basic and advanced log files).
WAB-13994: Improve import time for certificate revocation list (CRL) files.
WAB-14233: Update debian base to 12.11.
WAB-14424: Fix the "SameSite" attribute which was not forced to "Lax" in REST API cookie "api_csrf_token".
WAB-14452: Remove SHA224 and PKCS#1.5 algorithms to ensure SOGIS compliance.
WAB-14473: Remove SHA224 and PKCS#1.5 algorithms to ensure SOGIS compliance.
WAB-14520: Remove the diffie-hellman-group-exchange-sha256 algorithm to ensure SOG-IS compliance, and synchronize SMTP-supported cryptographic algorithms with those used for LDAP.

1.18 New functionalities and improvements in WALLIX Bastion 12.1.1

1.18.1 Complete list of changes

The following features and improvements have been implemented in this version:

WAB-12907: Kerberos method of Windows password change plugins can do password reconciliation.

1.19 New functionalities and improvements in WALLIX Bastion 12.1

1.19.1 New features

1.19.1.1 WAB-3123: API Key Associated With A Profile - Bastion

API keys can be linked to a non-editable profile, restricting the rights of users logging in with an API key. New default non-editable profiles have been introduced to simplify API key configuration with Access Manager (compatibility starting from version 5.2).

1.19.1.2 WAB-5327: Support of OpenID Connect (OIDC) - Bastion

Bastion supports OpenID Connect, enabling seamless authentication with identity providers supporting the standard. This integration enhances security and simplifies user access management. Administrators benefit from streamlined identity federation and improved access control. With Single Sign-On (SSO), users can access Bastion without repeatedly entering credentials.

1.19.1.3 WAB-11037: RDP Session Resolution Set by Bastion Admin

The RDP session resolution can be enforced by the administrator through the RDP connection policy. This new option facilitates connections to servers and systems that support only a specific resolution, preventing display issues or session crashes.

1.19.1.4 WAB-11325: Network Discovery - Latency Measure

In network and AD discovery, latency is now measured for each discovered devices and available in the scan job results.

1.19.2 Complete list of changes

The following features and improvements have been implemented in this version:

WAB-8906: Add a mechanism for checking replication status before launching an update.
WAB-9057: Update Ant Design library to version 5.15.4.
WAB-9342: Remove the domain name field in the DNS section of the System - Network web page and in the WABNetworkConfiguration CLI tool.
WAB-9739: Improve the behavior of the icons in the navigation bar. The menu icons in the navigation bar are no longer hoverable. They are now clickable to display the associated options.
WAB-9762: Add FortiSandbox compatibility for DLP/AV file verification in RDP and SSH sessions.
WAB-10390: Improve Bastion web documentation by adding more guides.
WAB-10816: Add 3 new default profiles that can be used in API keys created for Access Manager.
WAB-10842: Update the Windows password change plugin from v1.0.1 to v2.1.0.
WAB-10847: Add a link to a read-only profile in the API key.
WAB-10960: Remove verbose and useless log lines in bastion-traceman: [file in /var/wab/hash] not in local storage, skipped.
WAB-11050: Add support for specifying which DNS server to use by domain name.
WAB-11151: Improve the debug archive ZIP file available on the System > Status page by offering log download choices.
WAB-11218: Add new API resource /api/apikeys-v2 to set the profile in the API key.
WAB-11330: Add REST API option deprecated_resources to control the use of deprecated resources.
WAB-11331: Deprecate the REST API resource /api/apikeys in favor of the new resource /api/apikeys-v2.
WAB-11392: Add a description field in the API key.
WAB-11425: Fix a SBOM mismatch related to a vendorised and no longer used JQuery component shipped on the Bastion.
WAB-11427: Implement a limited disk space management strategy.
WAB-11458: Add mandatory server certificate validation in the TLS configuration of the SIEM, using a trusted Certificate Authority (CA) or by specifying the self-signed certificate or the CA chain.
WAB-11506: Remove "RDP-JUMPHOST" type connections policies which are no longer used.
WAB-11569: Improve the robustness of HA Database Replication when one node goes down and then back up.
WAB-11618: Add list of groups and profile names in API resource "/api/preferences".
WAB-11681: Add verification and storage of certificates for VNC sessions using the authentication methods X509None, X509Plain, and X509VNC. The configuration is in the VNC connection policy, and the certificates are visible in the GUI via the Devices menu.
WAB-11959: Improve the WALLIX Bastion upgrade workflow by ensuring that the database of all nodes are re-synchronized when HA Database Replication is enabled.
WAB-12236: Add support for checking the SMTP server certificate identity when sending e-mail notifications.
WAB-12292: Increase default password length from 8 to 16 characters in the default password change policy.
WAB-12380: Add the MAC address to the interface selection dialog in the first boot setup wizard and the WABNetworkConfiguration command.
WAB-12410: Add a 4GB quota on the /home partition.
WAB-12706: Add celery.log file in basic log files on System / Status page.
WAB-12890: Update download procedure for WALLIX PuTTY in User Guide.
WAB-13126: Remove deprecated Global Configuration options: allow_gssapi and credential_change_notification_timeout.

1.20 New functionalities and improvements in WALLIX Bastion 12.0.2

1.20.1 New features

1.20.1.1 New procedure for major upgrade

Bastion 12 introduces a new system upgrade procedure. As a result, if you have a WALLIX Bastion prior to version 12 and wish to upgrade to Bastion 12, refer to chapter 6 of the Deployment Guide.

1.20.1.2 New procedure for minor upgrade

Bastion 12 introduces a new minor upgrade process to enhance efficiency and user experience. The new process relies on the wabupgrade account making it easier to upgrade from version 12 to version 12.X. Refer to the Deployment Guide, chapter 7 for detailed instructions.

1.21 New functionalities and improvements in WALLIX Bastion 12.0.1

1.21.1 New features

1.21.1.1 New default behavior for the “Enable Kerberos” option

Bastion 12.0.1 introduces a new default behavior for the “Enable Kerberos” option, enabling it by default which means that NLA Kerberos is now the first attempted authentication method. However, when restoring the backup of a Bastion anterior to 12.0.1, the configuration of authentication mechanisms is not modified. That means that values set for NLA and Kerberos are restored as defined in that backup file. For example, if Enable Kerberos option was disabled, this option remains disabled after the restoration, even if the option is now enabled by default.

Bastion 12.0.1 also introduces new options for RDP target connections. To ensure that the target cannot negotiate an authentication protocol lower than that specified by the connection policy, fallback mechanisms are disabled by default. However, for greater granularity, you can modify fallback mechanisms for connections to RDP targets. The options are:

Allow NLA NTLM fallback
Allow TLS only fallback
Allow RDP legacy fallback

We strongly encourage you to review your connection policies and make any necessary updates to the fallback mechanism to better suit your needs.

WALLIX follows the Microsoft recommendation to use the domain account for RDP sessions. As a result, WALLIX recommends to use NLA Kerberos authentication when using target account in Active Directory. That means the “Allow NLA NTLM fallback”, “Allow TLS only fallback”, and “Allow RDP legacy fallback” options must be disabled.

When using a local account on a target, Microsoft and WALLIX recommend:

to use NLA NTLM if NTLM support is enabled and NLA enabled. In this situation, the “Allow NLA NTLM fallback” option must be enabled, but the “Allow TLS only fallback” and “Allow RDP legacy fallback” options must be disabled.
to use TLS only if NTLM support is disabled and NLA disabled. In this situation, the “Allow TLS only fallback” option must be enabled, but the “Allow NLA NTLM fallback” and the “Allow RDP legacy fallback” options must be disabled.

For earlier targets (windows 2003 and older), you must enable the “Allow RDP legacy fallback” option.

1.21.2 Complete list of changes

The following features and improvements have been implemented in this version:

WAB-8289: Improve product documentation by re-architecturing existing content into six new guides with better-defined target audiences.
WAB-8313: Add bastion-get-auth-statistics script to the Bastion to compute authentication satistics.
WAB-8687: Remove the User > Groups page in the legacy interface, following its refactoring.
WAB-9383: Improve user experience during backup create and restore operations by displaying warning messages and disabling unavailable options.
WAB-9425: Improve user experience when configuring password change policies by clarifying form input and validation.
WAB-9721: Add STATUS_NO_CHANGE_NEEDED return status for password change plugins.
WAB-9812: Add support of SAML forceAuthn parameter to require users reauthentication to their IdP even with an active session.
WAB-9896: Add backup and restore of the ticketing interface script in the Bastion backup.
WAB-9897: Add Password change plugins in backup/restore. In some cases, some plugins are restored aside, for more information, refer to the administration guide to see how and where to restore them.
WAB-10260: Add the number of e-mails sent in the API response to approvers notification (from user and approver).
WAB-10624: Improve default values in some security algorithms parameters in RDP and SSH connection policies.
WAB-10842: Update the Windows password change plugin from v1.0.1 to v2.0.1.

2 Bug fixes

This version includes all fixes implemented from WALLIX Bastion 12.0 and listed in the sections below.

2.1 Bug fixes in WALLIX Bastion 12.5

WAB-7872: Add support for subnets and IP ranges in the source IP restrictions of API keys on the Configuration ❭ API keys page.
WAB-9902: Fix the display of long values in the tooltips of the description column in tables, whose left part could be cut off on wide browser windows.
WAB-11765: Fix the Clear filters button, which was active when no filter was applied on the My authorizations ❭ Sessions and My authorizations ❭ Secrets pages.
WAB-12540: Fix the installation of WALLIX Bastion on NVMe disks.
WAB-15396: Fix the display of the local domains of web applications on the Targets ❭ Domains page with the Local for an application domain type.
WAB-16801: Fix the display of the authorizations on applications, which offered an RDP configuration file to download for web applications when the authorization included the RDP protocol.
WAB-16840: Fix issue causing SIEM log forwarding to fail after a restart when several active SIEM destinations share the same IP address, port and protocol. Only the first of these destinations is now used.
WAB-17016: Fix the error returned by some OIDs of the WALLIX-BASTION-MIB MIB over SNMP (MIBs being unreachable).
WAB-17380: Fix adding the path of a new cluster target to a standard application through the /api/applications REST API endpoint.
WAB-17562: Add the one_time_password_audit_ttl global option to keep the username associated with an OTP and use it in the audit logs.
WAB-18429: Fix the login transformation rule of a WEBAPP connection policy, which did not remove the domain from the login of external users.
WAB-18870: Fix the use of the underscore character (_) in the FQDN of a device.
WAB-19034: Fix the CSV file download on the Audit ❭ Session history page, which ignored the date filter.
WAB-19075: Fix extra spaces in the target name displayed in e-mails sent by WALLIX Bastion, such as approval e-mails.
WAB-19114: Fix the error that occurred when saving changes to a web application imported through a CSV file. Add support for the missing web application parameters in the CSV import and export.
WAB-19288: Fix the “Resource association(s)” section in Targets ❭ Accounts ❭ Global accounts ❭ General so that all previously selected resource associations are displayed when editing an existing account, even beyond 10.
WAB-19293: Fix the search for applications by name in a target group, on the Targets ❭ Groups page. Previously, an application added to the target group with account mapping or interactive login did not appear in the search results.
WAB-19342: Fix the credential injection by WALLIX Web Session Manager in web application sessions with account mapping for users authenticated through OIDC or SAML.
WAB-19349: Add a setting to limit the number of credential injection attempts on web applications.
WAB-19469: Add the missing information to the audit log when an administrator unlocks a user or when WALLIX Bastion automatically disables a local user after an auditor kills their session.
WAB-19515: Fix an error in the Fortinet FortiGate plugin during SSH key rotation.
WAB-19541: Fix the retrieval of session rights and password rights for an LDAP/AD user with the /api/sessionrights and /api/passwordrights REST API endpoints.
WAB-19558: Fix a WALLIX Web Session Manager session disconnection when WALLIX Bastion logged a certificate warning for a certificate whose subject or issuer contains non-standard character encoding.
WAB-19567: Fix the automatic click on the login button after credential injection by WALLIX Web Session Manager on some web applications.
WAB-19647: Fix Kerberos authentication on RDP targets when a connection broker redirects the connection to another server.
WAB-19648: Fix the missing audit log entries for configuration option changes made through the REST API.
WAB-19655: Fix an issue where removing a target from a target group displayed the internal domain am_il_domain in the service of the device.
WAB-19826: Fix the LDAP/AD authentication test, which reported a TLS/SSL handshake failure with the directory server as a generic "server unreachable" error.
WAB-19835: Fix the Windows password change plugin, which handled transient name-to-SID resolution errors on the domain controller as authentication failures. The plugin now retries the operation automatically after these errors.
WAB-19871: Fix the maintenance page displayed when approvers cancel an approval request that they already approved.
WAB-19927: Fix the missing details of application edits made through a CSV import on the Configuration ❭ Audit logs page.
WAB-19930: Remove the audit log entries generated by the automatic polling for pending approvals and by the display of the My authorizations ❭ Approval requests and Audit ❭ Session history pages. WALLIX Bastion still audits session views.
WAB-19944: Fix the replay of SSH sessions ended by a restriction with the kill action in the new web interface.
WAB-20047: Fix the checkout of target accounts containing a backslash () in their name. Previously, the operation failed with an error stating that the target did not exist or was inaccessible.
WAB-20089: Improve the update process by preventing chained updates without a restart, per the documented process.
WAB-20216: Fix the permission check of the PUT /api/accountchangepassword/{account_id}/{credential_type} REST API request, which let any authenticated user change the password or SSH key of a target account. This request now requires the same right as the credential change in the web interface. REST integrations that use this request need this right in their user profile.
WAB-20234: Update the react-router-dom component to version 6.30.6 in the WALLIX Bastion web interface to fix the following security issue: CVE-2026-53668.
WAB-20235: Fix the permission check of the REST API requests that create and modify the restrictions of user groups and target groups, which any authenticated user could use.
WAB-20236: Fix the permission check of the GET /api/licenseinfo REST API request, which returned the license information, including the lists of user names, to any authenticated user.
WAB-20238: Fix the permission check of the GET /api/authdomains/{domain_id} REST API request, which returned the configuration of an authentication domain to any authenticated user.
WAB-20239: Fix the permission check of the GET /api/sessions/files/{session_id} and GET /api/sessions/files/{session_id}/download/{file_id} REST API requests, which let users without audit rights list and download the files transferred during their own sessions.
WAB-20285: Fix the permission check of the POST /api/profiles, PUT /api/profiles/{profile_id}, and DELETE /api/profiles/{profile_id} REST API requests, which looked up the profile before checking the user rights.
WAB-20289: Fix the creation of approval requests in the web interface for targets with interactive login or account mapping.
WAB-20290: Fix the permission check of the GET /api/subprotocols REST API request, which returned the list of subprotocols to any authenticated user.
WAB-20398: Update the pyasn1 package to fix the following security issues reported in the Debian LTS advisory DLA-4778-1: CVE-2026-59884, CVE-2026-59885, CVE-2026-59886.
WAB-20401: Fix the WALLIX Web Session Manager named user license counter, which counted a user only once their session ended.
WAB-20501: Update the libevent package to fix the following security issues reported in the Debian LTS advisory DLA-4786-1: CVE-2026-63379, CVE-2026-63381, CVE-2026-63382, CVE-2026-63383, CVE-2026-63384, CVE-2026-63385, CVE-2026-63387, CVE-2026-63388.
WAB-20502: Update the xz-utils package to version 5.4.1-1+deb12u2 to fix the security issues reported in the Debian LTS advisory DLA-4783-1.
WAB-20629: Update the redis package to fix the following security issues reported in the Debian LTS advisory DLA-4794-1: CVE-2026-81934, CVE-2026-92925.
WAB-20630: Update the openssl package to fix the following security issues reported in the Debian LTS advisory DLA-4795-1: CVE-2026-42767, CVE-2026-54874, CVE-2026-63072, CVE-2026-63074, CVE-2026-63076, CVE-2026-75803.
WAB-20631: Update the tzdata package to apply the time zone changes reported in the Debian LTS advisory DLA-4792-1.
WAB-20644: n/a
WAB-20648: Fix the invalid types in the JSON schemas of the REST and SCIM APIs.
WAB-20786: Update the libdbi-perl package to fix the following security issues reported in the Debian LTS advisory DLA-4798-1: CVE-2026-78030, CVE-2026-88815, CVE-2026-88816.
WAB-20787: Update the lxml package to fix the following security issues reported in the Debian LTS advisory DLA-4799-1: CVE-2026-28348, CVE-2026-28350, CVE-2026-41066, CVE-2026-49825.
WAB-20788: Update the expat package to fix the following security issues reported in the Debian LTS advisory DLA-4807-1: CVE-2024-28757, CVE-2025-59375, CVE-2026-24515, CVE-2026-25210, CVE-2026-32776, CVE-2026-32777, CVE-2026-32778, CVE-2026-45186, CVE-2026-66046, CVE-2026-93990.
WAB-20789: Update the mkvtoolnix package to fix the following security issue reported in the Debian LTS advisory DLA-4805-1: CVE-2026-90783.
WAB-20790: Update the python-django package to fix the following security issues reported in the Debian LTS advisory DLA-4802-1: CVE-2026-48587, CVE-2026-48588.
WAB-20831: Update the pcre2 package to fix the following security issue reported in the Debian LTS advisory DLA-4816-1: CVE-2026-103111.
WAB-21038: Update the python3.11 package to fix the following security issues reported in the Debian LTS advisory DLA-4827-1: CVE-2025-69534, CVE-2026-1502, CVE-2026-3276, CVE-2026-6019, CVE-2026-8328, CVE-2026-9669, CVE-2026-15308, CVE-2026-15310, CVE-2026-15806, CVE-2026-17084, CVE-2026-18503, CVE-2026-19445, CVE-2026-19553.
WAB-21039: Update the libpng1.6 package to fix the following security issue reported in the Debian LTS advisory DLA-4824-1: CVE-2026-46675.
WAB-21040: Update the perl package to fix the following security issues reported in the Debian LTS advisory DLA-4821-1: CVE-2025-15649, CVE-2026-7010, CVE-2026-7017, CVE-2026-8376, CVE-2026-12087, CVE-2026-13221, CVE-2026-19487, CVE-2026-42496, CVE-2026-42497, CVE-2026-48959, CVE-2026-48962, CVE-2026-57432, CVE-2026-57433.
WAB-21113: Fix an authentication bypass in the SSH proxy that let a user connect with a public key without holding the matching private key. Also fix the responses of the SSH proxy to rejected public keys and certificates, so that clients try their next key or authentication method immediately.
WAB-21118: EN: Update the dependencies of the asciinema-player component in the WALLIX Bastion web interface to remove the following security issue: CVE-2026-104846. This issue did not affect the Bastion.
WAB-21119: Update the dependencies of the asciinema-player component in the WALLIX Bastion web interface to remove the following security issue: CVE-2026-104845. This issue did not affect the Bastion.
WAB-21157: Fix the handling of malformed key exchange messages received by the SSH proxy before authentication. The SSH proxy now rejects these messages and closes the connection.
WAB-21159: Fix the integrity verification of received packets in the SSH proxy for sessions using the aes128-gcm@openssh.com or aes256-gcm@openssh.com cipher.
WAB-21160: Fix the handling of malformed or truncated channel, session, and SFTP messages in the SSH proxy. The SSH proxy now refuses these requests, whether they come from an authenticated client or from a target server, and refuses channel open requests with an invalid maximum packet size. SFTP packets larger than 16 MiB close the channel, and SFTP file names that contain invalid UTF-8 no longer close it.
WAB-21161: Improve primary authentication by SSH certificate. User certificates with a principal containing a comma or NUL are rejected, and certificates with no principals are refused by default.

Fix additional user certificate checks. Certificates with a NUL in the key ID, force-command or source-address, duplicate critical options, or malformed option data are now also rejected. * WAB-21162: Fix SSH proxy authentication with FIDO security keys (sk-ecdsa and sk-ed25519), which did not require user presence. These keys must now report user presence (a physical touch), as with OpenSSH. Keys generated with the “-O no-touch-required” option can no longer authenticate, unless they are used with a certificate carrying the no-touch-required extension. * WAB-21163: Fix the SSH proxy, which accepted authentication methods disabled in its configuration when a client requested them. The SSH proxy now also disconnects a client that changes its username during authentication. * WAB-21210: Fix memory corruption when the RDP proxy processes client connection and logon data before authentication. Clients sending more than one network data block at connection are disconnected. * WAB-21211: Fix text conversion, graphics caches, Kerberos credential cache handling and file reads in the RDP proxy. Kerberos authentication to targets requires mutual authentication and confidentiality before credentials are sent. * WAB-21213: Fix issues in the headless client and development and test tools. * WAB-21214: Fix processing of recordings, signatures and configuration values. Command markers such as ${PASSWORD} in application names, accounts and Session Probe arguments are substituted in one pass. With persist_bitmap_cache_on_disk enabled, the persistent bitmap cache is rebuilt for host names containing / or %. * WAB-21215: Fix RDP client capability checks before authentication, including glyph cache sizes. Malformed capabilities from a client or target end the session. * WAB-21217: Fix length checks on RemoteApp program names and arguments forwarded to the target. Overlong fields are truncated. * WAB-21218: Fix processing of glyph (text drawing) orders from RDP targets. Malformed glyph orders are dropped or end the session. * WAB-21219: Fix decompression of RDP data from the target. Corrupted compressed data ends the session. * WAB-21220: Fix RemoteFX graphics decoding in the RDP proxy. Invalid or oversized surfaces and tiles from the target are dropped or end the session. * WAB-21221: Fix rendering of target graphics orders during session recording and OCR. Drawing is clipped to the session screen. * WAB-21222: Fix processing of palette and bitmap updates from RDP targets. Malformed palette updates and bitmaps wider than 65,532 pixels end the session. * WAB-21223: Fix length checks on drawing orders, updates and capabilities from RDP targets. Truncated or inconsistent data ends the session. * WAB-21224: Fix server redirection requests from RDP targets. Overlong redirection fields are truncated. * WAB-21225: Fix TLS failure handling for RDP target connections. A failed TLS handshake or a certificate rejected by the [server_cert] policy ends the connection instead of continuing unencrypted. * WAB-21226: Fix Standard RDP Security checks on client data when [client] tls_fallback_legacy is enabled. Unencrypted data or data with an invalid integrity check ends the session. * WAB-21227: Fix enforcement of drive redirection read and write permissions. Without write permission, the target cannot create, modify, rename or delete files or change their attributes. Applications opening files for writing on a read-only redirected drive may receive access-denied errors. * WAB-21228: Fix virtual channel filtering and clipboard antivirus/DLP checks. Virtual channel data marked as compressed ends the session; clipboard file data beyond the announced size is refused. * WAB-21229: Fix file access confinement on proxy-managed drives, including the Session Probe launcher drive. Target requests outside the drive or using another drive's file handle are refused. * WAB-21230: Fix length checks on clipboard and drive redirection data. Malformed messages from a client or target are refused or end the session. * WAB-21231: Fix ZRLE decoding and file transfer error handling for VNC targets. Invalid ZRLE data from the target ends the session. * WAB-21232: Fix resource limits on desktop sizes, bitmaps, drive redirection and Session Probe file reads requested by RDP targets. Desktops exceeding 32,766 pixels per dimension or 67,108,864 pixels in total area (8,192 x 8,192) end the session, including multi-monitor layouts. * WAB-21233: Fix memory use for client device announcements and messages on very narrow screens. Devices announced with more than 1 MiB of data are not redirected, and a warning is logged. * WAB-21234: Fix file transfer auditing for drive redirection and clipboard. Transfers on drives removed during the session are audited, and clipboard file names and sizes are logged correctly. * WAB-21235: Fix RDP proxy logging of session secrets and user file names. The auto-reconnect cookie is no longer logged, drive directory listings require drive redirection debug verbosity, and CredSSP/NLA debug traces show only credential lengths. * WAB-21236: Fix reading and verification of altered session recordings. The “redver” tool rejects recordings without a checksum, including archived version 1 recordings, unless the “--allow-nochecksum” option is specified. * WAB-21237: Fix the “wallixcelery” service running out of memory after unlocking the encryption key, on Bastions with limited memory and many accounts. This prevented the automatic check-in of expired checkouts. * WAB-21244: Fix memory corruption during SSH proxy user authentication with Kerberos (GSSAPI). Malformed or repeated GSSAPI authentication messages are now refused. * WAB-21245: Fix numeric option parsing and agent request forwarding in the SSH proxy. Malformed or out-of-range numeric values are refused instead of truncated. * WAB-21247: Fix resource leaks and error handling in SSH proxy Kerberos (GSSAPI) authentication. Kerberos tokens are no longer written to packet-level logs. * WAB-21248: Fix key exchange message and value validation and failure handling in the SSH proxy. Peers are disconnected if they send malformed or out-of-range key exchange values or keep the same keys for 2^32 packets. * WAB-21249: Fix credential and key cleanup in the SSH proxy. Target passwords, X11 cookies, private key material and session keys are now wiped from memory after use. * WAB-21250: Fix SSH proxy restriction patterns with inline flags or verbose-mode comments, SFTP sessions using protocol versions other than 3, and IPv6 UDP recording. These patterns now apply correctly, the requested SFTP version is capped at 3, and IPv6 UDP flows are recorded. * WAB-21251: Fix validation of received packets, version banners and protocol fields in the SSH proxy. Malformed SSH packet layouts now end the connection, and client version lines up to 255 bytes are accepted. * WAB-21252: Fix SSH proxy signature algorithm checks and authentication method selection for targets. Public key signatures must use the requested algorithm, and method names must match in full. SHA-2 signatures for ssh-rsa certificates and clients based on OpenSSH 7.0 to 7.7 remain accepted. * WAB-21253: Fix memory corruption when an SSH target sends an invalid host key signature during key exchange. The SSH proxy now fails the connection cleanly. * WAB-21254: Fix SSH proxy host key verification, which accepted a new key type from a known target. Targets that no longer offer their stored host key type are now refused; the error names the received and stored key types. * WAB-21255: Fix memory corruption in the terminal emulator used by the SSH proxy for real-time session display and transcripts. Combining characters, wide characters and terminal resizes now render correctly in transcripts. * WAB-21256: Fix SSH proxy command restriction and file transfer analysis handling. Analysis errors now close the channel, and restriction patterns apply to lines with invalid UTF-8. Data matching a warning pattern is discarded in full, and data accepted by the target in several parts is recorded once. * WAB-21258: Fix unbounded memory and CPU use in SSH proxy channel handling and Telnet option negotiation. Peers sending data well past the granted window are disconnected. * WAB-21259: Fix SSH proxy log injection through client or target text, including banners and disconnect messages. Control characters and invalid UTF-8 in this text are now escaped in logs and error messages. * WAB-21336: Update the MariaDB package to fix the following security issues: CVE-2026-47023, CVE-2026-60184, CVE-2026-60331, CVE-2026-60585, CVE-2026-60747, CVE-2026-61081. * WAB-21337: Update the linux package to fix the following security issues: CVE-2023-52629, CVE-2023-52676, CVE-2023-53231, CVE-2023-53336, CVE-2023-53353, CVE-2023-53429, CVE-2023-53491, CVE-2023-53538, CVE-2023-53574, CVE-2023-53627, CVE-2023-53762, CVE-2023-53851, CVE-2023-53857, CVE-2023-53999, CVE-2023-54227, CVE-2023-54233, CVE-2024-35887, CVE-2024-49568, CVE-2024-50017, CVE-2024-50029, CVE-2024-58097, CVE-2025-21649, CVE-2025-21651, CVE-2025-21759, CVE-2025-22039, CVE-2025-22103, CVE-2025-23129, CVE-2025-37833, CVE-2025-40074, CVE-2025-40097, CVE-2025-68190, CVE-2025-68736, CVE-2026-23191, CVE-2026-23447, CVE-2026-23448, CVE-2026-31420, CVE-2026-43088, CVE-2026-43198, CVE-2026-43288, CVE-2026-45897, CVE-2026-46090, CVE-2026-52944, CVE-2026-52988, CVE-2026-53005, CVE-2026-53078, CVE-2026-64210, CVE-2026-68097, CVE-2026-68161, CVE-2026-68236, CVE-2026-68286, CVE-2026-68287, CVE-2026-68288, CVE-2026-68289, CVE-2026-68391, CVE-2026-72334, CVE-2026-72402, CVE-2026-72413, CVE-2026-74268, CVE-2026-74289, CVE-2026-74294, CVE-2026-74334, CVE-2026-74474, CVE-2026-74496, CVE-2026-74521, CVE-2026-74565, CVE-2026-80521, CVE-2026-80671, CVE-2026-80689, CVE-2026-80833, CVE-2026-80834, CVE-2026-80912, CVE-2026-80914, CVE-2026-80928, CVE-2026-80930, CVE-2026-80931, CVE-2026-80932, CVE-2026-80938, CVE-2026-80941, CVE-2026-80944, CVE-2026-80949, CVE-2026-80951, CVE-2026-80952, CVE-2026-80963, CVE-2026-80964, CVE-2026-80965, CVE-2026-80966, CVE-2026-80967, CVE-2026-80968, CVE-2026-80969, CVE-2026-80971, CVE-2026-80972, CVE-2026-80973, CVE-2026-80976, CVE-2026-80977, CVE-2026-80978, CVE-2026-80982, CVE-2026-80983, CVE-2026-80987, CVE-2026-80988, CVE-2026-80992, CVE-2026-80994, CVE-2026-81000, CVE-2026-81001, CVE-2026-81002, CVE-2026-81003, CVE-2026-81005, CVE-2026-81007, CVE-2026-81008, CVE-2026-81017, CVE-2026-89440, CVE-2026-89444, CVE-2026-89456, CVE-2026-89457, CVE-2026-89458, CVE-2026-89461, CVE-2026-89463, CVE-2026-89464, CVE-2026-89469, CVE-2026-89470, CVE-2026-89471, CVE-2026-89474, CVE-2026-89475, CVE-2026-89476, CVE-2026-89477, CVE-2026-89478, CVE-2026-89479, CVE-2026-89480, CVE-2026-89481, CVE-2026-89482, CVE-2026-89483, CVE-2026-89485, CVE-2026-89487, CVE-2026-89488, CVE-2026-89489, CVE-2026-89490, CVE-2026-89491, CVE-2026-89493, CVE-2026-89494, CVE-2026-89495, CVE-2026-89496, CVE-2026-89497, CVE-2026-89498, CVE-2026-89504, CVE-2026-89508, CVE-2026-89510, CVE-2026-89511, CVE-2026-89512, CVE-2026-89515, CVE-2026-89524, CVE-2026-89525, CVE-2026-89532, CVE-2026-89533, CVE-2026-89538, CVE-2026-89540, CVE-2026-89541, CVE-2026-89542, CVE-2026-89548, CVE-2026-89549, CVE-2026-89551, CVE-2026-89554, CVE-2026-89555, CVE-2026-89557, CVE-2026-89559, CVE-2026-89560, CVE-2026-89562, CVE-2026-89563, CVE-2026-89565, CVE-2026-89569, CVE-2026-89573, CVE-2026-89575, CVE-2026-89576, CVE-2026-89579, CVE-2026-89582, CVE-2026-89583, CVE-2026-89585, CVE-2026-89586, CVE-2026-89587, CVE-2026-89594, CVE-2026-89595, CVE-2026-89596, CVE-2026-89597, CVE-2026-89599, CVE-2026-89604, CVE-2026-89605, CVE-2026-89606, CVE-2026-89607, CVE-2026-89608, CVE-2026-89609, CVE-2026-89615, CVE-2026-89616, CVE-2026-89617, CVE-2026-89621, CVE-2026-89626, CVE-2026-89627, CVE-2026-89628, CVE-2026-89634, CVE-2026-89636, CVE-2026-89640, CVE-2026-89643, CVE-2026-89649, CVE-2026-89650, CVE-2026-89653, CVE-2026-89655, CVE-2026-89656, CVE-2026-89662, CVE-2026-89663, CVE-2026-89665, CVE-2026-89669, CVE-2026-89674, CVE-2026-89684, CVE-2026-89694, CVE-2026-89696, CVE-2026-89697, CVE-2026-89699, CVE-2026-89704, CVE-2026-89706, CVE-2026-89710, CVE-2026-89711, CVE-2026-89712, CVE-2026-89720, CVE-2026-89723, CVE-2026-89724, CVE-2026-89725, CVE-2026-89726, CVE-2026-89729, CVE-2026-89730, CVE-2026-89732, CVE-2026-89733, CVE-2026-89736, CVE-2026-89741, CVE-2026-89742, CVE-2026-89744, CVE-2026-89746, CVE-2026-89749, CVE-2026-89751, CVE-2026-89752, CVE-2026-89753, CVE-2026-89756, CVE-2026-89765, CVE-2026-89776, CVE-2026-89777, CVE-2026-89778, CVE-2026-89779, CVE-2026-89780, CVE-2026-89781, CVE-2026-89782, CVE-2026-89783, CVE-2026-89784, CVE-2026-89785, CVE-2026-89786, CVE-2026-89787, CVE-2026-89789, CVE-2026-89792, CVE-2026-89796, CVE-2026-89816, CVE-2026-89817, CVE-2026-89818, CVE-2026-89821, CVE-2026-89822, CVE-2026-89823, CVE-2026-89824, CVE-2026-89843, CVE-2026-89845, CVE-2026-89846, CVE-2026-89847, CVE-2026-89849, CVE-2026-89850, CVE-2026-89851, CVE-2026-89852, CVE-2026-89853, CVE-2026-89854, CVE-2026-89855, CVE-2026-89856, CVE-2026-89858, CVE-2026-89861, CVE-2026-89863, CVE-2026-89864, CVE-2026-89865, CVE-2026-89870, CVE-2026-89871, CVE-2026-89872, CVE-2026-89876, CVE-2026-89877, CVE-2026-89878, CVE-2026-89879, CVE-2026-89880, CVE-2026-89881, CVE-2026-89883, CVE-2026-89887, CVE-2026-89888, CVE-2026-89890, CVE-2026-89891, CVE-2026-89892, CVE-2026-89893, CVE-2026-89894, CVE-2026-89895, CVE-2026-89896, CVE-2026-89897, CVE-2026-89901, CVE-2026-89922, CVE-2026-89923, CVE-2026-89924, CVE-2026-89925, CVE-2026-89926, CVE-2026-89927, CVE-2026-89930, CVE-2026-89932, CVE-2026-89936, CVE-2026-89937, CVE-2026-89939, CVE-2026-89945, CVE-2026-89946, CVE-2026-89947, CVE-2026-89948, CVE-2026-89949, CVE-2026-89951, CVE-2026-89952, CVE-2026-89953, CVE-2026-89954, CVE-2026-89957, CVE-2026-89959, CVE-2026-89964, CVE-2026-89965, CVE-2026-89968, CVE-2026-89969, CVE-2026-89970, CVE-2026-89973, CVE-2026-89979, CVE-2026-89980, CVE-2026-89982, CVE-2026-89983, CVE-2026-89984, CVE-2026-89988, CVE-2026-89989, CVE-2026-89992, CVE-2026-89993, CVE-2026-89997, CVE-2026-89998, CVE-2026-89999, CVE-2026-90000, CVE-2026-90003, CVE-2026-90007, CVE-2026-90011, CVE-2026-90015, CVE-2026-90017, CVE-2026-90018, CVE-2026-90019, CVE-2026-90020, CVE-2026-90025, CVE-2026-90031, CVE-2026-90032, CVE-2026-90033, CVE-2026-90034, CVE-2026-90049, CVE-2026-90053, CVE-2026-90054, CVE-2026-90055, CVE-2026-90056, CVE-2026-90057, CVE-2026-90058, CVE-2026-90060, CVE-2026-90062, CVE-2026-90063, CVE-2026-90067, CVE-2026-90068, CVE-2026-90070, CVE-2026-90071, CVE-2026-90072, CVE-2026-90073, CVE-2026-90074, CVE-2026-90075, CVE-2026-90078, CVE-2026-90081, CVE-2026-90088, CVE-2026-90090, CVE-2026-90091, CVE-2026-90092, CVE-2026-90102, CVE-2026-90103, CVE-2026-90107, CVE-2026-90108, CVE-2026-90110, CVE-2026-90114, CVE-2026-90122, CVE-2026-90124, CVE-2026-90126, CVE-2026-90128, CVE-2026-90140, CVE-2026-90141, CVE-2026-90143, CVE-2026-90151, CVE-2026-90157, CVE-2026-90160, CVE-2026-90176, CVE-2026-90180, CVE-2026-90184, CVE-2026-90185, CVE-2026-90186, CVE-2026-90188, CVE-2026-90189, CVE-2026-90190, CVE-2026-90194, CVE-2026-90196, CVE-2026-90198, CVE-2026-90202, CVE-2026-90203, CVE-2026-90207, CVE-2026-90209, CVE-2026-90214, CVE-2026-90216, CVE-2026-90218, CVE-2026-90219, CVE-2026-90221, CVE-2026-90222, CVE-2026-90223, CVE-2026-90224, CVE-2026-90225, CVE-2026-90226, CVE-2026-90228, CVE-2026-90245, CVE-2026-90248, CVE-2026-90249, CVE-2026-90251, CVE-2026-90253, CVE-2026-90254, CVE-2026-90255, CVE-2026-90257, CVE-2026-90274, CVE-2026-90281, CVE-2026-90283, CVE-2026-90284, CVE-2026-90285, CVE-2026-90286, CVE-2026-90287, CVE-2026-90290, CVE-2026-90292, CVE-2026-90293, CVE-2026-90294, CVE-2026-90295, CVE-2026-90296, CVE-2026-90297, CVE-2026-90298, CVE-2026-90302, CVE-2026-90303, CVE-2026-90307, CVE-2026-90309, CVE-2026-90314, CVE-2026-90316, CVE-2026-90318, CVE-2026-90319, CVE-2026-90327, CVE-2026-90329, CVE-2026-90334, CVE-2026-90341, CVE-2026-90348, CVE-2026-90352, CVE-2026-90353, CVE-2026-90354, CVE-2026-90357, CVE-2026-90360, CVE-2026-90361, CVE-2026-90362, CVE-2026-90372, CVE-2026-90378, CVE-2026-90382, CVE-2026-90386, CVE-2026-90388, CVE-2026-90391, CVE-2026-90393, CVE-2026-90394, CVE-2026-90395, CVE-2026-90403, CVE-2026-90411, CVE-2026-90413, CVE-2026-90414, CVE-2026-90415, CVE-2026-90416, CVE-2026-90419, CVE-2026-90420, CVE-2026-90431, CVE-2026-90434, CVE-2026-90435, CVE-2026-92476, CVE-2026-92477, CVE-2026-92481, CVE-2026-92494, CVE-2026-92496, CVE-2026-92498, CVE-2026-92501, CVE-2026-92504, CVE-2026-92507, CVE-2026-92508, CVE-2026-92509, CVE-2026-92510, CVE-2026-92511, CVE-2026-92512, CVE-2026-92514, CVE-2026-92521, CVE-2026-92522, CVE-2026-92523, CVE-2026-92524, CVE-2026-92525, CVE-2026-93037, CVE-2026-93039, CVE-2026-93040, CVE-2026-93041, CVE-2026-93046, CVE-2026-93048, CVE-2026-93049, CVE-2026-93050, CVE-2026-93051, CVE-2026-93052, CVE-2026-93053, CVE-2026-93054, CVE-2026-93055, CVE-2026-93056, CVE-2026-93061, CVE-2026-93063, CVE-2026-93064, CVE-2026-93067, CVE-2026-93073, CVE-2026-93095, CVE-2026-93098, CVE-2026-93102, CVE-2026-93103, CVE-2026-93108, CVE-2026-93109, CVE-2026-93110, CVE-2026-93114, CVE-2026-93115, CVE-2026-93117, CVE-2026-93118, CVE-2026-93120, CVE-2026-93130, CVE-2026-93131, CVE-2026-93136, CVE-2026-93137, CVE-2026-93138, CVE-2026-93140, CVE-2026-93141, CVE-2026-93142, CVE-2026-93145, CVE-2026-93149, CVE-2026-93151, CVE-2026-93152, CVE-2026-93158, CVE-2026-93159, CVE-2026-93160, CVE-2026-93161, CVE-2026-93165, CVE-2026-93167, CVE-2026-93170, CVE-2026-93177, CVE-2026-93178, CVE-2026-93182, CVE-2026-93183, CVE-2026-93185, CVE-2026-93188, CVE-2026-93189, CVE-2026-93190, CVE-2026-93191, CVE-2026-93203, CVE-2026-93204, CVE-2026-93206, CVE-2026-93210, CVE-2026-93213, CVE-2026-93214, CVE-2026-93219, CVE-2026-93222, CVE-2026-93226, CVE-2026-93234, CVE-2026-93236, CVE-2026-93242, CVE-2026-93245, CVE-2026-93247, CVE-2026-93252, CVE-2026-93256, CVE-2026-93261, CVE-2026-93262, CVE-2026-93264, CVE-2026-93268, CVE-2026-93271, CVE-2026-93274, CVE-2026-93278, CVE-2026-93279, CVE-2026-93280, CVE-2026-93281, CVE-2026-93283, CVE-2026-93286, CVE-2026-93287, CVE-2026-93288, CVE-2026-93781, CVE-2026-93782, CVE-2026-93783, CVE-2026-93784, CVE-2026-93785, CVE-2026-93787, CVE-2026-93788, CVE-2026-93789, CVE-2026-93795, CVE-2026-93797, CVE-2026-93798, CVE-2026-93800, CVE-2026-93802, CVE-2026-93803, CVE-2026-93805, CVE-2026-93806, CVE-2026-93807, CVE-2026-93808, CVE-2026-93810, CVE-2026-93811, CVE-2026-93812, CVE-2026-93813, CVE-2026-93814, CVE-2026-93815, CVE-2026-93816, CVE-2026-93819, CVE-2026-93820, CVE-2026-93821, CVE-2026-93822, CVE-2026-93824, CVE-2026-93825, CVE-2026-93826, CVE-2026-93830, CVE-2026-97407, CVE-2026-97408, CVE-2026-97411, CVE-2026-97413, CVE-2026-97415, CVE-2026-97416, CVE-2026-97417, CVE-2026-97418, CVE-2026-97419, CVE-2026-97420, CVE-2026-97421, CVE-2026-97427, CVE-2026-97430, CVE-2026-97434, CVE-2026-97435, CVE-2026-97436, CVE-2026-97437, CVE-2026-97438, CVE-2026-97439, CVE-2026-97440, CVE-2026-97441, CVE-2026-97442, CVE-2026-97444, CVE-2026-97445, CVE-2026-97446, CVE-2026-97448, CVE-2026-97449, CVE-2026-97450, CVE-2026-97451, CVE-2026-97452, CVE-2026-97453, CVE-2026-97454, CVE-2026-97455, CVE-2026-97456, CVE-2026-97472, CVE-2026-97475, CVE-2026-97476, CVE-2026-97481, CVE-2026-97482, CVE-2026-97483, CVE-2026-97484, CVE-2026-97485, CVE-2026-97486, CVE-2026-97487, CVE-2026-97488, CVE-2026-97489, CVE-2026-97490, CVE-2026-97491, CVE-2026-97492, CVE-2026-97495, CVE-2026-97497, CVE-2026-97502, CVE-2026-97506, CVE-2026-97507, CVE-2026-97508, CVE-2026-97509, CVE-2026-97510, CVE-2026-97516, CVE-2026-97517, CVE-2026-97523, CVE-2026-97524, CVE-2026-97539, CVE-2026-97540, CVE-2026-97541, CVE-2026-97556, CVE-2026-97557, CVE-2026-97564, CVE-2026-97568, CVE-2026-97572, CVE-2026-97573, CVE-2026-97576, CVE-2026-97581, CVE-2026-97582, CVE-2026-97592, CVE-2026-97596, CVE-2026-97598, CVE-2026-97601, CVE-2026-97604, CVE-2026-97608, CVE-2026-97611, CVE-2026-97612, CVE-2026-97899, CVE-2026-97904, CVE-2026-97905, CVE-2026-97909, CVE-2026-97910, CVE-2026-97920, CVE-2026-97921, CVE-2026-97922, CVE-2026-97923, CVE-2026-97925, CVE-2026-97926, CVE-2026-97927, CVE-2026-97930, CVE-2026-97931, CVE-2026-97940, CVE-2026-97948, CVE-2026-97951, CVE-2026-97952, CVE-2026-97954, CVE-2026-97957, CVE-2026-97958, CVE-2026-97959, CVE-2026-97963, CVE-2026-97964, CVE-2026-97969, CVE-2026-97970, CVE-2026-97973, CVE-2026-97977, CVE-2026-97979, CVE-2026-97981, CVE-2026-97982, CVE-2026-97986, CVE-2026-97987, CVE-2026-97991, CVE-2026-97993, CVE-2026-97995, CVE-2026-97998, CVE-2026-98006, CVE-2026-98008, CVE-2026-98009, CVE-2026-98010, CVE-2026-98011, CVE-2026-98012, CVE-2026-98013, CVE-2026-98014, CVE-2026-98015, CVE-2026-98016, CVE-2026-98017, CVE-2026-98022, CVE-2026-98023, CVE-2026-98025, CVE-2026-98027, CVE-2026-98030, CVE-2026-98031, CVE-2026-98046, CVE-2026-98055, CVE-2026-98063, CVE-2026-98064, CVE-2026-98066, CVE-2026-98068, CVE-2026-98069, CVE-2026-98070, CVE-2026-98071, CVE-2026-98072, CVE-2026-98074, CVE-2026-98075, CVE-2026-98076, CVE-2026-98077, CVE-2026-98078, CVE-2026-98080, CVE-2026-98088, CVE-2026-98089, CVE-2026-98090, CVE-2026-98091, CVE-2026-98092, CVE-2026-98094, CVE-2026-98095, CVE-2026-98096, CVE-2026-98098, CVE-2026-98104, CVE-2026-98108, CVE-2026-98113, CVE-2026-98116, CVE-2026-98121, CVE-2026-98123, CVE-2026-98128, CVE-2026-98129, CVE-2026-98130, CVE-2026-98154, CVE-2026-98157, CVE-2026-98158, CVE-2026-98159, CVE-2026-98160, CVE-2026-98167, CVE-2026-98169, CVE-2026-98171, CVE-2026-98172, CVE-2026-98181, CVE-2026-98185, CVE-2026-98186, CVE-2026-98187, CVE-2026-98188, CVE-2026-98189, CVE-2026-98190, CVE-2026-98191, CVE-2026-98194, CVE-2026-98195, CVE-2026-98196, CVE-2026-98197, CVE-2026-98199, CVE-2026-98201, CVE-2026-98202, CVE-2026-98203, CVE-2026-98204, CVE-2026-98205, CVE-2026-98207, CVE-2026-98208, CVE-2026-98209, CVE-2026-98210, CVE-2026-98213, CVE-2026-98217, CVE-2026-98221, CVE-2026-98227, CVE-2026-98233, CVE-2026-98234, CVE-2026-98236, CVE-2026-98237, CVE-2026-98238, CVE-2026-98239, CVE-2026-98241, CVE-2026-98246, CVE-2026-98247, CVE-2026-98249, CVE-2026-98251, CVE-2026-98252, CVE-2026-98253, CVE-2026-98255, CVE-2026-98257, CVE-2026-98260, CVE-2026-98262, CVE-2026-98264, CVE-2026-98272, CVE-2026-98275, CVE-2026-98276, CVE-2026-98282, CVE-2026-98283, CVE-2026-98287, CVE-2026-98290, CVE-2026-98298, CVE-2026-98299, CVE-2026-98300, CVE-2026-98301, CVE-2026-98302, CVE-2026-98303, CVE-2026-98306, CVE-2026-98308, CVE-2026-98311, CVE-2026-98312, CVE-2026-98314, CVE-2026-98319, CVE-2026-98320, CVE-2026-98322, CVE-2026-98323, CVE-2026-98325, CVE-2026-98326, CVE-2026-98328, CVE-2026-98331, CVE-2026-98339, CVE-2026-98340, CVE-2026-98342, CVE-2026-98343, CVE-2026-98344, CVE-2026-98345, CVE-2026-98347, CVE-2026-98348, CVE-2026-98349, CVE-2026-98351, CVE-2026-98352, CVE-2026-98354, CVE-2026-98357, CVE-2026-98358, CVE-2026-98359, CVE-2026-98360, CVE-2026-98362, CVE-2026-98363, CVE-2026-98367, CVE-2026-98368, CVE-2026-98369, CVE-2026-98370, CVE-2026-98374, CVE-2026-98378, CVE-2026-98379, CVE-2026-98380, CVE-2026-98381, CVE-2026-98383, CVE-2026-98388, CVE-2026-98398, CVE-2026-98402, CVE-2026-98404, CVE-2026-98406, CVE-2026-98407, CVE-2026-98410, CVE-2026-98413, CVE-2026-98416, CVE-2026-98417, CVE-2026-98419, CVE-2026-98421, CVE-2026-98422, CVE-2026-98423, CVE-2026-98426, CVE-2026-98428, CVE-2026-98429, CVE-2026-98430, CVE-2026-98432, CVE-2026-99999, CVE-2026-100070, CVE-2026-100071, CVE-2026-100075, CVE-2026-100078. * WAB-21343: Fix the Windows password change over WinRM: a single quote or a typographic quote in the login or the new password of an account is now escaped and no longer interpreted as PowerShell code. * WAB-21358: Update the python-django package to fix the following security issues: CVE-2026-77050, CVE-2026-87975. * WAB-21379: Update the libssh package to fix the following security issues: CVE-2026-0964, CVE-2026-0965, CVE-2026-0966, CVE-2026-0967, CVE-2026-0968, CVE-2026-3731, CVE-2026-59843, CVE-2026-59844, CVE-2026-59845, CVE-2026-59846, CVE-2026-59847, CVE-2026-59848, CVE-2026-59850. * WAB-21380: Update the ca-certificates package to fix the security issues reported in the Debian advisory DLA-4845-1.

2.2 Bug fixes in WALLIX Bastion 12.4.5

WAB-20210: Update the libssh2 package to fix the following security issues: CVE-2025-15661, CVE-2026-7598, CVE-2026-58050, CVE-2026-58051, CVE-2026-66032, CVE-2026-66034.
WAB-20211: Update the libass package to fix the following security issue: CVE-2026-61627.
WAB-20212: Update the aom package to fix the following security issues: CVE-2026-56208, CVE-2026-56209, CVE-2026-56210, CVE-2026-56211.
WAB-20213: Update the pcre2 package to fix the security issues reported in the Debian advisory DLA-4772-1.
WAB-20230: Update the linux package to fix the following security issues: CVE-2023-53706, CVE-2023-54141, CVE-2023-54263, CVE-2024-38620, CVE-2024-46754, CVE-2024-58094, CVE-2024-58095, CVE-2025-22104, CVE-2025-38117, CVE-2025-38203, CVE-2025-38206, CVE-2025-38237, CVE-2025-38616, CVE-2025-39833, CVE-2025-39901, CVE-2025-39925, CVE-2025-40054, CVE-2025-40064, CVE-2025-40102, CVE-2025-40139, CVE-2025-40168, CVE-2025-40206, CVE-2025-40307, CVE-2025-68794, CVE-2026-23394, CVE-2026-31419, CVE-2026-43491, CVE-2026-45963, CVE-2026-46111, CVE-2026-46158, CVE-2026-46170, CVE-2026-46266, CVE-2026-53089, CVE-2026-53090, CVE-2026-53361, CVE-2026-64082, CVE-2026-64139, CVE-2026-64192, CVE-2026-64270, CVE-2026-64272, CVE-2026-64280, CVE-2026-64294, CVE-2026-64434, CVE-2026-64507, CVE-2026-64508, CVE-2026-64542, CVE-2026-64543, CVE-2026-64561, CVE-2026-64562, CVE-2026-64563, CVE-2026-64564, CVE-2026-64565, CVE-2026-64567, CVE-2026-64569, CVE-2026-64571, CVE-2026-64572, CVE-2026-64573, CVE-2026-64576, CVE-2026-64577, CVE-2026-64578, CVE-2026-64579, CVE-2026-64580, CVE-2026-64581, CVE-2026-64582, CVE-2026-64583, CVE-2026-64584, CVE-2026-64586, CVE-2026-64590, CVE-2026-68082, CVE-2026-68093, CVE-2026-68096, CVE-2026-68099, CVE-2026-68100, CVE-2026-68104, CVE-2026-68106, CVE-2026-68108, CVE-2026-68111, CVE-2026-68115, CVE-2026-68117, CVE-2026-68121, CVE-2026-68123, CVE-2026-68124, CVE-2026-68125, CVE-2026-68127, CVE-2026-68129, CVE-2026-68130, CVE-2026-68131, CVE-2026-68132, CVE-2026-68135, CVE-2026-68136, CVE-2026-68137, CVE-2026-68138, CVE-2026-68140, CVE-2026-68141, CVE-2026-68142, CVE-2026-68143, CVE-2026-68144, CVE-2026-68146, CVE-2026-68147, CVE-2026-68148, CVE-2026-68151, CVE-2026-68153, CVE-2026-68154, CVE-2026-68155, CVE-2026-68156, CVE-2026-68157, CVE-2026-68158, CVE-2026-68159, CVE-2026-68160, CVE-2026-68162, CVE-2026-68164, CVE-2026-68165, CVE-2026-68169, CVE-2026-68175, CVE-2026-68176, CVE-2026-68180, CVE-2026-68181, CVE-2026-68182, CVE-2026-68183, CVE-2026-68184, CVE-2026-68186, CVE-2026-68187, CVE-2026-68188, CVE-2026-68189, CVE-2026-68190, CVE-2026-68192, CVE-2026-68194, CVE-2026-68195, CVE-2026-68196, CVE-2026-68197, CVE-2026-68198, CVE-2026-68199, CVE-2026-68202, CVE-2026-68204, CVE-2026-68206, CVE-2026-68207, CVE-2026-68209, CVE-2026-68210, CVE-2026-68212, CVE-2026-68213, CVE-2026-68214, CVE-2026-68215, CVE-2026-68216, CVE-2026-68217, CVE-2026-68218, CVE-2026-68222, CVE-2026-68223, CVE-2026-68226, CVE-2026-68227, CVE-2026-68229, CVE-2026-68231, CVE-2026-68234, CVE-2026-68243, CVE-2026-68244, CVE-2026-68246, CVE-2026-68248, CVE-2026-68249, CVE-2026-68250, CVE-2026-68251, CVE-2026-68253, CVE-2026-68254, CVE-2026-68255, CVE-2026-68259, CVE-2026-68269, CVE-2026-68277, CVE-2026-68278, CVE-2026-68279, CVE-2026-68280, CVE-2026-68284, CVE-2026-68294, CVE-2026-68297, CVE-2026-68299, CVE-2026-68300, CVE-2026-68301, CVE-2026-68302, CVE-2026-68304, CVE-2026-68309, CVE-2026-68310, CVE-2026-68313, CVE-2026-68315, CVE-2026-68320, CVE-2026-68322, CVE-2026-68324, CVE-2026-68325, CVE-2026-68326, CVE-2026-68327, CVE-2026-68328, CVE-2026-68331, CVE-2026-68333, CVE-2026-68335, CVE-2026-68336, CVE-2026-68338, CVE-2026-68340, CVE-2026-68343, CVE-2026-68344, CVE-2026-68349, CVE-2026-68350, CVE-2026-68351, CVE-2026-68352, CVE-2026-68353, CVE-2026-68354, CVE-2026-68355, CVE-2026-68357, CVE-2026-68359, CVE-2026-68360, CVE-2026-68361, CVE-2026-68362, CVE-2026-68363, CVE-2026-68365, CVE-2026-68366, CVE-2026-68367, CVE-2026-68368, CVE-2026-68369, CVE-2026-68370, CVE-2026-68371, CVE-2026-68373, CVE-2026-68376, CVE-2026-68377, CVE-2026-68386, CVE-2026-68388, CVE-2026-68395, CVE-2026-68397, CVE-2026-68398, CVE-2026-68402, CVE-2026-68403, CVE-2026-68405, CVE-2026-68406, CVE-2026-68407, CVE-2026-68410, CVE-2026-68411, CVE-2026-68413, CVE-2026-68414, CVE-2026-68417, CVE-2026-68422, CVE-2026-68425, CVE-2026-68427, CVE-2026-68428, CVE-2026-68430, CVE-2026-68431, CVE-2026-68432, CVE-2026-68433, CVE-2026-68434, CVE-2026-68444, CVE-2026-68446, CVE-2026-68450, CVE-2026-68451, CVE-2026-68452, CVE-2026-68476, CVE-2026-68480, CVE-2026-72012, CVE-2026-72015, CVE-2026-72017, CVE-2026-72023, CVE-2026-72030, CVE-2026-72035, CVE-2026-72040, CVE-2026-72041, CVE-2026-72045, CVE-2026-72051, CVE-2026-72057, CVE-2026-72062, CVE-2026-72063, CVE-2026-72065, CVE-2026-72069, CVE-2026-72070, CVE-2026-72077, CVE-2026-72096, CVE-2026-72099, CVE-2026-72110, CVE-2026-72113, CVE-2026-72114, CVE-2026-72115, CVE-2026-72116, CVE-2026-72117, CVE-2026-72118, CVE-2026-72119, CVE-2026-72121, CVE-2026-72124, CVE-2026-72125, CVE-2026-72142, CVE-2026-72146, CVE-2026-72157, CVE-2026-72170, CVE-2026-72172, CVE-2026-72191, CVE-2026-72216, CVE-2026-72236, CVE-2026-72237, CVE-2026-72242, CVE-2026-72252, CVE-2026-72253, CVE-2026-72260, CVE-2026-72262, CVE-2026-72299, CVE-2026-72305, CVE-2026-72308, CVE-2026-72323, CVE-2026-72392, CVE-2026-74436, CVE-2026-74441, CVE-2026-74443, CVE-2026-74444, CVE-2026-74446, CVE-2026-74450, CVE-2026-74453, CVE-2026-74454, CVE-2026-74455, CVE-2026-74456, CVE-2026-74457, CVE-2026-74458, CVE-2026-74459, CVE-2026-74460, CVE-2026-74461, CVE-2026-74463, CVE-2026-74464, CVE-2026-74465, CVE-2026-74467, CVE-2026-74468, CVE-2026-74469, CVE-2026-74470, CVE-2026-74471, CVE-2026-74472, CVE-2026-74473, CVE-2026-74475, CVE-2026-74476, CVE-2026-74478, CVE-2026-74479, CVE-2026-74480, CVE-2026-74481, CVE-2026-74482, CVE-2026-74485, CVE-2026-74487, CVE-2026-74488, CVE-2026-74490, CVE-2026-74492, CVE-2026-74493, CVE-2026-74494, CVE-2026-74495, CVE-2026-74497, CVE-2026-74498, CVE-2026-74499, CVE-2026-74505, CVE-2026-74507, CVE-2026-74508, CVE-2026-74509, CVE-2026-74510, CVE-2026-74512, CVE-2026-74514, CVE-2026-74515, CVE-2026-74516, CVE-2026-74518, CVE-2026-74519, CVE-2026-74522, CVE-2026-74523, CVE-2026-74525, CVE-2026-74540, CVE-2026-74546, CVE-2026-74547, CVE-2026-74548, CVE-2026-74549, CVE-2026-74550, CVE-2026-74551, CVE-2026-74552, CVE-2026-74553, CVE-2026-74555, CVE-2026-74556, CVE-2026-74557, CVE-2026-74563, CVE-2026-74564, CVE-2026-74566, CVE-2026-74567, CVE-2026-74569, CVE-2026-74575, CVE-2026-74577, CVE-2026-74579, CVE-2026-74580, CVE-2026-74581, CVE-2026-74582, CVE-2026-74583, CVE-2026-74585, CVE-2026-74586, CVE-2026-74587, CVE-2026-74588, CVE-2026-74589, CVE-2026-74594, CVE-2026-74595, CVE-2026-74597, CVE-2026-74598, CVE-2026-74601, CVE-2026-74603, CVE-2026-74604, CVE-2026-74607, CVE-2026-74608, CVE-2026-74609, CVE-2026-74612, CVE-2026-74613, CVE-2026-74614, CVE-2026-74615, CVE-2026-74616, CVE-2026-74620, CVE-2026-74621, CVE-2026-74622, CVE-2026-74623, CVE-2026-74624, CVE-2026-74625, CVE-2026-74626, CVE-2026-74628, CVE-2026-74630, CVE-2026-74631, CVE-2026-74632, CVE-2026-74635, CVE-2026-74636, CVE-2026-74637, CVE-2026-74641, CVE-2026-74647, CVE-2026-74648, CVE-2026-74649, CVE-2026-74650, CVE-2026-74651, CVE-2026-74654, CVE-2026-74656, CVE-2026-74657, CVE-2026-74658, CVE-2026-74659, CVE-2026-74660, CVE-2026-74662, CVE-2026-74663, CVE-2026-74664, CVE-2026-74666, CVE-2026-74667, CVE-2026-74668, CVE-2026-74669, CVE-2026-74671, CVE-2026-74672, CVE-2026-74673, CVE-2026-74675, CVE-2026-74676, CVE-2026-74678, CVE-2026-74679, CVE-2026-74680, CVE-2026-74682, CVE-2026-74683, CVE-2026-74688, CVE-2026-74689, CVE-2026-74691, CVE-2026-74692, CVE-2026-74693, CVE-2026-74694, CVE-2026-74696, CVE-2026-74697, CVE-2026-74701, CVE-2026-74704, CVE-2026-74705, CVE-2026-74714, CVE-2026-74717, CVE-2026-74719, CVE-2026-74720, CVE-2026-74722, CVE-2026-74724, CVE-2026-74726, CVE-2026-74730, CVE-2026-74737, CVE-2026-74739, CVE-2026-74743, CVE-2026-74744, CVE-2026-74746, CVE-2026-74748, CVE-2026-80527, CVE-2026-80528, CVE-2026-80529, CVE-2026-80534, CVE-2026-80536, CVE-2026-80539, CVE-2026-80540, CVE-2026-80541, CVE-2026-80547, CVE-2026-80548, CVE-2026-80549, CVE-2026-80550, CVE-2026-80552, CVE-2026-80553, CVE-2026-80555, CVE-2026-80557, CVE-2026-80558, CVE-2026-80559, CVE-2026-80560, CVE-2026-80561, CVE-2026-80562, CVE-2026-80565, CVE-2026-80567, CVE-2026-80568, CVE-2026-80569, CVE-2026-80570, CVE-2026-80572, CVE-2026-80573, CVE-2026-80574, CVE-2026-80583, CVE-2026-80584, CVE-2026-80586, CVE-2026-80589, CVE-2026-80590, CVE-2026-80678, CVE-2026-80679, CVE-2026-80680, CVE-2026-80681, CVE-2026-80684, CVE-2026-80686, CVE-2026-80706, CVE-2026-80707, CVE-2026-80708, CVE-2026-80709, CVE-2026-80714, CVE-2026-80715, CVE-2026-80716, CVE-2026-80717, CVE-2026-80718, CVE-2026-80722, CVE-2026-80725, CVE-2026-80726, CVE-2026-80730, CVE-2026-80731, CVE-2026-80732, CVE-2026-80733, CVE-2026-80737, CVE-2026-80742, CVE-2026-80743, CVE-2026-80744, CVE-2026-80752, CVE-2026-80754, CVE-2026-80756, CVE-2026-80757, CVE-2026-80762, CVE-2026-80763, CVE-2026-80764, CVE-2026-80765, CVE-2026-80766, CVE-2026-80767, CVE-2026-80768, CVE-2026-80770, CVE-2026-80772, CVE-2026-80781, CVE-2026-80782, CVE-2026-80783, CVE-2026-80784, CVE-2026-80788, CVE-2026-80789, CVE-2026-80790, CVE-2026-80791, CVE-2026-80792, CVE-2026-80793, CVE-2026-80794, CVE-2026-80795, CVE-2026-80796, CVE-2026-80797, CVE-2026-80798, CVE-2026-80799, CVE-2026-80800, CVE-2026-80801, CVE-2026-80802, CVE-2026-80803, CVE-2026-80805, CVE-2026-80806, CVE-2026-80807, CVE-2026-80808, CVE-2026-80809, CVE-2026-80812, CVE-2026-80814, CVE-2026-80819, CVE-2026-80823, CVE-2026-80824, CVE-2026-80826, CVE-2026-80827, CVE-2026-80828, CVE-2026-80829, CVE-2026-80830, CVE-2026-80831, CVE-2026-80832, CVE-2026-80840, CVE-2026-80842, CVE-2026-80843, CVE-2026-80844, CVE-2026-80846, CVE-2026-80848, CVE-2026-80852, CVE-2026-80854, CVE-2026-80855, CVE-2026-80856, CVE-2026-80863, CVE-2026-80888, CVE-2026-80890, CVE-2026-80891, CVE-2026-80892, CVE-2026-80893, CVE-2026-80901, CVE-2026-80902, CVE-2026-80904, CVE-2026-80906, CVE-2026-80908, CVE-2026-80909, CVE-2026-80910, CVE-2026-80913.

2.3 Bug fixes in WALLIX Bastion 12.4.4

WAB-11141: Fix an issue causing the upgrade log file name not to include the source and target versions.
WAB-11183: Fix a typographic mistake on the Configuration ❭ Local password policy page: "One word by line" → "One word per line".
WAB-12367: Add the approvers' comments to the e-mail sent to the user when their approval request is approved.
WAB-15252: Update the Python dependencies of the Discovery module to fix known vulnerabilities.
WAB-17547: Remove the error messages about the "smtp" and "syslog" services wrongly displayed at the start of an upgrade from a version earlier than 12.0.11.
WAB-17634: Fix the internal server error (HTTP 500) occurring on the web interface after a successful X.509 authentication, which prevented the user session from being established.
WAB-18548: Fix the "WABSessionLogExport" command that did not include integrity data in Web Session Manager trace exports.
WAB-18820: Fix the password history being lost when updating a user via the REST or SCIM API, which allowed a user forced to change their password to reuse their current or a previous one.
WAB-18981: Remove the MariaDB warning about aborted connections appearing every 24 seconds in the syslog.
WAB-19656: Fix the LDAP/Active Directory password authentication accepting any password when the external authentication is configured with a client certificate.
WAB-19679: Remove password expiration notifications for local users whose account has expired or whose profile is disabled. These notifications are no longer sent to the user or to the Bastion administrator.
WAB-20035: Fix the RemoteApp (RAIL) connection mode to allow the correct launch of standard applications.
WAB-20090: Fix the transfer of files through the RDP clipboard, which was rejected with some RDP clients such as FreeRDP or the Access Manager.
WAB-20161: Update the libarchive package to fix the following security issues: CVE-2026-14164, CVE-2026-15028, CVE-2026-16517.
WAB-20162: Update the librabbitmq package to fix the following security issues: CVE-2026-59986, CVE-2026-61547.
WAB-20163: Update the libdbi-perl package to fix the following security issues: CVE-2026-14380, CVE-2026-14739, CVE-2026-14740, CVE-2026-15043, CVE-2026-15392, CVE-2026-60081, CVE-2026-60082, CVE-2026-73193, CVE-2026-73194.
WAB-20164: Update the expat package to fix the following security issues: CVE-2026-50219, CVE-2026-56131, CVE-2026-56403, CVE-2026-56404, CVE-2026-56405, CVE-2026-56406, CVE-2026-56407, CVE-2026-56408, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411, CVE-2026-56412, CVE-2026-72522, CVE-2026-76957.

2.4 Bug fixes in WALLIX Bastion 12.4.3

WAB-17234: Add the enable_source_ip_display option on the Configuration Options ❭ RDP Proxy page to hide the user source IP address in the RDP selector. The address is displayed by default.
WAB-19527: Fix the modification of an existing Application target when the license limit of protected resources is reached.
WAB-19550: Fix the color inversion in the RDP client and the rendering of the generated session videos when the RDP server uses an 8-bit color depth.
WAB-19570: Fix the removal of a target from a target group, which also removed the same connection method from the other groups.
WAB-19691: Improve the robustness of the processing of RDP data received from a target. WSA-2026-08-0001
WAB-19697: Fix the audit of SCP file transfers, which could leave some transfers unrecorded. WSA-2026-08-0002
WAB-19729: Fix the audit of SFTP file transfers, which could leave some transfers unrecorded. A transfer that cannot be tracked now closes the session. WSA-2026-08-0003
WAB-19750: Update debian base to 12.15.
WAB-19759: Update nanoid to version 5.1.16 in the Bastion administration interface to fix the following security issue: CVE-2026-67214.
WAB-19782: Fix the restrictions applied to system accounts to prevent a local privilege escalation.
WAB-19875: Update the python-django package to fix the following security issues: CVE-2026-15337, CVE-2026-15920.
WAB-19882: Update the apr-util package to fix the following security issues: CVE-2025-49506, CVE-2026-32327, CVE-2026-34191, CVE-2026-34501, CVE-2026-34502.
WAB-19883: Update the unzip package to fix the security issues reported in the Debian advisory DLA-4741-1.
WAB-19884: Update the postgresql-15 package to fix the following security issues: CVE-2025-8714, CVE-2026-6464, CVE-2026-6469, CVE-2026-6470, CVE-2026-6471, CVE-2026-6473, CVE-2026-14662, CVE-2026-14663, CVE-2026-14664, CVE-2026-14666, CVE-2026-14668, CVE-2026-14669, CVE-2026-14670, CVE-2026-14671, CVE-2026-14673, CVE-2026-14677, CVE-2026-14678, CVE-2026-14679, CVE-2026-14680, CVE-2026-15741, CVE-2026-15742, CVE-2026-16239, CVE-2026-16241, CVE-2026-18024, CVE-2026-18408, CVE-2026-19385.

2.5 Bug fixes in WALLIX Bastion 12.4.2

WAB-15758: Fix import and export of CSV files having spaces in some columns.
WAB-16642: Add a log entry in the /var/log/wabauth.log file when a local account is locked due to too many failed login attempts.
WAB-17767: Fix the Windows Security window auto-fill in AppDriver with EdgeChromium on Windows Server up to 2019. For Windows Server 2022 and above, use Chrome or Firefox instead.
WAB-18424: Fix to allow reconciliation for configured administrator in Unix password change plugin.
WAB-18652: Fix permissions on some SCIM API endpoints.
WAB-18715: Improve the "Seamless Connection" feature in IPRedir mode on WAMUT to support certain applications that use ConnectEx.
WAB-18960: Fix the SSH key rollback failure in the Unix secrets rotation plug-in when the new public key test fails.
WAB-18962: Fix SSH key change with reconciliation in the Unix password change plug-in when sudo on the target allows only one password attempt.
WAB-19301: Fix the password not being saved when creating a user via the SCIM API (POST /scim/Users).
WAB-19302: Fix the HTTP 500 error and the corruption of the last password change date when setting a forced password change for a user via the SCIM API (PUT /scim/Users).
WAB-19483: Fix the incorrect name and description of the global option "Audit kill session lock user". The option is now "Disable local user when session is killed".
WAB-19521: Fix the missing permission check on the REST API endpoint /api/passwordchangeplugins, which allowed any user to list the installed plug-ins.
WAB-19645: Fix the Targets ❭ Clusters page not being displayed in WALLIX One PAM.

2.6 Bug fixes in WALLIX Bastion 12.4.1

WAB-11046: Fix an issue allowing an approver to approve the same approval request multiple times.
WAB-15325: Fix SMTP notifications when an at sign "@" is present in the sender name.
WAB-18047: Fix an issue where the network configuration wizard was not displayed after running the “WABInitReset --reset all” command and rebooting.
WAB-18116: Improve the Session Probe launch mask.
WAB-18234: Fix an issue where some password-change plugin settings were automatically enabled ("true") after a CSV import.
WAB-18609: Improve the “WABBackupPurge” script to prevent an unreadable email from being sent to administrators when backups are deleted.
WAB-18662: Improve log correlation by using the ISO 8601 format with the timezone offset for timestamps in the system log files.
WAB-18972: Fix an issue causing an email to be sent on every run of the replication cron task after an upgrade.
WAB-19066: Fix the slowness of the Audit ❭ Session history page when displaying 1000 items per page.
WAB-19233: Fix the API documentation of the 'first_seen' and 'last_seen' fields for the "accounts" and "devices" resources. In some cases, these fields were not created when restoring a backup on WALLIX Bastion.
WAB-19289: Fix an issue related to grub reconfiguration which occurs when upgrading.
WAB-19290: Fix an SQL injection vulnerability in the "sessionrights" REST API endpoint that allowed a user to read unauthorized data from the database. No write action was possible through this vulnerability.
WAB-19337: Improve the loading time of the Configuration ❭ License page.
WAB-19372: Fix the "DLA 4651-1" vulnerability affecting the "python-urllib3" package.
WAB-19373: Fix the "DLA 4658-1" vulnerability affecting the "librabbitmq" package.
WAB-19397: Fix a security issue: WSA-2026-07-0001.
WAB-19438: Fix the "DLA-4665-1" vulnerability affecting the "linux" package.

2.7 Bug fixes in WALLIX Bastion 12.4

WAB-10748: Fix an issue preventing saving the configuration when creating a VLAN interface or bonding with IPv6 enabled.
WAB-13511: Improve "WABInitReset" command by requesting confirmation before resetting the Bastion configuration when used with the "--reset" option
WAB-13868: Remove unexpected newlines at the end of some SNMP output values.
WAB-14485: Add email list and language to the user group audit log.
WAB-17203: Fix "Device null not found" error when switching pages from the Summary panel on the Targets ❭ Accounts ❭ Device accounts page.
WAB-17967: Fix application password injection via command line. Passwords were surrounded by non-printable characters.
WAB-18382: Fix RDP video generation for applications when the [audit] smart video cropping parameter in Configuration Options ❭ RDP Proxy is set to 2 (default value).
WAB-18552: Fix VNC connection issues on UltraVNC servers with the SecureDSM plugin enabled.
WAB-18582: Fix "4hand_status" type in "GET /api/sessions" response.
WAB-18771: Fix sorting error on the Authorizations ❭ Pending Approvals page when no displayed column is sorted.
WAB-19055: Fix the DSA 6323-1 vulnerability affecting the "apache2" package.
WAB-19056: Fix kerberos TGS encryption hardening.
WAB-19057: Fix the DSA 6321-1 vulnerability affecting the "ceph" package.
WAB-19090: Fix the DSA 6335-1 vulnerability affecting the "openssl" package.
WAB-19109: Fix memory leak in database access affecting services such as wallixsession and the REST API.
WAB-19121: Fix the DSA 6338-1 vulnerability affecting the "libdbi-perl" package.
WAB-19127: Fix 400 Bad Request HTTP error when clicking on the “Apply and launch” button of an existing scan configuration.
WAB-19174: Fix performance regression affecting primary authentication when there are many secondary sessions in the history.
WAB-19199: Fix potential SQL injection vulnerability on an authenticated-access page. Data exposure is limited to non-sensitive or encrypted information.
WAB-19251: Fix the DSA 6354-1 vulnerability affecting the "libconfig-inifiles-perl" package.

2.8 Bug fixes in WALLIX Bastion 12.3.6

WAB-15239: Fix the issue that prevents an application from being deleted after it has been removed from its target group.
WAB-15696: Fix the issue that prevents a global domain from being deleted after it has been removed from its target group.
WAB-15712: Fix a synchronization issue in the Fortigate plugin: when the timeout was exceeded, the password rotation was not applied in WALLIX Bastion but was applied on the target.
WAB-16183: Remove the read-only mount warning display for /mnt during an upgrade.
WAB-16939: Fixe an issue where a license slot was not released after the session was automatically logged out or the browser was closed directly.
WAB-17690: Fix the approval request form submission on the My authorizations page for global account targets. Add a new label for the Device and Application fields in the approval request form on the My authorizations page to improve user experience.
WAB-17815: Fix the check-in of a secret when an auditor cancels an approval request. The secret was not checked-in at cancelation.
WAB-17923: Remove extraneous characters from the pasword CSV export of the break glass mechanism.
WAB-18123: Fix page scrolling when opening the table settings popover by adding internal scrolling and stabilizing the mouse cursor to prevent automatic closure.
WAB-18415: Fix a warning that could occur when importing a session archive (WABSessionLogImport).
WAB-18494: Add missing audit logs when accessing or viewing a session recording in the WALLIX Bastion interface.
WAB-18505: Update the location of the MariaDB temporary directory from /tmp to /var/wab/tmp/mysql to avoid disk space issues on the root partition.
WAB-18508: Fix the loss of product installation history during an update.
WAB-18580: Update Kernel to 5.10.254 version to fix CVE-2026-31431 (CopyFail).
WAB-18661: Fix the DSA 6248-1 vulnerability affecting the "apache2" package.
WAB-18667: Fix the DSA 6248-1 vulnerability affecting the "apache2" package.
WAB-18696: Update Kernel to version 6.1.170-3 to fix CVE-2026-43284 and CVE-2026-43500 (Dirty Frag).
WAB-18697: [CVE-2026-32597] Fix a PyJWT vulnerability affecting token validation.
WAB-18698: Fix the DSA 6263-1 vulnerability affecting the "libpng1.6" package.
WAB-18699: Fix the DSA 6262-1 vulnerability affecting the "lcms2" package.
WAB-18710: Fix the DSA 6264-1 vulnerability affecting the "dnsmasq" package.
WAB-18754: Fix the DSA 6266-1 vulnerability affecting the "nghttp2" package.
WAB-18755: Fix the DSA 6276-1 vulnerability affecting the "ffmpeg" package.
WAB-18756: Fix the DSA 6269-1 vulnerability affecting the "postgresql-15" package.
WAB-18757: Fix the DSA 6271-1 vulnerability affecting the "gsasl" package.
WAB-18759: Fix the DSA 6275-1 vulnerability affecting the "linux" package.
WAB-18760: Fix the DSA 6277-1 vulnerability affecting the "openjpeg2" package.
WAB-18762: Update Debian base to 12.14.
WAB-18811: Fix the DSA 6281-1 vulnerability affecting the "gnutls28" package.
WAB-18827: Fix the DSA 6282-1 vulnerability affecting the "rsync" package.
WAB-18829: Fix the DSA 6285-1 vulnerability affecting the "bind9" package.
WAB-18882: Fix the DSA 6293-1 vulnerability affecting the "krb5" package.
WAB-18883: Fix the DSA 6294-1 vulnerability affecting the "libgcrypt20" package.
WAB-18890: Fix the DSA 6297-1 vulnerability affecting the "samba" package.
WAB-18938: Fix the DSA 6306-1 vulnerability affecting the "linux" package.
WAB-18939: Fix the DSA 6302-1 vulnerability affecting the "starlette" package.

2.9 Bug fixes in WALLIX Bastion 12.3.5

WAB-10306: Fix a string pattern type error preventing password rotation in the HP iLO plugin and improve debug logging.
WAB-10689: Fix Celery configuration handling without requiring changes to most default values.
WAB-15191: Fix root user password rotation and log message errors.
WAB-16535: Fix access loss to an IPSR interface following an update.
WAB-16717: Remove the "WABRaidSendNotification" command from WALLIX Access Manager and WALLIX Bastion.
WAB-17226: Improve loading speed of Tags column filter popup from Targets ❭ Devices and Targets ❭ Applications pages.
WAB-17560: Add French translations of email notifications sent by the Discovery feature.
WAB-17653: Improve the Add Targets modal on the Targets ❭ Groups page. Performance has been improved when navigating through the target type tabs.
WAB-17812: Fix OIDC authentication when the received “aud” parameter is a list of clients.
WAB-18125: Improve "Auto adjust performance flags" parameter in the "RDP Proxy" section under "Configuration options", now disabled by default.
WAB-18232: Fix the DSA 6201-1 vulnerability affecting the "openssl" package.
WAB-18335: Fix the DSA 6303-1 vulnerability affecting the "tiff" package.
WAB-18347: Fix the DSA 6204-1 vulnerability affecting the "openssh" package.
WAB-18379: Fix the DSA 6206-1 vulnerability affecting the "gdk-pixbuf" package.
WAB-18481: Fix the DSA 6221-1 vulnerability affecting the "ntfs-3g" package.

2.10 Bug fixes in WALLIX Bastion 12.3.3

WAB-11185: Fix an issue that occurred when upgrading WALLIX Bastion if the path /mnt/ was already a mount point.
WAB-12350: Add SameSite parameter with the value Lax in cookies generated by the Bastion (UI and REST API).
WAB-13284: Remove support for underscore (_) and dot (.) characters in system hostnames configured by the WABNetworkConfiguration script. These characters are now forbidden. Bastion administrators must manually update any hostnames containing these characters.
WAB-14287: Fix the calculation of permissions for custom profiles when user or target group restrictions apply. Users with these profiles can create applications if they have the appropriate rights.
WAB-14445: Fix an issue where authentication history was not consistently cleaned in a replicated environment. The "bastion-clean-user-data" command now purges auth logs on all nodes when using SQL replication.
WAB-15259: Improve automated backup purge defaults to keep only backups newer than 30 days and safeguard those newer than 5 days.
WAB-15745: Fix the values displayed in the Last connection field on the My authorizations ❭ Sessions page for WEBAPP targets.
WAB-16921: Fix an issue where a node added with the bastion-replication --add-slave command could be incorrectly detected as a master by ensuring the required metadata file is properly created.
WAB-17204: Fix session "Replay" tab crashes when video resolution is not available.
WAB-17287: Fix RDP connection issue on the Bastion when login exceeds 127 characters.
WAB-17495: Fix generation of Session invite link on Access Manager when the connected user has limitations in their Bastion profile.
WAB-17641: Improve the description of the Base inactivity timeout option in the Configuration options ❭ RDP Proxy section and the Inactivity timeout option in VNC and RDP connection policies.
WAB-17654: Add monitoring and restart of the Redis service in WALLIX Bastion watchdog.
WAB-17676: Fix an error when running the bastion-db-maintenance script.
WAB-17695: Fix Web session launch for users with a limited profile that no longer triggers a blocking error.
WAB-17714: Fix RDP target connection failure when the device or application name contains a plus sign (+).
WAB-17715: Fix an issue with the handling of certain characters when entering a Redis password.
WAB-17777: Improve Access Manager default session timeout in the Bastion by reducing it to prevent incorrect license usage.

2.11 Bug fixes in WALLIX Bastion 12.3.2

WAB-13455: Fix Bastion interface availability and license update issues when the timezone is set to Africa/Casablanca.
WAB-14371: Improve replication log management by moving MariaDB binary logs from /var/log to /var/wab/mysql.
WAB-16674: Improve the System ❭ SIEM integration page by moving the "+" button to the left of the screen and automatically adding the unsaved row when the form is submitted.
WAB-16937: Fix wabwatchdog to prevent service status checks and notifications during the upgrade process.
WAB-17147: Disable the "WABEmergencyCredentialRecovery" cron task on secondary (slave) replication nodes.
WAB-17757: Fix error 500 in GET /api/sessions/traces when a date is given in query string parameters.

2.12 Bug fixes in WALLIX Bastion 12.3.1

WAB-8198: Fix The "bastion-change-redis-password" command that no longer allows setting an empty password.
WAB-11169: Fix the URL returned for domain account credentials in the REST API.
WAB-13167: Fix the audit log message when the timeout of an external authentication is modified.
WAB-13225: Fix an issue preventing the immediate application of changes to the graphical user interface inactivity timeout.
WAB-14645: Remove the message shown by the form after submission when a REST API error occurs, as it duplicates the error notification. Notifications remain visible until the user closes them.
WAB-16777: Fix several typographical errors on the Backup/Restore page.
WAB-17148: Fix a timing mismatch between metadata events and video position in RDP and VNC session replay, ensuring that clicking a metadata timestamp jumps to the correct video position.
WAB-17184: Fix the Paths field desynchronization in Standard applications. When the targets of a cluster associated with a Standard application are modified, the Paths field in the application form is now correctly updated to reflect those changes.
WAB-17294: Fix internal logger crash when logging non-UTF-8 characters.
WAB-17375: Fix an incorrect error message when trying to restore a backup in the user interface while replication is active.
WAB-17526: Fix a typo in emails containing the results of the Discovery analysis.
WAB-17552: Fix the "WABChangeDbRootPassword" command. The command now works with any special character.
WAB-17629: Fix an issue preventing a backup without a cryptographic passphrase from being restored from the user interface.
WAB-17635: Add the ability to specify the Email attribute in an LDAP authentication domain.
WAB-17667: Fix remote port forwarding in SSH sessions. Sessions no longer close when using remote port forwarding.

2.13 Bug fixes in WALLIX Bastion 12.3

WAB-8981: Disable backup purge via cron job on WALLIX One PAM Bastions.
WAB-9030: Improve handling of the error triggered when resizing the terminal window below the minimum form size.
WAB-9357: Fix the naming of network interfaces connected to a physical or virtual machine during operation.
WAB-10186: Fix the WABCRLFetch command by removing the deprecated --location option, updating the --file option to accept a path or ` -` (minus sign) for standard input, allowing the - -config option to be used without an argument for the default configuration file, using standard input only when explicitly specified, and improving error reporting.
WAB-10447: Improve the description of the Keyboard input masking level field on the RDP connection policy page.
WAB-11108: Fix the impossiblity to change the number of parallel connections when a hop is configured.
WAB-11169: Fix the URL returned for domain account credentials in the REST API.
WAB-11763: Disable automatic backup via cron job on the WALLIX One PAM Bastions.
WAB-11913: Fix a bug which prevent WABChangeGrub to set a password on physical appliances.
WAB-12294: Improve the error message on the Network page when disabling a network interface that is still used in the Service control page.
WAB-12370: Add a parameter in the SSH Proxy configuration options to define remote commands treated as SFTP sessions, useful for configuring a specific SFTP executable command in WinSCP.
WAB-12871: Add password rotation data to the data sent to SIEM.
WAB-13449: Add french translation for the "disk full" notification.
WAB-14031: Fix sending large RAIL application icon to RDP client.
WAB-14088: Fix a compatibility issue between the Application Driver UI automation script for Google Chrome and Microsoft Edge, and iDRAC v9.
WAB-14406: n
WAB-14532: Fix a problem that prevented the security level of certain services from updating on version upgrades or backup restoration.
WAB-14593: Fix certain cases where transferred files were not properly recorded in the list of saved files during SSH sessions.
WAB-14764: Fix the target port value for a WSM session.
WAB-14807: Update the default log level for SNMP to avoid flooding.
WAB-14978: Improve seamless connections in IPRedir mode by supporting applications that use the WSAConnect system call, such as EasyModbusClient.
WAB-15066: Fix an issue preventing the configuration of the SMTP server without authentication via the REST API.
WAB-15143: Fix the disappearance of the default gateway in certain cases of IP source routing.
WAB-15192: Add password change logs to the syslog file and for SIEM export.
WAB-15202: Fix renaming errors for RDP session recordings that use an application cluster when sessions ended due to user inactivity.
WAB-15203: Fix the missing display of the message banner in the RDP Selector when a banner is configured under Configuration ❭ Configuration options ❭ Global ❭ Banner.
WAB-15204: Fix an issue where RDP clients using FreeRDP 3.15 libraries (Debian 13 "Trixie") required the relax-order-checks option to connect to targets. Connections can now be established without this option.
WAB-15240: Fix copy/paste in RDP sessions with Rdesktop.
WAB-15247: Fix the content of clipboard log events during RDP sessions so that transferred text data is not displayed.
WAB-15329: Add the Allow rt without recording parameter in SSH Proxy configuration options, allowing the “4 eyes” audit to be disabled when the SSH session is not recorded.
WAB-15412: Disable authentication with the RDP proxy and SSH proxy when the encryption passphrase is locked.
WAB-15510: Add passphrase confirmation before exporting sessions via WABSessionLogExport.
WAB-15513: Add default ascending sort order in the Account name column in the Add target accounts for session management window.
WAB-15516: Improve notification handling by preventing duplicate password change emails when one delivery attempt fails.
WAB-15607: N
WAB-15651: Add a boolean field trace_corrupted to the REST API resource GET /api/sessions.
WAB-15653: Add Debian packages libpq5 and python3-psycopg2 to WALLIX Bastion, enabling the use of the PostgreSQL password change plugin.
WAB-15715: Improve error handling when a DNS query returns no answer.
WAB-15739: Fix an issue causing the console keyboard to revert to US QWERTY after reboot.
WAB-15929: Improve the REST API request GET /api/devices when only specific fields are returned using the fields URL parameter.
WAB-15983: Fix display of legacy UI pages when accessing them for the first time after login.
WAB-16006: Fix incorrect field validation for the number of allowed simultaneous connections.
WAB-16171: Improve backup restoration by increasing the file size limit for restores via the web interface. Backup files can now be up to 300 MB.
WAB-16173: Fix the 2FA options in the RADIUS form so that each option is independent and applied correctly.
WAB-16185: Fix an issue where the Windows Security dialog couldn’t be filled or bypassed when using a domain administrator account.
WAB-16220: Fix stability issue by reverting Blobfuse2 to version 2.2.1 to avoid memory leak.
WAB-16223: Fix the generation of the SSH/RDP connection file when the username is the e-mail adress.
WAB-16267: Fix a bug that prevented submitting the LDAP form when using an anonymous bind method from the Configuration ❭ External authentications page.
WAB-16299: Fix a random issue affecting device redirection from FreeRDP-based clients to RDP sessions.
WAB-16651: Fix the identification of the HTTP Basic Authentication dialog box of Firefox 145.0.2.
WAB-16663: Add three additional log files to the debug information to enhance the advanced logs files.
WAB-16669: Improve the error message displayed when creating an application if the license has expired or the resource limit has been reached.
WAB-16726: Fix a spelling mistake in the error message when adding an existing NTP server.
WAB-16760: Improve the REST API request GET /api/accounts when only specific fields are returned using the fields URL parameter.
WAB-16765: Improve the REST API request GET /api/targetgroups when only specific fields are returned using the fields URL parameter.
WAB-16778: Add missing translations on the System ❭ Backup ❭ Restore page.
WAB-16807: Fix an issue that could prevent replication from resuming after a WALLIX Access Manager or WALLIX Bastion node restart.
WAB-16808: Fix a replication failure that could occur in “master/master” mode when resynchronizing databases on clustered Access Managers or Bastions using the bastion-replication --dump-resync command.
WAB-16813: Remove non-onboarded discovered devices from the list of targets in the application form.
WAB-16861: Improve SQL replication by increasing the maximum number of replica (slave) nodes to 100.
WAB-16954: Improve error 500 returned by GET /api/devices when a plugin is not found.
WAB-16974: Fix web session status in Session History when the WSM server is down, so failed sessions appear as FAILED and interrupted sessions as ABORTED.
WAB-17018: Add the WALLIX Bastion version impacted by the recent addition of resources in the REST API v3.12.
WAB-17023: Improve management of cron jobs related to replication. Cron jobs no longer accumulate.
WAB-17071: Fix the cron-run command help to show the correct exit code (254) when failing to acquire the lock with --flock option.

2.14 Bug fixes in WALLIX Bastion 12.2.3

WAB-11455: Add a configuration option that fixes connections that use email and a vault transformation rule.
WAB-12568: Fix a display issue in the legacy user interface when an external Active Directory user is mapped to multiple groups, including at least one with user group restrictions.
WAB-12786: Add anonymization of "accountcredhistory", "scan", and "scan_job" tables in the "bastion-db-anonymizer" script.
WAB-13437: Fix the audit log when creating, modifying, or deleting the “authorization” object.
WAB-13442: Fix the F5 Big-IP password rotation plugin to properly support passwords containing double-quotes ("), question marks:question: , and backslashes ().
WAB-13524: Add detection of an error by the Windows password change plugin when NTLM is disabled on the target.
WAB-13597: Add detection of an error by the Windows password change plugin when the target account has the "CannotChangePassword" attribute.
WAB-13785: Fix a traceback error in the syslog that occurs when an expired, disabled, or locked user tries to authenticate to WALLIX Bastion.
WAB-14192: Fix the removal of the old SSH key during a key rotation via the UNIX plugin when the Keep other keys option was selected.
WAB-14300: Fix an issue where an SAML user was able to log into the administrator network interface.
WAB-14523: Improve clarity by renaming the Last connection parameter to Last session for the user entity on both the Users ❭ Accounts web page and the /api/users endpoint.
WAB-14553: Fix incompatibility between WSM and IPv6 Bastion.
WAB-14703: Fix high RAM consumption during MP4 video generation for web sessions.
WAB-14778: Fix high memory usage and performance issue when the connected user has a lot of authorizations.
WAB-14822: Add max length for strings in REST API "sessions" resource.
WAB-14941: Fix CSV export of users with limited rights profiles.
WAB-15015: Fix WinRM fallback to HTTP for retrieving local Windows accounts in the context of local account discovery.
WAB-15077: Fix an issue where the resolution of names found by the discovery feature failed when the first DNS server returned a response other than a timeout or a ServFail error, preventing fallback to the next DNS servers.
WAB-15121: Fix creating a domain with an external HashiCorp vault when optional parameters are not set.
WAB-15122: Fix for approval closure in WABCleanApprovals close. Approvals whose end date has already passed, have an “accepted” status, and no sessions started now remain unchanged and are no longer closed automatically.
WAB-15127: Fix the issue preventing an auditor from opening a web session simultaneously with another user.
WAB-15185: Fix an error in Unix password change plugin during reconciliation on a Red Hat target.
WAB-15229: Add anonymization of the WSM table to the bastion-db-anonymizer script.
WAB-15231: Add anonymization of web application URLs in the bastion-db-anonymizer script.
WAB-15236: Add the generation of an error when importing web applications from a CSV file if the URL is missing.
WAB-15273: Disable reverse name lookup when canonicalizing hostnames for use in Kerberos service principal names.
WAB-15354: Fix wrong status code being returned by the Windows password change plugin when the host is unreachable for the WinRM method.
WAB-15381: Fix database initialization timeout on replica nodes in W1PAM clusters.
WAB-15422: Remove the bastion-replication cron jobs from all nodes when running --uninstall.
WAB-15432: Fix editing issues when a global and local domain share the same name.
WAB-15465: Fix SMTP passphrase synchronization across all nodes of a W1PAM cluster.
WAB-15476: Improve display of the Audit ❭ Authentication History page, and add the “X-Pagination-Counters” HTTP header to the REST API.
WAB-15543: Fix a 400 (Bad Request) error in the REST API that occurs when searching for fields with a null value.
WAB-15601: Add automatic periodic cleanup of troubleshooting files generated from the System ❭ Status page.
WAB-15611: Improve the response time of GET /api/sessionrights when handling many rights and tags, and remove unnecessary spaces and indentation in the JSON returned by the REST API.
WAB-15616: Fix support for long user names in the F5 Big-IP password rotation plugin.
WAB-15617: Fix the search for plugins in "devel" mode in wallix-debug.
WAB-15638: Update openssl packages to fix following security advisories: CVE-2025-9230, CVE-2025-9231, CVE-2025-9232.
WAB-15656: Fix 500 errors in the REST API caused by a lock on the confignumber table and improve the performance of database update requests.
WAB-15673: Fix the result of a vault transformation rule when the regular expression contains curly braces.
WAB-15710: Fix wallix-debug to correctly display command output when the return code is non-zero and stderr is empty.
WAB-15717: Fix a 500 error returned by the REST API when attempting to create a group restriction that already exists.
WAB-15727: Update redis package to fix the following security advisories: CVE-2025-46817, CVE-2025-46818, CVE-2025-46819, CVE-2025-49844.
WAB-15734: Fix the automatic deletion of backup files created from the System ❭ Backup/Restore page and stored in /var/tmp/backups/.
WAB-15736: Improve the "backup_key" option by raising its maximum length from 16 to 128 characters.
WAB-15737: Fix connection failures during simultaneous GSS-API bind authentications to Active Directory domains.
WAB-15751: Fix the association of a global domain account with target groups when the account is edited on the Targets ❭ Domains page.
WAB-15760: Fix the list of targets displayed on the standard application form.
WAB-15950: Fix support for the tmsh shell in the “F5 Big-IP” password rotation plugin.
WAB-15951: Fix risk of having different RDP proxy certificates on W1PAM cluster nodes after a reboot.
WAB-16052: Remove unnecessary redirects when navigating to pages in the legacy user interface.
WAB-16069: Fix an issue preventing WALLIX Bastion from retrieving LDAP approver users to notify in an approval workflow. This occurred when using an OpenLDAP directory with the memberOf overlay.
WAB-16070: Fix a 500 error returned by the API request GET /api/passwordrights?count=true.
WAB-16203: Fix repetition of the security level prompt during upgrades from version 12.0.
WAB-16270: WSA-2025-11-001: Fix local privilege escalation (MEDIUM) - CVE number pending.
WAB-16298: Fix error on the Targets ❭ Applications page when a standard application has no path defined.
WAB-16344: Fix an issue preventing the use of the password_hash parameter on the /users API resource.
WAB-16382: Add an event to the audit log when a user logs out of the web interface.
WAB-16383: Fix XSS vulnerability affecting the restrictions field on the Users ❭ Accounts page.
WAB-16384: Fix a vulnerability that allowed unauthorized access to the physical console via brute-force.
WAB-16411: Remove the unused directory /tmp/crl.

2.15 Bug fixes in WALLIX Bastion 12.2.2

WAB-10179: Fix cluster imports in CSV format.
WAB-13460: Fix Oracle password rotation plugin startup by replacing a missing deprecated dependency with its supported counterpart, adding Oracle 23 support and dropping Oracle 11.2. Fix handling of single quotes (') in usernames and passwords, and enable password rotation for accounts without the CREATE SESSION permission via reconciliation.
WAB-13580: Fix check of the received hostname in REST API when it contains a port number.
WAB-13746: Improve performance by avoiding updates to static data from the database during SSH, RDP, or VNC sessions.
WAB-13790: Fix interval for retrieving X509 connection approvals from 1s to 5s.
WAB-14064: Fix excessive growth of the "redis" log file by changing the default verbosity level to notice.
WAB-14155: Fix the keep_other_keys parameter of the UNIX password change plugin after an upgrade or the restoration of a backup.
WAB-14242: Update source protocol RDP to APP for sessions on applications in CSV exports.
WAB-14264: Improve the description of the configuration option Trusted hostnames for HTTP_HOST header.
WAB-14387: Fix typos in the description of the Windows password change plugin options.
WAB-14567: bastion-replication --uninstall uninstall cron jobs for monitoring and notification
WAB-14569: Improve security on the REST API CSRF token by accepting it only in the HTTP header X-CSRF-Token.
WAB-14617: Fix dashboard upgrade from WALLIX Bastion 12.0.10.
WAB-14639: Fix tags added by API on an application that were removed when saving the application via WALLIX Bastion web interface.
WAB-14646: Fix possible conflict in redis configuration file while upgrading.
WAB-14663: Fix secondary connection message for WEBAPP targets.
WAB-14782: Fix the creation of a second device (or application) using a new tag (key/value) identical to a first device (or application) when both POST RESTAPI creation calls are made at the same time. The creation could fail and several minor issues could occur.
WAB-14793: Add the tags field of the Device object (resource /api/sync) in the REST API documentation.
WAB-14840: To work properly with Citrix ADC load balancer 13.1, the security level for the HTTP Admin client must be set according to Open-Source community recommendations.
WAB-14845: Fix an issue that prevented selecting interfaces on the Network page in certain web browsers.
WAB-14909: To use SSL encryption for Active Directory authentication on Windows 2019 or earlier, the LDAP client’s security level must be set to the open-source community recommendations (oss).
WAB-14920: To use Remote Desktop connection on Windows Server 2019 or earlier, the security level for RDP Proxy must be set according to Open-Source community recommendations.
WAB-14932: Remove the "Use CSRF token" REST API option. The REST API client can still force the use of a CSRF token using the HTTP header "X-Use-Csrf-Token" upon API authentication.
WAB-14943: Add a message regarding changes to security level algorithms during updates from version 12.0.10 or earlier.
WAB-14960: Fix an issue where the replication cron jobs were deleting the replication config file during setup due to cron jobs not being deleted.
WAB-14985: Fix an issue causing user-defined DNS servers to be removed and replaced with those provided by DHCP.
WAB-15057: Fix the automatic deletion of old versions of CRL files when importing new ones.
WAB-15061: Add a log action when a user account is disabled, reactivated, or marked as expired.
WAB-15085: Remove case sensitivity for sessionSharing field in CSV import of authorizations.
WAB-15154: Update maximum length of private keys in REST API version 3.8: from 2000 to 20000 characters.
WAB-15217: Fix update script: checks encryption status before the upgrade and prompts for unlock.
WAB-15218: Fix type and description of default connection policies "RDP-ccn" and "SSH-ccn".
WAB-15249: Fix error 500 on REST API bulk request when the body is an empty JSON list.
WAB-15253: Fix an issue in AD domain handling with recursive groups. When an approver group was defined via group mapping and the mapping referenced an invalid group, emails were sent to all users in the domain.
WAB-15331: Fix error on CCN connection policies in migration.
WAB-15383: Update Axios package to version 1.12.0 (CVE-2025-58754).
WAB-15624: Fix an issue preventing SSH access to the Debian machine hosting Web Session Manager after a reboot.

2.16 Bug fixes in WALLIX Bastion 12.2.1

WAB-13811: Fix session timeout not updating when retrieving X509 connection approvals.
WAB-14084: Fix password reconciliation with Unix password change plugin when the sudo rule is configured with NOPASSWD.
WAB-14391: Fix an issue preventing the upgrade from running in a completely non-interactive way
WAB-14525: Fix a default route issue caused by the global table being set to an incorrect value in IPSR mode.
WAB-14527: Fix password change error in the Windows plugin when credential rotation was configured without the krb_file (Kerberos configuration file) parameter.
WAB-14551: Fix the creation or update of a password change policy where password_length is set to null via the REST API.
WAB-14558: Add default ascending sort order in the Account name column.
WAB-14559: Fix "wallixsession" service not starting on Wallix One Pam replica nodes.
WAB-14590: Update Debian packages to fix this security advice: CVE-2025-32462.
WAB-14611: Fix changes to the “url” field that were not tracked in the audit log.
WAB-14707: Add heuristics to hide usernames, passwords, and API keys in URLs stored in audit information and logs of Web Application sessions.
WAB-14747: Fix a file writing error when trying to save customized logos.
WAB-14766: Update GnuTLS packages to address security advices: CVE-2025-32990, CVE-2025-32989, CVE-2025-32988, CVE-2025-6395.
WAB-14828: Update WSM version to 4.0.9 to fix plain-text credentials in WebSocket frames.
WAB-14862: Fix replication of custom proxy connection messages across Wallix One PAM nodes.
WAB-14893: Fix limitations on user/target groups in the profile when the user is logged with an API key.
WAB-14901: Update debug email templates for discovery.
WAB-14995: Update connection failure message in Discovery.
WAB-15062: Update Paramiko to version 3.4.0 in Discovery (CVE-2023-48795).
WAB-15063: Update Axios package to 1.11.0 (CVE-2025-7783).
WAB-15079: Fix connection failures to RDP and SSH proxies with SAML authentication if the user was already logged into the GUI.
WAB-15221: Update Debian packages in order to fix this security advice: CVE-2025-7425.

2.17 Bug fixes in WALLIX Bastion 12.2

WAB-5852: Remove Timeout field requirement when an approver accepts a user request.
WAB-8024: Fix sorting on "device" field in API resource /api/targets/session_scenario_accounts.
WAB-9700: Fix device removal when there are no active approvals.
WAB-9942: Fix the acceptance of empty names or zero-length passwords when creating or updating password change policies via the REST API.
WAB-10269: Fix an incorrect error message when reaching the concurrent users limit.
WAB-10277: Improve logs when an OTP has expired while connecting to the WALLIX Bastion GUI.
WAB-10937: Fix the maintenance page when viewing approval request details in Entra ID.
WAB-10943: Fix start dependencies for the "wallixsession" service.
WAB-11056: Fix the disappearance of the default gateway in specific cases.
WAB-11412: Remove the need to open port 443 between WALLIX Bastions while configuring HA Database Replication.
WAB-11423: Fix the long display time of a global account page when the account has more than 30 resource associations.
WAB-11672: Add a warning message in the GUI and in "WABNetworkConfiguration" if an FQDN does not have two levels for the domain.
WAB-11759: Fix the validation of "F5 Big IP" plugin parameters on a local domain for a device.
WAB-11801: Fix the display of devices in a cluster when there are a lot of devices in the database.
WAB-12323: Fix concurrent user count when the same account connects to the WALLIX Bastion interface from different IP addresses.
WAB-12393: Remove sending of Break glass and approval emails to disabled users.
WAB-12492: Improve several descriptions on the Configuration options > RDP proxy page.
WAB-12581: Fix the inability to use interfaces previously used for bonding.
WAB-12831: Fix SAML authentication when the user is already connected to the browser.
WAB-12848: Fix the execution of "bastion-disk-space-checker" during WALLIX Bastion upgrade which led to mails being sent to the Bastion administator.
WAB-12857: Fix the compression of rotated files in /var/log.
WAB-12997: Fix disconnection from web site when authenticating with SAML on a proxy.
WAB-13019: Fix Chrome compatibility affecting password field detection in RDP sessions.
WAB-13035: Fix slow display of approvals when searching in the history.
WAB-13131: Fix the visibility of users with the same profile permissions but different "transferable flags".
WAB-13163: Improve errors reporting in the "F5 BIG-IP" password rotation plugin and improve support for slower authentication on the target device.
WAB-13251: Fix an issue with the Application Driver and Interactive Login mode, which requires locating input fields.
WAB-13284: Remove support for the underscore (_) and dot (.) characters in the system hostname configured in the 'WABNetworkConfiguration' script. They are no longer permitted. Due to this new restriction, it is the duty of the Bastion administrator to manually modify any system host name that contains these forbidden characters.
WAB-13335: Add support of MariaDB in the MySQL password change plugin.
WAB-13450: Improve SNMP reporting by setting the WALLIX Bastion status to "false" when services are disabled due to low disk space.
WAB-13513: Fix issue with service mapping restrictions for a SAML administrator.
WAB-13525: Fix an issue related to the inability to obtain a root shell when booting in "rescue" mode.
WAB-13545: Fix update of application paths via the REST API for interactive login and accoung mapping targets.
WAB-13550: Fix an event sent by "WABSessionLogIntegrityChecker" to the SIEM when the session status is "OK" and added a missing quote in a reported event.
WAB-13578: Add a note about allowed characters in the Trusted hostnames for HTTP_HOST header field.
WAB-13605: Remove "camellia256-cts-cmac" and "camellia128-cts-cmac" algorithms from accepted encryption types for kerberos authentication.
WAB-13625: Fix duplicate session record creation in the database when editing its description via the REST API.
WAB-13630: Remove sending break-glass and approval emails to expired local users.
WAB-13631: Fix an issue in 'bastion-replication --add-slave' where the script could incorrectly report "This Bastion is already in slave list".
WAB-13639: Fix the "WABSessionLogExport" script, which could generate archives with corrupted data, making them non-importable. A separate fix to the "WABSessionLogImport" script allows importing those previously affected archives.
WAB-13649: Add search and sort features for the "is_application" field in REST API resource /api/applications.
WAB-13652: Fix missing KBD_INPUT logs in RDP session connections from Windows 11 MSTSC to a Windows Server 2025 target.
WAB-13672: Fix multiple plugin backup issues that could trigger internal errors after restoration, and verification that pre-existing plugins are stored in the "restored_aside" directory.
WAB-13703: Fix Ctrl+End and Ctrl+Alt+End shortcuts interpreted as Ctrl+Delete and Ctrl+Alt+Delete during VNC sessions.
WAB-13711: Fix local user editing on the web interface when the account expiration date is in the past.
WAB-13725: Fix an issue causing incorrect nighttime notification during license status check.
WAB-13726: Fix an issue with Application Driver when the login field does not have any type.
WAB-13729: Fix copy-paste issue in internal page edit fields of the RDP proxy, where an invisible character was added that prevented deletion of the first character.
WAB-13749: Fix incorrect network configuration when restoring a backup that did not include the DNS Domain or Search options.
WAB-13802: Fix multi-line banner formatting on SSH target connections.
WAB-13857: Fix a traceback being printed when running the 'WABCleanGhostSessions' command when the license has expired.
WAB-13871: Fix approval request email not being sent to LDAP/AD approvers for groups linked to a SAML authorization.
WAB-13893: Fix an issue with Bastion replication clusters where SQL replication between servers could be disrupted by the simultaneous execution of specific recurring jobs on multiple cluster nodes.
WAB-13895: Add Celery and SQL replication logs in debug ZIP file on the System > Status page .
WAB-13978: Add Windows 11 Pro and Entreprise, and Windows Server 2025 to the list of supported versions.
WAB-14003: Fix error in logs when trying to change a secret that is not present in the account.
WAB-14065: Fix unintended sending of the password expiration notification to the “admin” user.
WAB-14116: Improve Domain Server Name handling to support names with only one or two characters.
WAB-14133: Fix LDAP user listing issues when using "memberOf" as a group attribute in an authentication domain.
WAB-14166: Fix the version check for WALLIX Bastions to allow more flexibility during replication script execution.
WAB-14232: Update kernel package to 6.1.140-1 and intel-microcode to 3.20250512.1~deb12u1 to fix CVE-2024-28956 and CVE-2024-45332 security advices.
WAB-14274: Fix an issue causing the "ntpsec" service configuration file to reference an invalid directory pathname.
WAB-14451: Fix default route that was set to "blackhole" for each routing table of IPSR interfaces.
WAB-14468: Fix the "RDP-sogisces_1.3_2030" and "SSH-sogisces_1.3_2030" connection policies when new parameters are added. These parameters were not taken into account during a configuration restore or upgrade of WALLIX Bastion.
WAB-14479: Add vault activity logs in the debug archive.

2.18 Bug fixes in WALLIX Bastion 12.1.1

WAB-13812: Fix old password been keep with Kerberos method of Windows password change plugins when password successfully changed on Active Directory.

2.19 Bug fixes in WALLIX Bastion 12.1

WAB-6301: Improve the listing time of users with AD recursive groups.
WAB-6445: Fix deletion of target by a limited administrator if it exists in another group.
WAB-7383: Fix AD/LDAP 'simple (client certificate)' bind method.
WAB-7705: Improve route definition by accepting host bit set. The applied route is normalized, and a warning message is logged in/var/log/syslog.
WAB-8391: Improve the user interface by hiding the iDrac network interface of Dell physical appliances.
WAB-8445: Add replication of logo customizations in WALLIX One PAM cluster.
WAB-8999: Fix the Deactivate action in the configuration of the remote storage.
WAB-9074: Fix to automatically reload logger settings on each REST API request without restarting the service.
WAB-9155: Fix X.509 authentication when there are accents in the user certificate.
WAB-9170: Fix to keep the user's last connection date when the password changes.
WAB-9476: Remove the interface element related to the deprecated HA DRBD feature.
WAB-9491: Improve the default display of API key in the browser. After the generation, this key is hidden by default. Add an eye icon to display the API key.
WAB-9862: Remove unnecessary data for each file when session files are moved between local and remote storage. This fixes the "data is too long" error in the case of a session with a huge number of files.
WAB-9873: Fix an issue preventing a notification email to be sent when the watchdog gets back to an operational state after having been out of order.
WAB-10180: Fix target connection failure notification sending when application cannot be launched.
WAB-10230: Fix error logging in/opt/wab/bin/WABCRLFetch cron.
WAB-10250: Fix RDP Proxy Sesman configuration options lost after upgrade.
WAB-10278: Fix to display the login instead of defaultEmailDomain for UserPrincipalName.
WAB-10340: Fix the CSV import of Entra ID (ex Azure AD) users.
WAB-10341: Fix to ensure that a limited administrator can access the authentication history.
WAB-10401: Fix the Clear action of the remote storage configuration so it deletes the remote storage parameters from the bastion.
WAB-10443: Fix time frame verification that allowed to open a session on an application outside a time frame under certain conditions.
WAB-10464: Improve robustness of HA Database Replication with concurrent check-ins and checkouts of credentials.
WAB-10618: Improve usability by limiting email notifications to approvals whose end date has not yet passed.
WAB-10664: Fix the test network parameters by using the timeout during a GSSAPI connection.
WAB-10671: Fix target name in file created for ticketing interface script in case of password checkout.
WAB-10754: Update the Apache server to version 2.4.62-1~bpo10+wallix1 to fix following vulnerabilities: CVE-2024-39573 CVE-2024-38477 CVE-2024-38476 CVE-2024-38475 CVE-2024-38474 CVE-2024-38473 CVE-2024-38472 CVE-2024-36387 CVE-2024-39884 CVE-2024-40898 CVE-2024-40725.
WAB-10833: Fix the error "AttributeError: 'list' object has no attribute 'st_size'" that could be reported by the integrity checker "WABSessionLogIntegrityChecker" after importing a session archive. The imported sessions are now correctly processed.
WAB-10844: Fix the SAML Entra ID authentication end to end between Bastion and Access Manager.
WAB-10910: Add the option for administrators to reencrypt the LUKS volume.
WAB-11001: Add more logs when LDAP connection test fails.
WAB-11005: Fix wrong script path in the replication cron jobs.
WAB-11006: Fix the "bastion-traceman info" subcommand to provide the correct values for available and total space on the remote storage.
WAB-11007: Fix the removal of the monitoring cron job of the replication.
WAB-11011: Fix the “--elevate-master“ option of the replication script.
WAB-11019: Fix to allow creation of profiles with Manage Approvals right but without the Manage Authorizations right. Fix to prevent saving a profile with Manage Authorizations right but without User groups and Target groups rights.
WAB-11031: Fix the restoration of /var/wab/etc content during backup restore.
WAB-11043: Update python3 packages to version 3.7.3-2+deb10u8 to fix the following vulnerabilities: CVE-2024-0397 CVE-2024-4032.
WAB-11051: Fix the HA installation workflow if the system locale is not in English.
WAB-11063: Disable account creation by Google cloud agent.
WAB-11087: Fix the automatic partition resizing on cloud images.
WAB-11095: Remove mail sent every five minutes for replication check.
WAB-11097: Disable users from launching bastion-upgrade.sh manually.
WAB-11103: Fix notifications for OCR and keyboard input-based pattern detection during RDP sessions.
WAB-11111: Remove unexpected successful message in logs when a domain failed to be saved.
WAB-11138: Improve readability by reinstating the previous upgrade log file name, which used underscores instead of spaces.
WAB-11139: Improve usability by resetting the default wabupgrade shell to bash, which restores autocompletion.
WAB-11140: Add a message at the end of the upgrade to say the operation was successful.
WAB-11142: Add a confirmation message on BastionSecureUpgrade command before launching upgrade
WAB-11143: Fix service control limit value when toggling iptables rules.
WAB-11166: Fix live session audit not working with WALLIX Access manager 5.0.0.
WAB-11201: Fix corrupted vhdx image release.
WAB-11289: Fix issue in the SBOM regarding the incorrect version of the 'python3-winrm' package.
WAB-11297: Update dashboard component.
WAB-11303: Fix an issue that causes mail notifications to be sent to the wrong recipient during a HA Database Replication.
WAB-11316: Add a default HTTPS transport feature when changing credentials with WinRM method of Windows password change plugin.
WAB-11349: Fix SAML data schema update from 10.0 in migration scripts.
WAB-11351: Fix IPv4 and IPv6 default gateway deletion each time the configuration is applied in the System > Network page if IP source routing is enabled.
WAB-11378: Fix backup import from previous versions when the backup key has been truncated.
WAB-11391: Improve the description of the Enable Kerberos and Allow NLA NTLM fallback RDP options in Connection Policies.
WAB-11399: Fix users of AD recursive groups not correctly mapped to their Bastion groups. Improve performance when fetching users from an AD/LDAP domain.
WAB-11401: Fix Universal Tunneling session when requested source ip is empty.
WAB-11424: Fix import of backup when there are duplicated user or target groups in database.
WAB-11428: Improve security by further restricting LDAP client algorithms to match SOG-IS.
WAB-11431: Fix two bastion-replication issues: certain SSH operations are no longer interrupted before completion, and the autossh tunnel is now established through the right network interface.
WAB-11453: Fix deletion of e-mail list in user group via API endpoint PUT /api/usergroups.
WAB-11459: Improve the strength of passwords and passphrases. Weak, common or too short passphrases and passwords are now rejected.
WAB-11461: Fix HTTP host header handling in redirects.
WAB-11462: Fix a bad error handling when entering an invalid network mask in the network configuration form of the setup wizard.
WAB-11463: Improve CSRF token behavior which is now provided by the REST API thanks to a cookie (with established ttl) and is not stored anymore in the browser local storage.
WAB-11490: Add a new advanced option tls enable legacy server in RDP Connection Policy to fix RDP connections with TLS 1.0 to legacy Windows Server (such as Windows Server 2008). This option is disabled by default and must be enabled only for targets on a legacy Windows Server.
WAB-11499: Fix clipboard redirection with Windows XP target.
WAB-11503: Fix internal server error (HTTP 500) in API request when filtering on a timestamp field and providing an invalid date.
WAB-11518: Fix password checkout of a target whose account name contains a "" character (Secrets table).
WAB-11552: Add options to control the authentication method and TLS options in the connection policy of VNC.
WAB-11559: Fix keyboard input pattern detection in Access Manager invited sessions.
WAB-11574: Fix a vulnerability that allowed a malicious user to execute arbitrary commands while restoring a backup.
WAB-11590: Fix the integrity errors of the current sessions caused by WABSessionLogPurge by recreating, if necessary, the hash folder deleted by the script.
WAB-11626: Fix WALLIX-PuTTY installation in Windows workstation where some libraries (VCRUNTIME140.dll) are not present.
WAB-11636: Fix auditor 4 hands (via Windows Shadowing) access on some targets.
WAB-11648: Fix the network configuration migration during upgrade or restoration from a version prior to IPv6 support.
WAB-11665: Fix restoration of backup made on version 9.0 when a connection policy has single quotes in name.
WAB-11671: Fix error notification appearance when a global account is linked to an application via a target group.
WAB-11727: Improve logging for Windows password change plugin.
WAB-11743: Improve the error report of the keyboard pattern detections of the RDP sessions by resetting the text sent when the Enter key will be detected.
WAB-11764: Fix handling of multiple LUKS partition in bastion-luks-update.
WAB-11771: Fix the vulnerability issue DSA 5782-1 affecting the Linux kernel.
WAB-11791: Add Disable keyboard log option to the VNC connection policy to configure the KBD_INPUT log.
WAB-11795: Fix the detection of closure by inactivity on the shared RDP sessions and whose control is given to the guest.
WAB-11811: Fix errors when changing multiple passwords at the same time with the Kerberos method of the Windows plugin.
WAB-11813: Fix the login generated by the GUI for an account mapping.
WAB-11816: Fix display of the default gateway interface for ipv4 and ipv6 when the IP source routing is disabled on the System > Network page.
WAB-11818: Fix the display of the approval history list by de-duplicating rows when the approver belongs to more than one approver group.
WAB-11830: Fix RDP connections closing when approval requests were pending for too long.
WAB-11842: Fix "mariadb Aborted connection ..." warning for bastion-replication that was triggered by the replication monitoring, and which appeared in syslog every minute.
WAB-11883: Fix the delete icons for ipv4 and ipv6 routes as they removed the wrong routes on the System > Network page.
WAB-11884: Fix issue when adding multiple ipv4 or ipv6 routes in the System > Network page.
WAB-11904: Fix display of local authentication configuration in user creation form with Chrome browser version 127 or later.
WAB-11910: Fix encoding of users imported from an LDAP or AD server.
WAB-11928: Fix an issue that causes Ha Database Replication to be down for too long.
WAB-11929: Fix a traceback issue caused by Unicode decoding in SQL replication.
WAB-11949: Fix message displayed outside of visible area when configuring X.509 certificates on the web interface.
WAB-11950: Improve warning message when target session is limited in time by indicating the timezone of the deconnection time.
WAB-11953: Fix support for small computers without a keyboard controller. The absence of a keyboard controller was causing the startup setup screens to crash.
WAB-11965: Add optional field to enter the administrator's domain for Windows password change plugin.
WAB-11966: Fix to catch network error in the Windows password change plugin.
WAB-11967: Fix for Windows plugin to catch error when changing password of a user who does not exist on the target.
WAB-12025: Fix issue that could allow a disabled or expired Active Directory user to connect to the Bastion SSH proxy with a SSH key or to the Bastion with an X.509 certificate.
WAB-12028: Fix interruption of the launch of a manually deployed Application Driver by an end-user.
WAB-12038: Fix XRDP target connections when the Allow TLS only fallback option is disabled in the RDP connection policy.
WAB-12068: Improve the upgrade process of WALLIX Bastion by preventing it from starting if disk space is insufficient.
WAB-12090: Fix compatibility issue between Cisco Secure Endpoint and Session Probe.
WAB-12097: Improve the strength of SMTP cipher algorithms in TLS or STARTTLS, with the ability to configure their security level.
WAB-12131: Fix "Page not found" error that might appear on Administration and Audit pages
WAB-12169: Fix RDP session status when the connection has been aborted.
WAB-12176: Fix read of approvals assigned to a user via the REST API when the user logged is an external user.
WAB-12177: Fix interactive mode for SCP and SFTP protocols when primary authentication is SAML.
WAB-12179: Fix the system going into lockdown mode when the upgrade is prevented by an active HA Database Replication. The fix will be effective when upgrading from this version and newer versions.
WAB-12197: Fix errors in the Check Point GAIA password change plugin.
WAB-12203: Fix uniqueness of the /etc/machine-id file on the disk image.
WAB-12209: Fix email sent containing "UNLIKELYVALUEMAGICASPICONSTANTS3141592926ISUSEDTONOTIFYTHEVALUEMUSTBEASKED" when a user attempts to access a critical target in interactive login, but quits via the escape key or due to a timeout.
WAB-12214: Improve SQL request made when an AAPM client is authenticating.
WAB-12225: Fix an issue on the SMTP system page when trying to check a certificate against a SMTP server listening on a non-standard port.
WAB-12241: Fix file permission of the logger configuration preventing the change of the log level of the Bastion.
WAB-12247: Fix issue that allowed a disabled or expired FreeIPA user to connect to the Bastion SSH proxy with an SSH key or to the Bastion with an X.509 certificate.
WAB-12283: Add Hungarian keyboard layouts (named hu-HU). The previous keyboard layout hu-HU is renamed hu-HU.101-key.
WAB-12287: Improve RDP Client Keepalive description in the RDP proxy configuration options.
WAB-12378: Fix network interface renaming after upgrade.
WAB-12397: Remove mentions of traces in the log when no file needs to be transferred. [bastion-traceman]
WAB-12401: WAB wallix-config-restore.py exit code does not report errors
WAB-12412: Fix for Windows plugin to catch error when trying to change the password of a locked out account.
WAB-12452: WABSessionLogPurge: fix orphan file detection to prevent accidental deletion of hash files when some session files are temporarily not available.
WAB-12497: Fix inaccurate error message sent in case of rejected credential change.
WAB-12502: Improve the handling of untrusted HTTP hosts by returning a 400 error instead of redirecting on the UI and API.
WAB-12645: Add error about a file copy in the logs and in the output of the bastion-traceman job. When bastion-traceman failed to copy one individual file for a trace, it left the trace's files in the local storage (as expected), but would not report any error in the logs.
WAB-12671: Fix RAIL application that can appear partially or not at all in 4eyes when the primary monitor is not at the top-left corner of the virtual desktop.
WAB-12780: Fix emails sent to approvers by error for targets outside of their limitations.
WAB-12842: Fix an error message concerning remote storage when it was not configured.
WAB-12909: Fix restoration of backup when there are NULL values in the "owner" column of the SQL table "session_log".
WAB-12938: Fix error "STATUS_ACCOUNT_RESTRICTION" in Samba method of Windows password change plugin.
WAB-12999: Fix failure of session sharing between multiple RemoteApps when the target name is too long.
WAB-13026: Fix "WABSessionLogImport" when importing archives with a specific error in data format (see related fix WAB-13639). The import script will now handle the error, do its best efforts to recover the relevant data, and proceed to the end of the archive without a fatal error.
WAB-13037: Fix parallelization for change credentials in multiple domains.
WAB-13140: Improve workflow and error handling in Windows password change plugins.
WAB-13150: Fix the Local domain field in the device and application accounts forms.
WAB-13153: Fix the warning message when lowering the security level.
WAB-13162: Add support of accounts with shell different from /etc/cli.sh in Checkpoint GAIA password change plugin.
WAB-13209: Fix Kerberos form in edit mode then a keytab file is not provided.
WAB-13261: Fix the creation of approval requests starting in the past and bypassing the current allowed timeframe (security fix).
WAB-13272: Update libgnutls30 package to fix this security advice: CVE-2024-12243.
WAB-13275: Fix the SIEM message on session log purge that only contained one session.
WAB-13296: synchronize-cluster fails when there are too much folder in /var/wab/hash
WAB-13396: Improve Users > Groups page by renaming the User number column to Local users.
WAB-13496: Fix a Python import error during upgrade of the Bastion.
WAB-13519: Remove credential cache file left after rotation in Kerberos method of Windows password change plugin.
WAB-13548: Fix the encryption level of the Discovery service and use HTTPS as the default method for connecting to Windows devices through WinRM.
WAB-13722: Fix the Discovery service status that was not stopped when deactivating the corresponding configuration option.

2.20 Bug fixes in WALLIX Bastion 12.0.2

WAB-8391: Improve the user interface by hiding the iDrac network interface of Dell physical appliances.
WAB-10754: Upgrade the Apache server to fix multiple vulnerabilities.
WAB-10910: Add the option for administrators to reencrypt the LUKS volume.
WAB-11005: Fix wrong script path in the replication cron jobs.
WAB-11007: Fix the removal of the monitoring cron job of the replication.
WAB-11011: Fix the "--elevate-master" option of the replication script.
WAB-11051: Fix the HA installation workflow if the system locale is not in English.
WAB-11063: Improve GCP agent configuration.
WAB-11087: Fix the automatic partition resizing on cloud images.
WAB-11103: Fix notifications for OCR and keyboard input-based pattern detection.

2.21 Bug fixes in WALLIX Bastion 12.0.1

WAB-6364: Fix permanent connection file when the user is in an authentication domain with the Server Domain Name different from the Authentication Domain Name.
WAB-6420: Fix usage of variable approvers in custom e-mail templates.
WAB-6643: Fix issues with bastion-debugging-tools.
WAB-6969: Improve external authentications to ensure that the Last Connection field updates in scenarios where the User Name attribute is configured as UserPrincipalName.
WAB-7484: Improve "Missing authorization UID for right" log message by changing the log level to TRACE.
WAB-7489: Add anonymization of table "activity" in script bastion-db-anonymizer.
WAB-7605: Fix wrong behavior when activating or deactivating IP Source Routing where /32 routes were deleted.
WAB-7623: Improve HA Database Replication by forbidding the execution on some command in slave.
WAB-7711: Remove exception from file /var/log/apache2/wabrest-uwsgi.log when an object is not found in REST API.
WAB-7812: Improve the error message for Domain server name field in the Authentication domains page. The name should comply with the Domain Naming Convention.
WAB-8019: Improve message displayed to user for TLS errors with RDP connections.
WAB-8042: Improve readability by renaming the "Authentication domain name" field to "Server domain name" in the Groups form for users.
WAB-8243: Fix account mapping login issue from Access Manager when user password contains special characters like "é", "ü", "ß", "¾", or "§".
WAB-8268: Fix approval requests obtention for an external user.
WAB-8269: Fix the installation of HA database replication when the database passwords of the cluster nodes are different.
WAB-8283: Fix CSV export for Global Domain configuration.
WAB-8288: Fix the sending of notifications that was not always working.
WAB-8529: Fix the session audit right being transferable by a user who does not have this right.
WAB-8990: Fix WALLIX Bastion outage when filesystem is full and trying to download debug logs zip file.
WAB-8991: Improve Bastion-replication script which now checks the license for clustering entitlement.
WAB-8993: Fix parsing of LDAP user e-mails for approval permissions.
WAB-9031: Fix issue which allows to configure an invalid FQDN in the setup screens.
WAB-9069: Fix the --resync command in HA Database Replication.
WAB-9164: Fix an issue, in the context of approval workflow or auditor 4-hands, where the refused message notification can randomly be silenced while in RDP pending page.
WAB-9186: Fix CAL per Device license management when using multiple RDS in an application cluster.
WAB-9241: Fix translation of some fields on the website that were using the browser language instead of the Bastion user language.
WAB-9295: Fix reconciliation of password in Unix password change plugin.
WAB-9375: Fix the absence of two csv reports in the daily reporting e-mail.
WAB-9413: Increase default number of concurrent connections allowed to 30.
WAB-9486: Improve compatibility with HA database replication by reducing the size of the password generated for the database to 32 characters.
WAB-9497: Fix reconciliation for SSH key change in Unix password change plugin.
WAB-9514: Improve approval display time for approvers on large LDAP directory.
WAB-9561: Improve REST API target password checkout by adding real domain name for global domain accounts.
WAB-9684: Add return of error 503 in API endpoint "/api/ldapuser" if the LDAP/AD server is not reachable.
WAB-9711: Fix access to an application outside authorized time frames.
WAB-9718: Fix security issue caused by the database root password being displayed in the process list and in error messages.
WAB-9733: Fix connection to target with a local account discovered by a discovery scan.
WAB-9755: Improve performance of the Audit > Session history page on the web interface.
WAB-9804: Add LDAP case insensitive option to perform case insensitivity checks for LDAP or Active Directory mappings. This option affects the performance of the user listing.
WAB-9818: Add extended mouse buttons support in RDP sessions.
WAB-9819: Fix regeneration and upload of a new SSH private key in an account when it already has one.
WAB-9827: Fix wrong Bastion version being displayed on the grub menu after upgrade.
WAB-9834: Fix wrong EHLO command by sending a correct hostname.
WAB-9859: Fix to ensure that a self-approval request is only possible if the requester is a member of the approvers group.
WAB-9886: Fix to ensure adding of new routes with a subnet of 255.255.255.255 or 32 to the appliance interface no longer deletes routes with a submask of 255.255.255.255 or 32.
WAB-9963: Improve Filesystem Virtual Channel Manager to ignore malformed requests.
WAB-9988: Fix profile addition by a limited administrator.
WAB-9998: Fix to allow auditors with a group restriction to see accounts activities under their control.
WAB-9999: Add anonymization of authentication domains in script bastion-db-anonymizer.
WAB-10056: Update kernel version to version 6.1.85-1 in order to fix following security advice: CVE-2023-2176 CVE-2023-6270 CVE-2023-7042 CVE-2023-28746 CVE-2023-47233 CVE-2023-52429 CVE-2023-52434 CVE-2023-52435 CVE-2023-52583 CVE-2023-52584 CVE-2023-52587 CVE-2023-52588 CVE-2023-52589 CVE-2023-52593 CVE-2023-52594 CVE-2023-52595 CVE-2023-52597 CVE-2023-52598 CVE-2023-52599 CVE-2023-52600 CVE-2023-52601 CVE-2023-52602 CVE-2023-52603 CVE-2023-52604 CVE-2023-52606 CVE-2023-52607 CVE-2023-52616 CVE-2023-52617 CVE-2023-52618 CVE-2023-52619 CVE-2023-52620 CVE-2023-52621 CVE-2023-52622 CVE-2023-52623 CVE-2023-52630 CVE-2023-52631 CVE-2023-52632 CVE-2023-52633 CVE-2023-52635 CVE-2023-52637 CVE-2023-52638 CVE-2023-52639 CVE-2023-52640 CVE-2023-52641 CVE-2024-0340 CVE-2024-0841 CVE-2024-1151 CVE-2024-2201 CVE-2024-22099 CVE-2024-23850 CVE-2024-23851 CVE-2024-24857 CVE-2024-24858 CVE-2024-26581 CVE-2024-26582 CVE-2024-26583 CVE-2024-26584 CVE-2024-26585 CVE-2024-26586 CVE-2024-26590 CVE-2024-26593 CVE-2024-26600 CVE-2024-26601 CVE-2024-26602 CVE-2024-26603 CVE-2024-26606 CVE-2024-26621 CVE-2024-26622 CVE-2024-26625 CVE-2024-26626 CVE-2024-26627 CVE-2024-26629 CVE-2024-26639 CVE-2024-26640 CVE-2024-26641 CVE-2024-26642 CVE-2024-26643 CVE-2024-26651 CVE-2024-26654 CVE-2024-26659 CVE-2024-26660 CVE-2024-26663 CVE-2024-26664 CVE-2024-26665 CVE-2024-26667 CVE-2024-26671 CVE-2024-26673 CVE-2024-26675 CVE-2024-26676 CVE-2024-26679 CVE-2024-26680 CVE-2024-26681 CVE-2024-26684 CVE-2024-26685 CVE-2024-26686 CVE-2024-26687 CVE-2024-26688 CVE-2024-26689 CVE-2024-26695 CVE-2024-26696 CVE-2024-26697 CVE-2024-26698 CVE-2024-26700 CVE-2024-26702 CVE-2024-26704 CVE-2024-26706 CVE-2024-26707 CVE-2024-26710 CVE-2024-26712 CVE-2024-26714 CVE-2024-26715 CVE-2024-26717 CVE-2024-26718 CVE-2024-26720 CVE-2024-26722 CVE-2024-26723 CVE-2024-26726 CVE-2024-26727 CVE-2024-26731 CVE-2024-26733 CVE-2024-26735 CVE-2024-26736 CVE-2024-26737 CVE-2024-26741 CVE-2024-26742 CVE-2024-26743 CVE-2024-26744 CVE-2024-26745 CVE-2024-26747 CVE-2024-26748 CVE-2024-26749 CVE-2024-26750 CVE-2024-26751 CVE-2024-26752 CVE-2024-26753 CVE-2024-26754 CVE-2024-26759 CVE-2024-26760 CVE-2024-26761 CVE-2024-26763 CVE-2024-26764 CVE-2024-26765 CVE-2024-26766 CVE-2024-26769 CVE-2024-26771 CVE-2024-26772 CVE-2024-26773 CVE-2024-26774 CVE-2024-26775 CVE-2024-26776 CVE-2024-26777 CVE-2024-26778 CVE-2024-26779 CVE-2024-26780 CVE-2024-26781 CVE-2024-26782 CVE-2024-26787 CVE-2024-26788 CVE-2024-26789 CVE-2024-26790 CVE-2024-26791 CVE-2024-26792 CVE-2024-26793 CVE-2024-26795 CVE-2024-26798 CVE-2024-26800 CVE-2024-26801 CVE-2024-26802 CVE-2024-26803 CVE-2024-26804 CVE-2024-26805 CVE-2024-26809 CVE-2024-26810 CVE-2024-26811 CVE-2024-26812 CVE-2024-26813 CVE-2024-26814 CVE-2024-26815 CVE-2024-26816 CVE-2024-27437.
WAB-10072: Add a mechanism that automatically stops SQL replication during a restore, then re-synchronizes the nodes and restarts the synchronization.
WAB-10075: Improve logs readility by no longer creating logs when there is a logging attempt with an incorrect username.
WAB-10123: Fix AD authentication test for GSS-API bind method.
WAB-10147: Fix issue where the RDP Proxy configuration can not be modified on a fresh install.
WAB-10167: Improve user experience by scheduling a single checkin task after multiple checkouts of the same account by the same user.
WAB-10175: Fix Application Driver automatic deployment.
WAB-10217: Update WALLIX-PuTTY to version 0.81.1 to fix the following security issue: CVE-2024-31497.
WAB-10220: Add parameters to fine tune RDP targets authentication phase.
WAB-10244: Improve backups by allowing a backup to happen while bastion-traceman is running.
WAB-10253: Remove default evaluation license for Cloud installations.
WAB-10254: Fix wabadmin password change prompt not being displayed on Azure at the first shell login.
WAB-10255: Fix support of legacy hash algorithms for the local user password hashes.
WAB-10299: Fix removing redirected drive of Session Probe.
WAB-10312: Fix RDP sessions with corrupted recordings that leave TMP files.
WAB-10333: Fix forwarding of arguments to WABInitReset properly when ran as wabadmin.
WAB-10385: Remove a question about the "crypto" during the configuration of the HA Database Replication. The answer was not used.
WAB-10386: Fix superset cookie issue.
WAB-10407: Fix the Palo Alto change password plugin.
WAB-10519: Update the VMware disk from ".vmdk" to ".ova".
WAB-10746: Update Debian packages in order to fix this security advice: CVE-2024-6387.
WAB-10865: Fix non-functional boot in EFI SecureBoot mode.
WAB-10877: Add audit logs related to SIEM settings when the log format is changed or the filter configuration is changed.
WAB-10889: Fix of file rights under /var/wab/hash when restoring a backup. The standard rights expected on a bastion are now restored.
WAB-10917: Fix Network and Service control pages, as well as the WABNetworkConfiguration script, in WALLIX One Remote Access environments.

3 Known issues

WAB-13678: The WinRM method of the Windows plugin only works with reconciliation, An administrator account is required in the domain settings.
WAB-20690: Add the possibility for an administrator whose profile is limited to some target groups can list and delete, from the legacy web interface, the stored host keys and host certificates of devices outside these target groups. The profile must have the right to view or to modify devices. Workaround: give the Devices modification right only to trusted administrators, and set server_pubkey_check to 0 in the connection policies to refuse a target whose stored key is missing.
WAB-20842: When an administrator revokes an SSH key certificate on a Unix or Linux device with an SFTP server, WALLIX Bastion does not update the key revocation list of the device. The certificate stays valid, and WALLIX Bastion deletes the SSH key from the account. Workaround: on the device, in the home directory of the account that updates the revocation list, create a directory whose name is a single space. In this directory, create etc/ssh/wallix_krl as a symbolic link to /etc/ssh/wallix_krl.
WAB-20843: WALLIX Bastion does not revoke the certificate of the previous SSH key of an account when an administrator replaces or removes this key through the REST API with force=true. This occurs with the PUT /api/domains/❬domain❭/accounts/❬account❭ request on a domain with an SSH certificate authority. The certificate stays valid on the targets until it expires. Workaround: replace the key from the web interface.