Looking for a bug fix list for all versions of Privilege Secure?
All bug fixes will automatically be added here!
26.07 Updates
Netwrix Privilege Secure Q2 2026 Release (26.07.1)
July 30, 2026
| ID | Description |
|---|---|
| 424937 | Can’t find policy which matches: account, resource and activity |
| 438600 | Resourceless activity shows 30 minute expiry regardless of actual setting |
| 392759 | Provisioning Entra Accounts Error |
| 402118 | Old resources still show up in NPS with every AD sync |
| 402925 | Passwords not rotating on activity start |
| 403103 | Poor performance when filtering resources |
| 420815 | Users not getting removed from groups |
| 424095 | Slow Server List Loading and Session Creation |
| 432040 | SQL Server performance poor |
| 433524 | Privileged Accounts not able to RDP into machines |
| 434817 | Password not Rotating for multiple users Credential Checkout |
| 434828 | New Activities Not Showing in “My Activities” |
| 435018 | NPS unable to provision Linux sessions |
| 426953 | Account created in all caps will not allow access to Linux resource |
| 426531 | Linux sudo elevation failing |
| 436769 | Cannot View Historical Dashboard |
| 437957 | Cisco Activity Token Provisioning Regression |
| 440585 | EntraID - Request_ResourceNotFound |
| 437354 | Ephemeral accounts not deleted with AD sync |
| 442697 | Events page only shows 30 records with no pagination |
| 426104 | SSH failures caused by missing ticket number prompts |
| 435175 | Groups don’t show up in Users and Groups |
| 439532 | Linux session won’t provision for the accounts that has uppercase letters |
| 440181 | Login not possible after updating |
| 437949 | Multiple password changes simulatenously for user, wrong password being returned |
| 438776 | No connection to Linux systems |
| 405323 | Not able to scan Windows host using IP address |
| 436011 | Password is "empty when copied or Error 404 when clicked on view password |
| 445877 | PlatformId Null without scan |
| 443492 | Schedule task getting queued and not finishing |
| 440664 | Unable to recreate service account after it is deleted |
| 447423 | SRA portal fail |
| 447467 | Unable to provision Cisco devices that support both secret and password for users |
| 447582 | Host collision insert error |
Known Issues
| Description |
|---|
| EntraID password rotation. Microsoft tightened permissions and requires additional roles: https://docs.netwrix.com/docs/privilegesecure/26_03/admin/configuration/serviceaccounts/entraidappregistration |
| EntraID 404 issue - First off, ensure that the Entra service account has the proper permissions (see link above) Second, most EntraID issues were resolved in 26.03.2. However, a customer with a version of NPS prior to 26.03.2 may have an EntraID account that still won’t work. It must be deleted and then re-scanned into NPS to work. Since the NPS soft-deletes accounts, it may have to be removed from the database. Support may be required to do this. |
| P12 to PG 16 upgrade sometimes requires a manual step for schema update using the DBUpater tool. |
| Weak SSH algorithms The SSH algorithms NPS uses may be modified to comply with customer security requirements (usually removing “weak” algorithms) Be sure BOTH files are present and modified. https://docs.netwrix.com/docs/privilegesecure/26_03/install/sshconfigurations |
| Microsoft KB5082142 includes deprecating the RC4 algorithm for Kerberos tickets. Domain controllers with the patch stop issuing RC4 tickets. Microsoft tried to make this seamless, but there could always be accounts that don’t get updated or can’t accept RC4. See the article here. |
| AD Sync scheduling offset one hour. This bug was fixed |
| PlatformID issue. When upgrading from previous version to 25.12.0 and up to this release, resources needed to be re-scanned to bring in a new platformID. This caused issues for customers that didn’t know to rescan and in some cases even caused issues for customers that did know. In this release, we put in a fix so that the resources rescan automatically and fixes the platformID issue. However, in a very specific case, upgrading from 25.12.1 and NPS is in a cluster environment, then a rescan is still required. We don’t see this issue for stand-alone server installations or other upgrades. 
If they are not deleted, then after the upgrade, then those resources will show up as duplicates with the same IP address. If this happens both entries need to be deleted and the resource re-onboarded and scanned.
26.03 Updates
Patch Version 26.03.2 Released - Privilege Secure
June 9, 2026
These updates fixed the remaining EntraID issues (Please note the needed permissions mentioned in the Known Issues section below) and greatly increased scheduled AD sync and PW rotations. Hotfix 3 will add clearing stuck sessions to make the PW rotations even more reliable.
| ID | Description |
|---|---|
| 437643 | When upgrading Netwrix Privilege Secure, the file SamlRequestTemplate.xml (and SamlSignoutTemplate.xml) located in the Web installation directory (e.g. D:\Program Files\Stealthbits\PAM\Web\) is overwritten with the default version shipped in the installer. Any customer modifications to these files, such as custom SAML request attributes required by their identity provider, are silently lost. Upgrading to this hotfix or any release after this will still require that you recover the customer files. However, any subsequent upgrade will preserve those files if modified. In other words, it takes two upgrades to get past this issue. |
| 437991 | EntraID accounts that have nested groups and roles will fail to deprovision, then not provision the next time. |
| 438297 | Manual password rotation when a session is active causes issues when the session ends. Blocked password rotation if there is an active session. |
Patch Version 26.03.1 Released - Privilege Secure
May 14, 2026
| ID | Description |
|---|---|
| 432669 | Scheduled AD sync and PW rotation fails |
| 433523 | EntraID account deprovision issues. Graph API errors. |
| 435128 | SSH algorithms were made configurable in 26.03.0, but were defaults were too restrictive for backwards compatibility. More algorithms were included by default. Customer can modify SSH encryption algorithms. See: https://docs.netwrix.com/docs/privilegesecure/26_03/install/sshconfigurations |
Netwrix Privilege Secure Q1 2026 Release (26.03.0)
April 24, 2026
| ID | Description |
|---|---|
| 419689 | Linux service account with certificate login tries password first. |
| 419574 | User not added to Group if samAccount name differs |
| 419669 | Approver emails not sending |
| 423477 | Old resources still listed after AD sync |
| 419868 | Passwords not rotating on activity start |
| 420690 | SQL Server pre-session didn’t add all users to roles/groups |
| 418596 | AD sync scheduling fails. |
| 422126 | Users nor removed from groups post session |
| 422127 | AD resources page “Remove NPS role” button remains after removal |
| 422518 | Stop session disables account when used in other sessions |
| 417668 | Ephemeral user account profiles not deleted |
| 413805 | Logs showing activity time in GMT instead of local time for scheduled activities |
| 415352 | Support environments where TLS 1.0 and 1.1 have been disabled (1.2 and 1.3 preferred) |
| 417492 | Replay session broke in Safari |
| 403358 | Scheduled email report not sending email |
Known Issues
| ID | Description |
|---|---|
| 426243 | EntraID password rotation requires password administrator role. Need to update KB. |
| 418597 | P12 to PG 16 upgrade requires a manual step for schema update. |
25.12 Updates
Patch Version 25.12.2 Released - Privilege Secure
January 29, 2026
The latest Hotfix, version 25.12.2 of Netwrix Privilege Secure, is now available, addressing the issue detailed below.
| ID | Description |
|---|---|
| 411913 | Improved stability when calling built-in PowerShell scripts |
| 412894 | Resolved Active Login and Session Cancelled/Completed not appearing in SIEM events for certain activities |
| 413510 | Added stability to backend Quartz concurrency |
Netwrix Privilege Secure Q4 2025 Release (25.12.1)
December 18, 2025
This list includes the most significant fixes in this release; numerous minor bugs have also been addressed.
Bug Fixes
| ID | Decription |
|---|---|
| 401184 | Secure Remote Access: Copy/paste for text now works as expected |
| 405067 | Sessions now provision as expected when using any of the built-in Replication steps |
| 400511 | Remove from AD Group now works in all expected circumstances |
| 402745 | Unmanaged users no longer disappear from the Credentials tab |
| 402791 | Login Account Template now respected for “Custom” Requester Login Format |
| 405542 | Service accounts no longer get stuck in “queued” state when rotating passwords in certain scenarios |
| 406000 | Active session reference counts are now accurate; no longer prevent password rotations from occurring or managed accounts from being disabled |
| 403122 | Improved page load speed for domain details |
| 403123 | Improved page load speed for events |
| 403292 | Policy search now works as expected when viewing a user |
| 404013 | User group authentication method now overrides “Internal MFA” authentication |
| 404211 | Managing individual resources now works as expected for Active Directory for resource groups |
| 404217 | “Rotate” button now works as expected for resource groups |
| 404427 | Passwords can now be viewed as expected within the NPS UI (when allowed by admins) |
| 405051 | Protection Policies now function as expected in all scenarios. |
| 405395 | IIS no longer fails to load when running the installer due to “stalled running jobs” |
| 405994 | Improved performance of loading credentials from both PostgreSQL and SQL Server databases |
| 407104 | Improved performance for session provisioning and deprovisioning |
| 407930 | Improved performance of various lists throughout the application |
| 408017 | Drives can now be mapped during RDP sessions as expected |
| 408167 | All report filters now respect the specified timeframe |
| 408176 | Proxy now deleted old log files as expected |
| 409290 | Resolved data processing error ‘null value in column “HostUsersId” of relation “HostDatabaseDbHostUser” violates not-null constraint’ during Oracle and SQL database scans |
| 409295 | Removed “Associated Domain Controller” and “Service Account” fields from website resources, as they served no function |
| 409907 | Resolved PDF download failure in Audit & Reporting |
| 410292 | Improved communication performance for service messaging broker |
| 411442 | Resolved replication scheduled task conflict w/ multiple Action Service workers |
| 412361 | Resolved NATS communication issues in service meshes |
Known Issues
| ID | Description |
|---|---|
| 401699 | NPS servers that don’t use a trusted certificate need to re-add ‘InsecureSkipVerify’ to Host Scan Service’s ‘appsettings.user.json’ after upgrading |
| 410722 | Error duplicate key value violates unique constraint "PK_host_user_group_join” |
| 410813 | RDP sessions may have issues related to extending sessions, recording keystrokes, and viewing the mouse cursor when both the client and destination are a combination of Windows 11 and Windows Server 2025. |
25.09 Updates
Hotfix Version 25.09.30002 Released for Netwrix Privilege Secure
October 7, 2025
| ID | Description |
|---|---|
| 359286 | Policy list and policy count on Users & Groups > Users > Policies tab now match |
| 400425 | Passwords for managed accounts are now properly rotated (Managed Account sessions, Credential Release, etc.) |
| 400988 | Added expanded logging for Active Directory sync |
| 401543 | Updated the ciphers used in the Proxy Service |
| 401545 | RDP window no longer needs to be manually closed when an RDP session ends |
| 401898 | Oracle Users with ‘infinity’ or ‘-infinity’ set as their ‘password_changed_date_time’ no longer cause credential page load failures |
| 401900 | Proxy Service now uses the expected version numbering format |
| 402822 | Certain Active Directory account types experiencing an error during management no longer experience this issue |
| 403101 | Provisioned sessions now accurately appear on Access tab without needing to refresh the page |
| 403126 | ‘SkipEmitEvent’ setting added to Web Service’s appsettings.json, which will bypass adding duplicate errors to SIEM |
| 403292 | Policy search when viewing a user now functions as expected |
September '25 Release (25.09.16002)
September 23, 2025
This list includes the most significant fixes in this release; numerous minor bugs have also been addressed.
Bug Fixes
| ID | Decription |
|---|---|
| 393674 | Prevent browser extension from exiting the browser when dev tools are opened |
| 396146 | Server error while starting live session view: “Unable to load recording not available” |
| 400525 | Requester using requester account during activity steps rather than output of login account template |
| 400820 | For Direct Connect Strings, revert Requester logic for all login templates other than “Custom” so only a single password entry is needed when NPS User == Requester User |
| 401052 | RefreshTokens are overwritten by the Heartbeat Worker - causes a service that is offline for more than 15 minutes to fail to RenewToken |
| 401056 | RDS Web App Launcher - Auto Credential Injection Failure |
| 401058 | Accounts not being enabled due to NPS server unable to find PDCe |
| 401168 | Users with ‘infinity’ or ‘-infinity’ set as their password_changed_date_time cause credential page load failures |
| 401319 | HostScanServiceWorkers and ActionServiceWorkers don’t respawn as expected |
| 401891 | NPS creates sudoers.d files with incorrect permissions (0770 instead of 0440) |
| 401402 | Secure Remote Access Portal: Cannot launch Entra ID MyApps via RDS when using the Dashboard tab - “Unable to download RDP file” |
Known Issues
| ID | Description |
|---|---|
| 401184 | Copy/paste doesn’t function during Secure Remote Access RDP sessions |
| 401699 | NPS servers that don’t use a trusted certificate need to re-add ‘InsecureSkipVerify’ to Host Scan Service’s ‘appsettings.user.json’ after upgrading |
Hotfix Version 25.09.03002 Released for Netwrix Privilege Secure
September 9, 2025
| ID | Description |
|---|---|
| 400423 | Disable user action could fail to find the PDCe in certain domain environments |
| 400424 | Interactive App Launch can now be used with website and database resources |
| 400428 | Viewing SIEM Service details created a long running query that didn’t cancel |
| 400435 | Updated version of the Endpoint Policy Manager integration that ships in the Extras folder |
| 400445 | The MFA registration page could appear in certain circumstances after a user was removed from NPS and the user tried to log-in again |
| 400449 | “Copy Username” and “Copy Password” buttons didn’t work as expected in Safari on macOS |
| 400472 | Removed “Copy” functionality from the Active Directory platform |
| 400473 | In certain circumstances, a report’s data in the UI could be slightly different than the report’s data when downloaded as a CSV |
| 400475 | Users that have been removed from NPS could still appear in certain places within the app |
| 400517 | Service account rotations could get stuck in the “queued” state |
| 400421 | Secure Remote Access: “Failed to impersonate user” error could prevent access to sessions via the Portal |
| 400961 | Secure Remote Access: Nginx process wouldn’t start automatically after Portal installation or reboot |
25.08 Updates
Hotfix Version 25.08.15002 Released for Netwrix Privilege Secure
August 19, 2025
| ID | Description |
|---|---|
| 39 | Folder nps_realvnc is missing in Extras folder |
| 10 | Requester sessions as local Windows users don’t work |
| 44 | Secure Remote Access (SRA): For a scheduled session the “requested by” hyperlink should not be present |
| 16 | Services often need to be re-registered; every few days session provisioning starts to fail |
| 45 | SIEM Service Performance: Need indexes to handle large data volumes |
July '25 Release (v25.08.04003)
August 7, 2025
This list includes the most significant fixes in this release; numerous minor bugs have also been addressed.
| ID | Decription |
|---|---|
| 373712 | Browser Extension: Resolved “Clear Website Data Before Start” not targeting cached admin.microsoft.com data |
| 381101 | Resolved an issue preventing Task Automation sessions from ending |
| 384101 | Stopped High Availability configuration tool from generating numerous pg_hba.conf.old files |
| 391963 | Resolved an issue that could cause discrepancies in SIEM event times |
| 391964 | Prevented incorrect password changes in certain multi-activity scenarios |
| 392764 | Prevented Content Security Policy from breaking the Secure Remote Access portal UI |
| 394009 | Non-Default Connection Profiles are now updated to record keystrokes if session recording was already enabled when upgrading |
| 394452 | Resolved situation that could prevent Secure Remote Access portal sessions from connecting |
| 394483 | Prevented host scan from marking computers as “WinRM Disabled” if it cannot find a host online during subsequent host scans |
| 395827 | Resolved Cisco OS detection for Linux causing an issue with certain Cisco devices |
| 396697 | Resolved copy/paste not always functioning during Secure Remote Access sessions |
25.06 Updates
June '25 Release (v25.06.30001)
July 1, 2025
This list includes the most significant fixes in this release; numerous minor bugs have also been addressed.
| ID | Decription |
|---|---|
| 342834 | NATS could time out due to a large amount of unsent approval emails |
| 378406 | NPS user account password could be incorrectly prompted for instead of the intended session Requester’s password |
| 392894 | Action Service was not always prioritized over the Host Scan Service |
| 392901 | Certain changes to the Host Scan Service could inadvertently disable the Email Service |
May ‘25 Release (v25.06.23002)
June 12, 2025
This list includes the most significant fixes in this release; numerous minor bugs have also been addressed.
| ID | Decription |
|---|---|
| 390126 | Managed Account check-in workflows did not always function as expected |
| 388185 | Unassigned access policies could display on the Resource Selection > Session Wizard |
| 387363 | Activities that add to Domain Admins group could fail for subdomains |
| 386979 | Removed a cipher typo in sbpam_sshclient.json |
| 386260 | Hosts added through Active Directory could have DNS name falsely replaced if a scanned failed |
| 386065 | “OS Not Defined” errors could unexpectedly cause host protection and disable RDP to fail |
| 385401 | New Connection Profiles could unexpectedly display under Activity Token Complexity Policy |
| 383678 | Unsupported PostgreSQL regions could cause upgrade failures |
| 381832 | RDS sessions to macOS using RealVNC could fail |
| 374434 | Domains could unexpectedly display under Session Wizard Resource Selection |
| 374220 | API endpoint for looking up Approval by Approval ID did not always function as expected |
| 369763 | Failed password changes now throw better errors in logging |
| 369006 | Custom roles could expose unassigned credentials to users |
| 367236 | Historical page did not load in certain circumstances |
| 363171 | Improved logging for nltest |
| 361054 | Resolved issues with Cisco Model 3850 host scans |
| 360092 | Website sessions could remain live when a session is ended |
| 359030 | Access Policy - user name of a managed account would not always update after AD Sync |
| 356428 | actionserviceWorker could cause a memory leak |
| 347476 | Entra ID verify/rotate password would not function in certain scenarios |
| 346692 | Incorrect values could be used for %Resource% in a proxy’s macro |
| 346446 | User Profile cleanup did not always behave as expected for Domain Accounts |
| 345708 | Renaming a website resource could potentially not update the Credentials tab |
| 345389 | The WebService could process recordings on nodes where the recording does not exist |
| 345316 | Incorrect values could display in the Last Login Column for Role Management |
| 345256 | Webm recordings could potentially get discovered by the wrong proxy in a multi-proxy environment |
| 344086 | Entra ID - With both the create account and delete after use checkboxes selected, the same user could not always be created twice |
| 343827 | Dashboard’s “Users” card could cause a memory leak when getting especially large |
| 340747 | Managed User login status did not always update when a user logged-in |
| 319593 | Setting a daily platform host scan schedule could result in an incorrect time |
| 306265 | AD Sync would not always update “Member” tab for Group under Users and Groups as expected when a user was removed |
| 304973 | Timeouts could occur when calling PowerShell function Get-SbPAMAdUser |
| 303774 | Custom roles did not always display on the User Roles tab |
| 295700 | Certain aspects of Resource Groups were not working as expected |
| 198027 | Confirmation pop-up did not display group names when removing one or more groups from Collections |
| 138219 | Local accounts for a removed credential could still display in Credentials |
| 87195 | Adding a user group inside of another user group did not always display as expected |
4.2 Updates
Patch Version 4.2 Hotfix 10 Released for Netwrix Privilege Secure
June 3, 2025
We are committed to enhancing the security and reliability of Netwrix Privilege Secure. Please see the important updates below.
| ID | Description |
|---|---|
| 388813 | Resolve an issue causing transport layer errors with RDP |
| 388816 | Resolve an issue causing Domain Admin sessions to fail for foreign domains |
| 388809 | Update version scheme to yyyy.mm.ddxxx |
Patch Version 4.2 Hotfix 9 for Netwrix Privilege Secure Released
May 20, 2025
We are committed to enhancing the security and reliability of Netwrix Privilege Secure. Please see the important updates below.
| ID | Description |
|---|---|
| 386260 | Host added through Active Directory could have DNS name falsely replaced if scan fails |
| 386065 | OS Not Defined, unable to protect host and unable to enable/disable RDP on a host |
| 385401 | New Connection Profile can show incorrect Activity Token Complexity Policy |
| 383678 | PG16 Unsupported PostgreSQL Region causes upgrade failure |
| 382921 | Database service status indicator not functioning |
| 382073 | Connection Profile Page - Activity Token Complexity drop list is not populated |
| 381832 | Cannot launch RDS session to MacOS using RealVNC |
| 379565 | Unable to create Access certification |
| 378200 | Custom Script - Force managed account to be disabled in post-session |
| 377258 | Connect icon in session dashboard |
| 376609 | Find/enable pre-session step should ignore Active Directory Recycle Bin objects |
| 376298 | Do not allow “Active Directory” resource group to be added to Access Policies |
| 376136 | Access Certification - Users selection list includes Groups |
| 373681 | OIDC configuration wizard can destroy token information |
| 373679 | OIDC authenticator fails to “Get User Data” on the first try |
| 373375 | Group membership add/remove should obtain membership information from the target group |
| 371838 | Resources - Hide “Remove from Database” |
| 370747 | User/user group information missing from add users and groups table |
| 370526 | PG16 Installer - Disk space check |
| 369765 | Active Directory Sync - avoid merge conflicts |
| 369763 | Password Rotation Logging - failed password change needs to throw an error |
| 369006 | Application Security - Custom role exposes unassigned credentials to users |
| 365589 | Enhanced logging for approved sessions |
| 363795 | Unable to create connection profile |
| 363590 | Unable to edit default connection profile |
| 363545 | Cisco - Cannot bind argument to parameter “OS” because it is an empty string |
| 363335 | Putty (Handler) does not work for Linux/Cisco on Chrome |
| 363171 | Logging enhancements for nltest |
| 362721 | Import Posh Signing Certificate uses wrong registry key |
| 362293 | User able to create duplicate connection profiles |
| 361770 | Browser Extension - Ensure that a closed tab always results in a closed session |
| 361738 | Issue adding multiple resources using CSV file |
| 360092 | WebSite Session is now live when session ends |
| 359478 | Prevet merge conflict with SQL backend |
| 359155 | Improve error message for distinguished name parsing in ManagedGroupController |
| 359030 | Access Policy - User name of managed account not updated after AD Sync |
| 358773 | Proxy - Session Extension - Enhanced Logging |
| 355019 | AddMultiple REST endpoint is not de-duping inputs |
| 305747 | Activity Token is created in parent domain instead of child domain when both domains are onboarded |
| 300969 | SAML configuration page - “Test Connection” and “Login” buttons only work on the second click |
Patch Version 4.2 Hotfix 8 for Netwrix Privilege Secure Released
May 1, 2025
We are committed to enhancing the security and reliability of Netwrix Privilege Secure. Please see the important update below.
| ID | Description |
|---|---|
| 380266 | High Availability - Hardcoded Credentials for Postgres ‘repuser’ |
A revised version of our High Availability configuration article is available here. It is essential that you precisely follow these updated steps for all future upgrades. In particular, between configuring the HaMgr tool on the primary and secondary servers, ensure that the encryption keys and the appsettings.json file from the primary are exported to the secondary.
Thank you for your prompt attention to this security matter. For further assistance, please contact our support team.
Patch Version 4.2HF7 Released for Netwrix Privilege Secure
April 15, 2025
| Description | Case # |
|---|---|
| Update FreeRDP to 3.10.3 (addresses graphical issues when launching RDP sessions from Windows 11 24H2) | 360881 |
| Postgres 16 upgrades - before running pg_upgrade, shutdown all relevant NPS services | 377834 |
Version 4.2 - Release Notes & Bug Fixes
April 9, 2024
See the Netwrix_PrivilegeSecure_4.2_BugFixList PDF for a list of bugs fixed in this version.
The following versions may have limited or no support. Please see the