Base 8.4.0 release notes
November 3rd, 2026
Base 8.4.0 includes Service Pack 43. Upgrades to 8.4.0 are supported from Base 8.1.0 and later.
🆕 New features
Coordinated updates for clustered and failover appliances
Clustered and failover deployments now update as a unit. The primary schedules both base and product updates, and every node installs them together in the same maintenance window, so nodes no longer drift onto different versions between windows.
- The cluster Updates page shows per-node status.
This applies to both Cloud and on-premises deployments.
Canadian French language support
The appliance administrative interface is now available in Canadian French.
✨ Enhancements
Independent burst and sustained rate limiting
Rate limiting now limits burst and sustained request rates independently. Short, legitimate bursts of traffic are no longer throttled as though they were sustained abuse.
Two-factor authentication enrollment improvements
Two-factor authentication enrollment is easier to complete. Setup errors now stay on the two-factor authentication page instead of navigating away, so you can correct the problem without restarting enrollment.
🛠️ Issues resolved
| Product area | Description | Resolution |
|---|---|---|
| Updates | Disruptive critical updates were never scheduled when Automatically install disruptive critical updates during the Maintenance Window was cleared. | Disruptive critical updates now install on the automatic update schedule. |
| Updates | The Critical Update Available message of the day remained after the patch had already been installed. | The message is now cleared once the patch is installed. |
| Updates | A patch whose ID contains a period could not be cancelled or rescheduled, and remained scheduled after it installed. | Patches with a period in the ID can now be cancelled and rescheduled, and are cleared from the schedule after installation. |
| Updates | A patch installed successfully, but the install progress page reported a failure at the post-patch step. | The install progress page now reports the correct result for the post-patch step. |
| Updates | An "An error occurred during the reboot process (404)" alert appeared on the install progress page during product upgrades. | The alert no longer appears during product upgrades. |
| Certificates | Cluster nodes renewed ACME certificates owned by the primary, producing certificate bundles with mismatched private keys. | Only the primary renews the ACME certificates it owns, so bundles keep matching private keys. |
| Networking | Connections were counted only after the TLS handshake completed, so TLS handshake floods were not throttled. | Connections are now counted and limited before the TLS handshake completes. |
| Logging | Log rotation could fill a filesystem. Rotated logs were re-rotated without being compressed or pruned, and compression was skipped under some conditions. Services also continued writing to deleted files after rotation. | Rotated logs are compressed and pruned correctly, and services now reopen their logs after rotation. |
| Administration | An over-length hostname could break actions in the web interface after the next update. | The hostname is now limited to 64 characters. |
| Networking | DHCP leases were lost across a firmware update. | DHCP leases are now preserved across firmware updates. |
| Networking | A cloud appliance restored from a snapshot onto a new instance could come up on the previous instance's IPv6 address and be unreachable at its published address. | A restored appliance now comes up on the correct address for its instance. |
| Networking | A boot race condition allowed network interfaces to be configured before the kernel had detected them, leaving the appliance running but unreachable. | Network interface configuration now waits for kernel detection to complete. |
| Site Services | The TURN server could fail to restart during a site install and stay down. | The TURN server now restarts reliably after a site install. |
| Maintenance | The site's services were not stopped when entering maintenance mode, rebooting, or applying a software update. Maintenance mode left the site running behind the 503 page, and PostgreSQL waited about 60 seconds to shut down. | Site services are now stopped on maintenance mode entry, reboot, and software update. |
| Certificates | Creating a self-signed certificate failed when the hostname was empty. | Self-signed certificate creation now succeeds, and the administrative interface validates SAN and DN values. |
| Certificates | The TLS certificate expiration notice email directed administrators to BeyondTrust Support. | The notice email now directs administrators to the documentation. |
🗒️ Notes
- Base 8.4.0 requires Base 8.1.0 or later. Upgrade to 8.1.0 or later before upgrading to 8.4.0.
- Base 8.4.0 includes Service Pack 43.
- Verified for Remote Support 26.3.1 and Privileged Remote Access 26.3.1.
