Release Date: 8th October, 2026

Version 2.7.0 Cloud On-Premise

---

• Release Summary:

miniOrange PAM 2.7.0 is a maintenance release. It extends web application access with support for native browser authentication and approval gated password fill, adds web connectivity for switches and routers, and moves all services to Python 3.14.6. The release also resolves issues across Endpoint Privilege Management, RDP session handling, resource visibility and the user lifecycle.

• WHAT'S NEW:

Web Applications

• HTTP Basic Auth Support for Web Apps: Web applications that use the browser's native authentication prompt instead of an HTML login form can now be published through PAM. The attached system user's credentials are supplied automatically when the application is launched through XecureAccess, so the prompt is never presented to the end user.
• Approval Gated Password Fill: Administrators can require approval before a specific password field inside a web application is filled. The user raises a request from the field itself, and once approved, the credential is entered and the form submitted without the user viewing or typing it. Approval authorises a single password release and grants no ongoing access to the resource.

Network Devices

• Web Access for Switches and Routers: Switches and routers can now be accessed via a web interface alongside SSH.

• IMPROVEMENTS:

Access and Policy

• File Transfer Control on the Default SSH Policy: File Transfer Control can now be enabled directly on the Default SSH Policy, removing the need to create a replacement policy and reassign existing SFTP allocations. New deployments have it enabled by default, and existing policies remain unchanged until updated.

Resource Management

• Tag Filtering in My Resources: End users can now filter their allocated resources by tag. Tag administration is governed by its own permission rather than inheriting the Assets permission.

Platform and Deployment

• Python 3.14.6: All PAM services now run on Python 3.14.6 for improved performance and long term support.
• SSL Configuration Retained on Update: Updating an SSL enabled deployment now preserves the certificate configuration while applying the new build's web server routes, including the routes required for language support.

• BUG FIXES:

Sessions and Recording

• RemoteApp Session Termination: Closing a published application launched through the RDP client now ends the underlying session and releases the proxy connection. Session recordings close at the same point and no longer continue to grow.
• Administrator Session Termination Notice: Users whose session is terminated by an administrator are now shown a Session Suspended page with a link back to the dashboard. The access link cannot be reused, and all browser tabs belonging to that session are closed.

Endpoint Privilege Management

• Paginated Selections in Assignment: Selections made across multiple pages are now retained in full when creating an application group or a custom policy.
• Kill Switch Policy Tabs: Kill Switch policy applies only to devices and device groups. The Manage screen now shows only these two tabs and hides the unsupported user and application tabs.

Users and Access

• Resource Visibility in Search: Searching My Resources by display name or resource type now returns only the resources allocated to the logged in user.
• Desktop Application Ticket Approval: Access tickets raised for desktop applications can now be approved. The System User field is no longer required for these tickets, as desktop applications are allocated without a system user.

Interface

• Registration Page Validation: Registration fields now display a single validation message, and the confirm password check updates correctly when the password is edited afterwards.
• Interface Consistency Fixes: The Download XecureAccess button label no longer wraps in a narrow toolbar, the Tags section follows a consistent layout across all edit pages, and tag filter messages reference the correct location.

Platform and Deployment

• Protocol in Cloud Registration: New cloud registrations now store the organisation URL with the correct protocol, so the sign in redirect and OAuth callback URLs generated on the SSO page use HTTPS.

Release Date: 3rd September, 2026

Version 2.6.0 Cloud On-Premise

---

• Release Summary:

miniOrange PAM 2.6.0 centres on managing privileged access at scale. Resources and system users can now be tagged and organised into static or rule-based dynamic groups, and an entire group allocated in a single action with per-protocol policies. The release also makes session recordings portable as standard MP4 files, brings screen recording to Endpoint Privilege Management on Windows alongside agent 1.2.0, and introduces adaptive, risk-based authentication. Further additions include Active Directory-backed system users, thick client access using dashboard credentials, Slack-based approvals, SCIM 2.0 provisioning, mutual TLS on the database proxy, and break glass emergency access.

• WHAT'S NEW:

Resource Organisation & Allocation

• Resource & System User Grouping with Tags: Introduced tagging and grouping for resources and system users. Tags are applied to assets or system users and used to filter either list. Groups are static, with members chosen manually, or dynamic, built from rules over name, resource type, protocol, operating system, port, IP range, CIDR block or tag with ALL/ANY logic. Dynamic membership is previewed before saving, recalculated on demand, and refreshed automatically as resources change, with manual include and exclude overrides per resource.
• Group-Level Allocation: An entire resource group can be allocated in a single action to Users, User Groups or Roles, connecting through either one system user or a system user group. Policies are mapped per resource type across SSH, RDP, Database and Web App, falling back to the customer default.

Session Auditing & Recording

• MP4 Session Recording Export: Session recordings can be downloaded as standard MP4 files directly from the Audit dashboard, playable in any browser, media player, compliance system or archival platform. This removes the dependency on format-specific players previously required for .cast, .json and .guac recordings when sharing evidence with auditors or external parties.

Endpoint Privilege Management

• Windows Agent 1.2.0: New release of the Endpoint Privilege Management agent for Windows.
• Policy Management Interface: The EPM policy Manage page gains tabbed navigation across devices, device groups, users, application definitions and application groups, with the active tab persisted in the URL. Three-dot menus are replaced with inline View Details and Assign or Unassign links, and selecting a row opens a detail side panel.
• Elevation Recording for Endpoint Privilege Management: The EPM Windows agent captures screen activity while a privileged application runs, administrators replay it through the existing session-recording infrastructure, storage backends and player.

Authentication & Access

• Adaptive Authentication: Context-aware, risk-based login policies configured through a guided four-step wizard. Conditions are set on IP address, device, location and time of access, with a chosen enforcement action when they are not met, plus alerting and custom error messaging.
• Active Directory-Backed System Users: A system user can be backed by Active Directory rather than a vaulted password, with PAM creating or reusing the account at session time. Per-user settings cover the AD configuration over LDAPS, target OU, create if missing, delete after access, save in vault and rotate existing. Revealing a stored password in edit mode now requires an audit justification before decryption.
• Thick Client Access with Dashboard Credentials: SSH clients including PuTTY and MobaXterm, and RDP clients including MSTSC, xRDP and MobaXterm, can authenticate with the user's dashboard username and password.
• Scoped API Keys: Scoped API key creation is restored in Settings, with scopes defined from the default API key capabilities and the plaintext key shown once at creation. OAuth client credentials remain a separate flow with their own scopes.

Workflows & Approvals

• Slack Approval Integration: Approvers receive access-request tickets as Slack direct messages and can approve or reject without opening the PAM dashboard, using a decision modal for access type, window, system user and policy. Both legacy ticketing and workflow automation are supported, with /pam-request and /pam-tickets slash commands.
• Veto Approvers: Approvers can be designated as veto approvers on a stage. A veto approver's rejection rejects the ticket outright regardless of the configured approval strategy, covering cases where a specific approver must be able to block a request under any-one or majority rules.

Integrations & Connectivity

• SCIM 2.0 Provisioning: A SCIM 2.0 connector exposing standards-compliant endpoints so external identity providers can provision Users, Groups and the membership into PAM through the identity handler.
• Mutual TLS for PostgreSQL: The database proxy supports mutual TLS on PostgreSQL connections. The client presents a valid, short-lived certificate issued by the proxy for the thick-client connection; the proxy uses it to identify the session and authenticate to the real database through passwordless, certificate-based access.

Resilience & Deployment

• Break Glass Emergency Access: Emergency credentials are held in a separate service or offline secure medium so they remain reachable when PAM itself is unavailable. Retrieval enforces two-person control through an approval flow, and every access is recorded.
• High Availability Health Checks: Service and storage monitoring with TCP monitors confirming service ports are reachable and accepting connections, HTTP monitors calling service health endpoints, and configurable timeouts and intervals across microservices.
• Self-Signed SSL at Installation: An optional install-time prompt generates a self-signed certificate and key, applies the SSL configuration and starts PAM on HTTPS. Declining retains the existing HTTP-only flow, removing the need to configure the web server and certificates manually after install.

• IMPROVEMENTS:

Sessions & Recording

• RDP Thick Client Support for Web and Desktop Applications: MSTSC, Remmina and RDP File access extended to web and desktop applications, with credential prompting before the connection file is generated.
• File Transfer Auditing for RDP Thick Clients: Upload, download, delete, rename and clipboard actions in native RDP sessions are now recorded in the audit trail, matching browser-based sessions.
• Touch Support for Mobile RDP Sessions: An Enable Touch toggle lets Android and iOS users drive the remote desktop with touch gestures and an on-screen virtual keyboard.
• Multi-Tab Web Application Recording: Each browser window in a web application session is recorded separately under the same access.

Access & Users

• Remembered Access Preference: A Remember user access preference toggle in the Connect modal stores the connection method, sub-option and system user per resource.
• Configurable Default SSO Role: The role assigned to users provisioned through SSO is now configurable.
• Reusable Resource Access URLs: Resource access URLs remain valid across a page refresh, a session survives a reload and links can be reused within a session.
• Client Credential Scopes: Added a lock and unlocked users scope for client credentials.

Platform & Interface

• Resource Allocation Interface Revamp: Redesigned View Allocated and Allocate pages, with a resource header showing the resource icon, name, active state, sub-type and address.
• Keyboard Shortcuts in the Web App: Standard find, reload, history navigation, zoom, print, full screen and stop loading shortcuts added to the application window. Addressable Edit Pages: Edit pages can be opened directly by URL, refreshed and shared, keeping their context.
• Resource Name in Ticket Notifications: Send, update, approve and reject ticket emails now name the specific resource instead of showing only its type.
• Last Login Reporting: A Last Login filter on the Users Audit report shows one row per user with their most recent successful login, searchable by email.

Deployment & Security

• MySQL 8.4 LTS: The bundled database moves from MySQL 8.0 to 8.4 LTS for security fixes and long-term support.
• Electron 43 for XecureAccess Desktop: Upgraded to Electron 43 with the accompanying Chromium update, and fixed console disconnects when a window was fully covered.
• Web Application Login: Credential auto-fill now works reliably on web applications that use multi-step login flows.
• Group Audit Refactor: Group and group-user audits record the originating identity source and reference identifier, distinguishing AD sync, SSO, SCIM provisioning and manual administration.

• BUG FIXES:

Sessions & Recording

• SSH Session Auditing: SSH session activity is now captured reliably and appears in full in the audit trail.

Reports & Interface

• Report Filtering: Advanced Filter now applies correctly across the App Access, Asset Access, OT Device, OT Device Access, OT Device Allocation and Server Local User Access reports.

Security & Storage

• First Login Experience: Users created with a temporary password and a forced reset now sign in immediately after setting their new password, and branding URLs are handled consistently regardless of letter case.
• Cloud Storage Validation: Test Connection now validates Azure Cloud Storage and Alibaba OSS configurations before saving, with clear messaging when a connection cannot be established.

Release Date: 10th April, 2026

Version 2.4.1 Cloud On-Premise

---

• Release Summary:

We are pleased to announce the release of PAM v2.4.1. This release focuses on deep performance optimizations, core architectural resilience, and system stability. Alongside introducing a powerful new macOS client, this update delivers a significantly faster session management backend, hardened security workflows, and highly reliable protocol connections under heavy workloads.

• WHAT'S NEW:

macOS Client Integration:

• macOS Desktop Client for Web Apps: Introduced a new, natively optimized macOS desktop client featuring seamless multi-app support, real-time live streaming directly to the audit dashboard, and comprehensive full-session playback capabilities.

• IMPROVEMENTS:

Performance & Session Management:

• Optimized Recording & Playback: Re-engineered the session recording backend to be lighter and significantly faster. RDP, SSH, and Database sessions now feature highly reliable streaming playback, effectively eliminating previous load times.
• Real-Time Intervention: Upgraded live session monitoring capabilities, enabling administrators to track and instantly terminate suspicious user activity with zero system latency.

Auditing & System Resilience:

• Robust SSH Command Auditing: Enhanced the auditing infrastructure to reliably process and capture significantly longer SSH commands across a wider variety of complex prompts, shells, and tools without data truncation.
• Hardened Access Controls: Refactored core policies and access control mechanisms to be highly resilient under heavy processing loads, introducing clearer, actionable error messages for streamlined administrative troubleshooting.

Security & Identity Management:

• Advanced Anomaly Detection: Rolled out a more efficient, performance-driven anomaly detection engine. System security is further fortified with stricter password policy enforcement, corrected lockout expiries, and hardened reset workflows.
• Streamlined Directory Operations: Optimized Active Directory (AD) synchronization logic for highly accurate group mapping and engineered a faster, simplified bulk user import process utilizing role names.

Data Operations:

• High-Speed CSV Handling: Overhauled the data parsing engine to ensure fast and highly reliable CSV imports and exports for bulk infrastructure data across databases, web apps, and servers.

• BUG FIXES:

Protocols & Terminal Stability:

• Connection Reliability: Addressed underlying architectural bottlenecks to deliver highly stable RDP, SSH, SFTP, and SMB sessions with significantly reduced timeout drops.
• Terminal & Policy Execution: Fixed critical bugs to ensure consistent clipboard and file-transfer policy enforcement during active sessions. Optimized SSH terminal rendering for smoother display and successfully resolved application crashes previously triggered by non-UTF-8 output.

Reporting & System Accuracy:

• Data Precision: Fixed reporting logic to guarantee accurate client IPs in login reports, standardized terminal exit codes for better parsing, and ensured consistent asset schemas across the entire database architecture.