BeyondInsight and Password Safe 26.3.1 release notes

❗
Important
This maintenance release supersedes all other previous 26.3.x releases. To see prior release versions, see Release notes page.

🆕 New features

This is a maintenance release. There are no new features.

✨ Enhancements

This is a maintenance release. There are no enhancements.

🛠️ Issues resolved

Product Area	Issue Description	Issue Resolution
Security – Third-party components	The bundled OpenSSL libraries required an update to address recently disclosed vulnerabilities.	The OpenSSL libraries bundled with BeyondInsight and the Resource Broker are updated to version 3.5.9.
Password Management	When a scheduled password test of a Windows managed account takes longer than the managed system’s connection timeout, Password Safe queues a Reset Password on Mismatch change even though the password was never checked. On slow networks this can cause unnecessary daily password rotations.	A password test that times out no longer queues a password reset, matching how connection failures are handled. A test that fails because of a wrong password still queues the reset.
Public API	In some environments, Public API calls intermittently fail with database connection timeouts. Public API sessions send more requests to the database than necessary, which can overload it during busy periods.	Public API sessions now make far fewer database requests, and the intermittent connection timeouts no longer occur.
Event Forwarding	When using a TCP or TCP SSL connector for event forwarding, BeyondInsight attempted to reuse connections that had been closed by the receiver due to inactivity. This resulted in the silent loss of event batches because the system did not detect the closed state before sending, and no retry mechanism was triggered for the failed delivery.	BeyondInsight now properly validates the connection state and ensures that events are successfully delivered or retried upon failure, preventing data loss when receivers close idle connections.
Event Forwarding	BeyondInsight event forwarding occasionally missed events that arrived in the few seconds immediately preceding a scheduled check. Because the check moved the starting point for the next interval past these events before they were written to the database, the missed events were never collected or forwarded.	The event forwarding logic now ensures that the starting point for subsequent checks does not bypass events that have not yet been committed to the database. All events are now successfully collected and forwarded exactly once.
Public API	On systems with a large number of sessions, a Public API GET Sessions request with no filter never completes and keeps SQL Server CPU at 100%.	GET Sessions requests now complete promptly on large session tables, and the response is unchanged.
Smart Rules	In environments with a large number of Smart Rules, creating, updating or deleting a managed account through the API can take several minutes to return. Automation with shorter timeouts may report the call as failed even though the change succeeded. Disabling Smart Rules does not help.	Managed account creates, updates and deletes calls now return promptly, regardless of how many Smart Rules exist, and Smart Rule results are unchanged.
Smart Rules	Asset Smart Rules that use the User Account Attribute filter can take a very long time to process and use a large amount of database CPU, even when other filters have already narrowed the asset list. Processing may time out in large environments.	The User Account Attribute filter now only evaluates the assets passed to it by earlier filters, so processing is much faster and returns the same results as before. Placing this filter after other filters gives the best performance.
Password Safe	After Password Safe has been running for a while, testing an SAP functional account can stop responding and leave the web console unresponsive until services are restarted. When accounts on several SAP systems are tested at the same time, some of the tests can also fail. Only affects managed systems using SAP.	SAP functional account tests and password changes now complete reliably, including when several run at once, and the web console stays responsive.
Endpoint Privilege Management	Assets reported by EPM can take days to appear in BeyondInsight, and some may not appear at all.	New EPM assets are now processed promptly and reliably appear in BeyondInsight.
Session Monitoring	Playing back a recorded session intermittently fails with the message, An error occurred while trying to play the session, even though the recording is available.	Recorded sessions now play back reliably.
SCIM	Creating an Active Directory user through SCIM fails with an internal server error when the password policy’s minimum length is set to 16 characters, which is the default in newer versions.	Active Directory users can now be created through SCIM regardless of the password policy settings.