• Home
• Release Notes
• Version 2.7.0

Version 2.7.0

Release Date: 8th October, 2026

---

• Release Summary:

miniOrange PAM 2.7.0 is a maintenance release. It extends web application access with support for native browser authentication and approval gated password fill, adds web connectivity for switches and routers, and moves all services to Python 3.14.6. The release also resolves issues across Endpoint Privilege Management, RDP session handling, resource visibility and the user lifecycle.

• WHAT'S NEW:

Web Applications

• HTTP Basic Auth Support for Web Apps: Web applications that use the browser's native authentication prompt instead of an HTML login form can now be published through PAM. The attached system user's credentials are supplied automatically when the application is launched through XecureAccess, so the prompt is never presented to the end user.
• Approval Gated Password Fill: Administrators can require approval before a specific password field inside a web application is filled. The user raises a request from the field itself, and once approved, the credential is entered and the form submitted without the user viewing or typing it. Approval authorises a single password release and grants no ongoing access to the resource.

Network Devices

• Web Access for Switches and Routers: Switches and routers can now be accessed via a web interface alongside SSH.

• IMPROVEMENTS:

Access and Policy

• File Transfer Control on the Default SSH Policy: File Transfer Control can now be enabled directly on the Default SSH Policy, removing the need to create a replacement policy and reassign existing SFTP allocations. New deployments have it enabled by default, and existing policies remain unchanged until updated.

Resource Management

• Tag Filtering in My Resources: End users can now filter their allocated resources by tag. Tag administration is governed by its own permission rather than inheriting the Assets permission.

Platform and Deployment

• Python 3.14.6: All PAM services now run on Python 3.14.6 for improved performance and long term support.
• SSL Configuration Retained on Update: Updating an SSL enabled deployment now preserves the certificate configuration while applying the new build's web server routes, including the routes required for language support.

• BUG FIXES:

Sessions and Recording

• RemoteApp Session Termination: Closing a published application launched through the RDP client now ends the underlying session and releases the proxy connection. Session recordings close at the same point and no longer continue to grow.
• Administrator Session Termination Notice: Users whose session is terminated by an administrator are now shown a Session Suspended page with a link back to the dashboard. The access link cannot be reused, and all browser tabs belonging to that session are closed.

Endpoint Privilege Management

• Paginated Selections in Assignment: Selections made across multiple pages are now retained in full when creating an application group or a custom policy.
• Kill Switch Policy Tabs: Kill Switch policy applies only to devices and device groups. The Manage screen now shows only these two tabs and hides the unsupported user and application tabs.

Users and Access

• Resource Visibility in Search: Searching My Resources by display name or resource type now returns only the resources allocated to the logged in user.
• Desktop Application Ticket Approval: Access tickets raised for desktop applications can now be approved. The System User field is no longer required for these tickets, as desktop applications are allocated without a system user.

Interface

• Registration Page Validation: Registration fields now display a single validation message, and the confirm password check updates correctly when the password is edited afterwards.
• Interface Consistency Fixes: The Download XecureAccess button label no longer wraps in a narrow toolbar, the Tags section follows a consistent layout across all edit pages, and tag filter messages reference the correct location.

Platform and Deployment

• Protocol in Cloud Registration: New cloud registrations now store the organisation URL with the correct protocol, so the sign in redirect and OAuth callback URLs generated on the SSO page use HTTPS.