Want the full details? Click the link below!
NPS-D 26.06.0 is a hotfix release. Key highlights:
-
Entra ID sync reliability — fixed three bugs causing full Graph API sync every cycle instead of delta sync (30-min cycles → seconds); fixed SID byte-ordering breaking group-based access in My Systems and Access Risk; fixed hybrid group membership; fixed Last Successful Sync timestamp.
-
Windows Server 2025 support — upgraded impacket to 0.13.1 (SMB 3.1.1 for CIS L1 hardened servers); fixed Kerberos RC4/AES negotiation crash ahead of Microsoft’s July 2026 RC4 enforcement.
-
Access Risk — fixed empty chart for 1W/1M ranges; fixed daily crash on incomplete scan data; fixed Entra ID domain missing from domain selector.
-
Security — mitigations applied for CVE-2026-46300 and CVE-2026-43284 (Dirty Frag); Ubuntu patched kernels now available via
sudo apt upgrade. -
Tanium — Tanium Cloud enabled by default; bulk scan scales reliably to 10,000+ hosts.
Bug Fixes
| ID | Description |
|---|---|
| 439601 | Entra ID sync performed a full Microsoft Graph pull on every cycle instead of delta sync. Three bugs in svc_sync.py prevented saved delta links from being reused, forcing a complete tenant pull every run. On large tenants (200K users, 100K groups): ~30-minute sync cycles with heavy API rate limiting. After fix: incremental delta syncs complete in ~1 second. A related crash in mixed LDAP + Entra ID environments with renamed groups was also resolved. |
| 438352 | Entra ID cloud devices and groups stored with incorrect SIDs. A byte-ordering error in GUID-to-SID conversion caused stored SIDs to not match what Windows reports. In environments using Entra ID groups as local admins, this silently dropped devices from access paths — My Systems and Access Risk reports may have underreported Entra ID group-based access. Present since Entra ID sync launched. Existing records are corrected automatically on the first sync after upgrade. |
| 439575 | Hybrid group **member_of** field populated from the wrong source. A copy-paste error caused member_of (parent groups) to be filled from members (direct members) instead of memberOf from Microsoft Graph. For nested hybrid groups, users with access flowing through those groups could be missing from access lists. Corrected automatically on the next sync. |
| 437492 | Entra ID “Last Successful Sync” timestamp never updated. The sync.finish field was not written on sync completion, so the Domain Configuration UI permanently showed the original domain creation date. LDAP/AD domains were not affected. Fixed. |
| 440591 | Entra ID domain missing from Access Risk domain dropdown. On Insight › Access Risk pages (Privileged Users, Segregation, Cumulative), the Entra ID domain was absent from the selector — a blank entry appeared instead. Fixed; a data migration corrects existing records. |
| 440341 | Access Risk chart showed no data for 1-Week and 1-Month time ranges. The date window calculation used current time-of-day instead of midnight UTC, causing recent records to fall outside the query window. The 90-day range was unaffected. Fixed. |
| 440343 | Daily access risk calculation crashed on computers with incomplete scan data. A missing scanTs field in any computer’s lastScan record caused the analytics job to crash and not retry until the next day, making access risk history permanently stale. Fixed; incomplete records are now treated as never scanned. |
| 440035 | Defunct LDAP Sync UI section removed from Settings › Services. The LDAP Sync “Run Interval Minutes” control had no effect since March 2025. The dead panel has been removed. The correct control is Settings › Services › General Sync Service Settings › Run Interval Minutes. |
| 436802, 436803 | Export buttons unclickable and filter row layout broken on Insight and Management pages. On Insight › Access Risk / Computer pages, export buttons (Copy/CSV/Excel/PDF) did not respond to clicks — a CSS conflict from the L0 rebrand. On Management › Systems, the “Show Filters” button was mispositioned and expanded filters wrapped to a second row. Both fixed. |
| 438320, 438336 | Insight Overview: Y-axis incorrect on Privileged Accounts chart; stray checkbox overlaying High Risk Systems chart. Y-axis now starts at zero. Checkbox positioning fixed. |
| 436994 | Domain Configuration table: last row obscured by the action bar border. Fixed. |
Improvements
| ID | Description |
|---|---|
| 437617 | Tanium Cloud provider enabled by default. Tanium Cloud is now active in the EDR provider list on fresh installs and upgrades without any additional configuration. |
| 442108 | Tanium bulk scan scales to 10,000+ managed hosts. Hostname resolution during bulk scans is now sub-second at scale, ensuring reliable scan completion in large Tanium environments. |
| 424200 | Tanium bulk scan: offline device visibility and failure reporting improved. Offline devices are now recorded in the resource’s access history log after a bulk scan. The Bulk Scan Monitor “Failed” column now reflects all failure types (offline, timeout, parse error, execution failure). The “Offline” column is re-enabled in the results table. |
| 440648 | Windows Server 2025 support — SMB 3.1.1 (CIS Level 1 hardened servers). CIS WS2025 L1 enforces Smb2DialectMin=SMB311. Upgraded impacket to 0.13.1, which adds SMB 3.1.1 support, restoring scan and access management on WS2025 servers with this hardening applied. Verified on WS2025 Standard with Smb2DialectMin=SMB311. Workaround until upgrade: Set-SmbServerConfiguration -Smb2DialectMin SMB202 (does not disable encryption or signing). |
| 432667 | Windows Server 2025 support — Kerberos AES-only enforcement. Fixed a crash occurring when a scan account had only RC4 Kerberos keys and the DC enforced AES-only — the service now falls back gracefully and reports a clear error referencing msDS-SupportedEncryptionTypes. Note: Microsoft enforces Kerberos RC4 deprecation from July 2026 (KB5073381). Scan accounts should be updated to support AES before that date. |
Security
| ID | Description |
|---|---|
| 436747 | CVE-2026-43284 (Dirty Frag) — mitigation applied. Kernel modules esp4, esp6, rxrpc (not used by NPS-D) are now blacklisted in the installer. Ubuntu has released a patched kernel — run sudo apt upgrade and reboot to apply the permanent fix. |
| 437538 | CVE-2026-46300 — mitigation applied. Host-level mitigation included in the installer. Ubuntu kernel patches available via sudo apt upgrade. |
Upgrade & Deployment
Direct upgrades to 26.06.0 are supported from 25.12.x, 26.03.x, and 2.22.x.
Version 2.22.x has reached End of Support status and will no longer receive maintenance releases, bug fixes, or security updates. Customers running 2.22.x should upgrade to 26.06.0 to remain on the supported release path.
We recommend upgrading to 26.06.0 to benefit from the latest security updates, platform improvements, and Windows Server 2025 with AES support.
For both new installations and upgrades, container-based deployment on Ubuntu is now the recommended approach. The ISO appliance remains available for customers whose environments depend on it.
Learn more about container-based deployment:
Container-Based Deployment Is Now GA for Privilege Secure for Discovery
Need help with this update?
There are many different ways to get help with our products!
| Situation | Action |
|---|---|
| If you feel the product is broken and not working as intended… | Contact Support |
| If you have a question you’d like to ask other experts… | Create a discussion in the community: Privilege Secure > Discussions & Questions |
| If you have a feature request… | Let our product team know directly: Privilege Secure > Ideas |
| If you have something cool to show… | Show everyone what you built: Privilege Secure > Show & Tell |
What are your thoughts?
We are always happy to hear from our users on what you like, and what you hope to see in the future. Please, share your thoughts below!