BT Updater Client 3.6.1 release notes
September 10th, 2026
🆕 New features
| Product area | Description | Resolution |
|---|---|---|
| Subscriptions | BT Updater had no subscription for the .NET 10 Hosting Bundle, so the runtime had to be installed and kept up to date outside the Updater. | A .NET 10 Hosting Bundle subscription is now available. BT Updater delivers and installs the bundle, and the subscription registers itself, so no manual setup is required. |
✨ Enhancements
| Product area | Description | Resolution |
|---|---|---|
| Activity Feed | When the Updater server cancelled a download, the activity feed ended without explaining why. | The activity feed now shows the reason the server cancelled a download. |
| Configuration | A successful Test Connection confirmed only that the connection succeeded. | A successful Test Connection now also reports the version of the Updater server you connected to. |
| Downloads | The client retried a download on its own schedule, ignoring any wait requested by the server. | The client now honors a server-requested wait before it retries a download. |
| Web Console | The web console ran on an out-of-date version of its UI framework. | The web console has been upgraded to a current supported version of its UI framework. |
🔒 Security improvements
| Product area | Description | Resolution |
|---|---|---|
| Authentication | Stored credentials were protected with hardcoded encryption keys, and the credential database was protected by a legacy password. | The hardcoded keys and the legacy password have been removed, strengthening protection for stored credentials. |
| Downloads | Certificate validation was disabled for connections to the download server, and the validation callback accepted any certificate. | Certificate validation is enforced, and the callback now fails closed instead of accepting any certificate. |
| Downloads | SSL 3.0 and TLS 1.0/1.1 were explicitly enabled for outbound connections. | Legacy protocols are no longer enabled. The Updater now uses the modern TLS version negotiated by the operating system. |
| General | Bundled third-party components included versions with published vulnerabilities. | Third-party components, including log4net and the web console's npm packages, have been updated. |
| Logging | Passwords and anti-CSRF tokens were written to application log files, and a debug-level log file was written unconditionally to the working directory. | Sensitive values are no longer written to log files, and the unconditional debug log file has been removed. |
| Packages | Package extraction did not validate entry paths, so an archive entry could be written outside the target folder. | Update packages, web policy and plugin packages, and offline package imports now reject any entry that resolves outside the target folder. |
| Web Console | Signing out could act on the wrong session, issued tokens carried administrative rights unconditionally, and token renewal accepted a client-supplied user identity. | Session and token handling have been hardened on all three paths. |
| Web Console | The support package download endpoint and a set of legacy HTTP handlers were reachable without authentication, and the support package could expose the credential database and log files. | These endpoints have been removed or now require authentication. |
| Web Console | The web console did not send the X-Frame-Options header. | The web console now sends the X-Frame-Options header, adding clickjacking protection. |
🛠️ Issues resolved
| Product area | Description | Resolution |
|---|---|---|
| Licensing | When more than one license was issued for a serial number, the daily license refresh failed and the local license database was not updated. | The license refresh now saves multiple licenses for a single serial number correctly. |
| Authentication | For anyone who installed Updater 3.6.0, you may experience login errors when using SAML to sign in to BeyondInsight. | Updater 3.6.1 improves security by keeping token encryption keys in memory only and no longer storing them on the local machine. This change helps prevent sign-in issues with BeyondInsight. |
📝 Requirements
- .NET 4.7.2 or later
- IIS to be enabled on host
