Password Secure Version 26.3.100 released

[hano.grimm]

Want the full details? Click the link below!

Download Netwrix Password Secure 26.3.100 here!

Password Secure 26.3.100 Now Available

Important: breaking change

This release introduces a breaking change.

All clients must be upgraded to the same version as the server. Older clients are no longer able to connect.

What’s New in Release 26.3.100

Updated interface and branding

The web application and the browser extension interfaces, as well as the reports, have been updated to align with Netwrix branding, ensuring a seamless, unified experience for security teams using multiple Netwrix products.

New versioning scheme

Password Secure now follows a new versioning format:

YY.M.VVV (Year.Month.Release indicator)

This makes it easier to understand:
• when a release was shipped
• how significant the changes are

For more details, please refer to the documentation: A new version number — here’s what changed and why

New user right: “Can manage reports”

A new permission allows administrators to control who can create reports.

• Existing databases: enabled by default (to maintain current behavior)
• New databases: limited to administrative users

Bug Fixes and Miscellaneous Updates

• Improved validation and consistency across the web application
• Fixes for logout behavior and UI inconsistencies
• Improved autofill detection for more websites
• Multiple security-related improvements across components. Additional details can be viewed here: https://community.netwrix.com/t/adv-2026-005-vulnerability-in-netwrix-password-secure/125724

Bug Fix List

Component	Description	Case #	Escalation #
Windows App	When changing the name of a form and closing the tab without saving, the Windows app now asks the user if the changes should be discarded.	416119
	In the ribbon, starting an application from the password list displays the name of all connected applications again. In the application list, the names of connected passwords are displayed again, too.	417913	4308591
Web App (Advanced View)	When creating a seal, the fields for configuring the validity hours of release requests and releases are no longer marked as errors after their value was changed.	418951
	The number of affected users, groups, and organizational structures in the Active Directory synchronization assistant is now displayed correctly again.	417335	4308526
Web App (Basic View)	When logging out from the web app, it may happen that the page flickers. This issue is now resolved. [Web App (Advanced view), Web App	409237
Server	Security: When a server method fails, the stack trace is no longer reported to the customer.	417945	4308597
Browser Extension	We improved the logic Password Secure is using to find login forms that can automatically be filled. More sites should now be supported again.	386492	4264369
	We fixed an issue with the automatic password entry in websites for many sites, where the file ending caused problems (like, e.g., .jsp or .jsc files).	417448	4308547, 4308556, 4308567, 4308576, 4308502, 4308625, 4308646, 4308691, 4308718, 4308783

Compatibility

All clients must match the server version.

Older client versions are no longer supported for this release.

The following client versions are compatible with Netwrix Password Secure Application Server 26.3.100:

• Windows & Web App: same version (26.3.100)
• Browser Extensions & API/SDK: >=26.3.100

Note: This release brings in some breaking changes. Because of this, all clients need to be upgraded as soon as the server is upgraded to the newest version. Older clients are not able to connect!

NOTE: With the release of Version 26.3.100, support for version 9.0.0.30423 and older has stopped.

Need help with this update?

There are many different ways to get help with our products!

Situation	Action
If you feel the product is broken and not working as intended…	Contact Support
If you have a question you’d like to ask other experts…	Create a discussion in the community: Password Secure > Discussions & Questions
If you have a feature request…	Let our product team know directly: Password Secure > Show & Tell
If you have something cool to show…	Show everyone what you built: Password Secure > Show & Tell

What are your thoughts?

We are always happy to hear from our users on what you like, and what you hope to see in the future. Please, share your thoughts below!

[rsantos (randy)]

@hano.grimm

Browser Extension We improved the logic Password Secure is using to find login forms that can automatically be filled. More sites should now be supported again. 386492 4264369 We fixed an issue with the automatic password entry in websites for many sites, where the file ending caused problems (like, e.g., .jsp or .jsc files). 417448 4308547, 4308556, 4308567, 4308576, 4308502, 4308625, 4308646, 4308691, 4308718, 4308783

Hopeful that this will help with the autofill when trying to sign in to google workspace.

[pgo1337]

When will the Android application finally receive an update? It is currently, to put it mildly, entirely unusable.

[Lukrecija (Blattmann)]

@hano.grimm

When renaming a form and closing the tab without saving, the Windows app now asks the user whether the changes should be discarded. 416

In forms (or individual form fields) that have a required field (e.g., in our case this is the application number) and a minimum length for the required field was configured, after updating to v26.3.100 the predefined minimum length is no longer accepted. The message that the minimum length has not been reached always appears, even though it has been. The minimum length for this required field was configured to 7 characters and a maximum of 10 characters. The forms now need to be modified since no new passwords can be entered. The minimum and maximum length of the required field must be set to 0 in order for new passwords to be entered.

On the other hand, “already entered passwords” can no longer be edited and saved, as the message appears that the forms have been changed.

I have also noticed that in the WebClient not all form fields are visible and cannot be edited, whereas in the FullClient they can.

[Sascha (Sascha Martens)]

Hi Lukrecija - we’re investigating the behavior regarding the form-fields - we’d really appreciate it if you could open a ticket w/ customer support for this case

In terms of the ECC Migration:
We’ve implemented a new analysis and cleanup tool accessible via the Server Manager. Besides Base64 errors, it can also check for and remove orphaned rights, seal keys, and seal releases. This will significantly reduce migration-related errors.

[d.wac (Daniel Wachowski)]

Hi Sascha,

does that mean we should wait a bit longer before installing the update even if it closes the critical vulnerability?

The feedback from @Lukrecija isn’t very comforting:

@Lukrecija

On the other hand, “already entered passwords” can no longer be edited and saved, as the message appears that the forms have been changed.

I have also noticed that in the WebClient not all form fields are visible and cannot be edited, whereas in the FullClient they can.

[Sascha (Sascha Martens)]

Hey Daniel - thanks for your question! We’re still investigating the behavior and will update everyone as soon as possible. In the meantime, we still recommend installing the update (for security reasons).

If functionality - especially affecting so many customers/passwords - is affected, we will work on a patch with all available resources!!

Cheers,
-sascha

[d.wac (Daniel Wachowski)]

Hi @Sascha, thank you for the quick response. We will update it in our lab environments and let you know if we face anything similar.

[Sascha (Sascha Martens)]

That’s awesome, Daniel! Appreciated!!

If you see something, it would be amazing if you could open a ticket w/ customer support to better help us investigate!

[muellert (Thomas Mueller)]

Hi Sascha

The support ticket has already been created.

Thomas

[GabrielWrona]

Hello everyone,

after updating to the current version 26.3.100, the web application shows an outdated version.

How can I update the web application?

Thank you very much.

[User001 (Martin Wälchli)]

I think the source hashes are not published here.
thanks
Martin

[d.wac (Daniel Wachowski)]

Hi all,

according to my tests, I could not find any issues when updating from version 9.3.0.33526 to this version.

I tested the following topics:

1. Logging into the database as an administrator and standard user:
   1. Create OU
   2. Create password entry
   3. Change password entry (synchronise history)
      1. Changing a password using a password policy
   4. Changing the password entry form
   5. Moving a password entry
   6. Deleting a password entry (move to recycle bin and permanently delete)
   7. Deleting an OU

PS: It was tested in two lab environments for Windows and the web app.

[User001 (Martin Wälchli)]

It seems that we have some issues after upgrading to 26.3.100 with Remote Desktop Manager connections. We are actually analysing this.

[User001 (Martin Wälchli)]

It seems our dev. Team was able to fix it by fixing some dll’s for now.

[Sascha (Sascha Martens)]

Hey Everyone - thanks so much for all of your contribution <3

As you might have seen already, we have released another patch (26.3.101) addressing the reported issues!

→ Here is the new announcement: Patch Version 26.3.101 for Password Secure released

Cheers,
-sascha