6.7.2 Appliance

Released July 2, 2026.

Updates

The signal channel between the Connection Broker and Gateways/clients can now use QUIC, enabling improved NAT traversal in environments where a client's UDP and TCP source IPs differ.
Active Sessions (Usage > Active Sessions) now includes a Traffic Mode filter that allows administrators to filter sessions by whether they include relayed connections. The filter makes it easier to identify relayed sessions without navigating to System > Sites > Site Health > View Relayed Sessions.

Improvements were made to the Collective Replication Status Details window, with clear, actionable messages when replication issues are detected.
The target collective now operates in high availability mode. If replication fails on the current Controller, the replication service will move to another Controller and replication will be retried.

Fixed an issue where the VPN Gateway service could unexpectedly terminate when processing faulty control channel data.
Resolved a compatibility issue where older endpoints, such as Exchange servers, required the client to send a Secure Renegotiation extension field. The Portal now announces Secure Renegotiation support (RFC 5746) during TLS handshakes.
Improved CRL-based certificate revocation. Expired, untrusted, or mismatched CRLs are now rejected instead of silently accepted.
Addressed an issue where PEM-encoded Certificate Revocation List (CRL) files were parsed as DER format, causing CRL loading to fail.
Improved authorization performance in systems with a lot of entitlements and policies. This change makes the controller.authorizationRepositoryCacheExpirySeconds local configuration obsolete.
Addressed an issue to avoid JVM virtual thread hang under load resulting in inter-process socket communication errors.

Fixed an issue that prevented users from clicking on the scroll bar when viewing some drop-down suggestions.
Fixed an issue in which page size and list parameters were not kept when refreshing the Entitlements page.