What’s New in This Release: 5.6.0 (July 2026) 

This release focuses on delivering several modernization and security enhancements. Customers can now upgrade to a newer release more easily, benefit from modern authentication standards, and take advantage of a more secure and resilient platform foundation. 

New Features and Enhancements

1. In-Place Upgrades: Data Platform and User Console can now be upgraded in place without requiring a prior uninstall. This streamlines the upgrade process, reduces deployment effort, and enables faster adoption of new releases. Existing databases, passwords, and authentication settings are automatically preserved during the upgrade, helping organizations stay current with platform enhancements while minimizing maintenance overhead.
2. OAuth 2.0 Bearer Token Authentication for service-to-service communication: User Console now uses OAuth 2.0 bearer token authentication for communication with Admin Console web services. This enhancement helps customers adopt modern authentication standards, strengthen security, and align with enterprise identity and compliance requirements. It also provides a more secure foundation for service-to-service communication across the platform.
3. User Console communication modernized with gRPC: This modernizes communication between Data Platform and User Console by replacing legacy .NET Remoting with gRPC and token-based authentication, delivering improved security, reliability, scalability, and maintainability. 
4. Migration to OpenSearch for User Console search engine: User Console search engine has been migrated from Elasticsearch to OpenSearch. Search performance is maintained or improved, and security is strengthened through modernization. 
5. Data Platform upgraded to Pentaho version 10.2: Data Platform now runs on Pentaho 10.2, providing security improvements with accumulated vulnerability fixes, support for modern runtime alignment, and enhanced stability.
6. Optimized wizard performance by shifting catalog load steps: Installation workflows have been optimized by moving long-running catalog loading operations outside of the installation wizard, resulting in a faster and smoother setup experience.
7. User Console installation improvements: User Console installation experience now automatically initializes the search engine after installation and configuration, simplifying post-installation setup.
8. Automatic cleanup of working directories: Decompiled Java classes in working directories are now automatically cleaned up, reducing manual maintenance and improving security posture. 
9. Unique encryption keys in Data Platform: The legacy encryption key has been removed. Unique encryption keys are now generated by default for every customer. 
10. Distributed SAML Support: SAML authentication can now be used without requiring the User Console service to be installed on the same server as Data Platform, providing greater deployment flexibility.

Resolved Issues

• Reduced the default session timeout for Admin Console and User Console to enhance protection against unauthorized access from unattended sessions. 
• Updated jQuery and related libraries to supported versions. 
• Resolved an issue where manipulated HTTP headers could trigger unintended service interactions between User Console and external entities. 
• Upgraded Log4j to version 2.26.0, incorporating the latest security and stability fixes. 
• Removed the ability to load external JavaScript resources directly, strengthening platform security controls.
• Fixed normalization issues that could occur when using non-default scopes and exposed the scope parameter within data source configuration. 
• Fixed a common issue that could happen when SW_ALL_P was removed, breaking BDNA_A_CUBES and preventing successful system reconfiguration.
• Resolved an issue that blocked the upload of certain Excel spreadsheet format (.xslx) for processing
• Resolved issue where accumulated inventory history could cause the "load analyze" step to fail during cleanup operations.
• Improved performance for some procedures that could time out on systems hosting and processing multiple inventories

Link to Release Notes for more information.

In an upcoming Data Platform release, changes will be introduced to the installation and upgrade experience to improve consistency and reliability.

The next Data Platform version will not be released as a patch via Technopedia Update Services. Instead, it will be made available through the Product Licensing Center (PLC).

This release will also introduce an updated licensing format. Customers will be required to download an updated license file from the PLC as part of the upgrade process. Additional communication will be shared ahead of the release to confirm when the new licenses will be available for download.

No action is required at this time. Detailed guidance will be provided closer to the release.

What’s New in This Release: 5.5.82

New Features and Enhancements:

1. IPv6 Support: Added support for IPv6‑only environments in both Data Platform and User Console. When a hostname is provided, the platform automatically detects whether IPv6 is enabled and configures remoting accordingly, enabling modern network deployments without manual configuration.
2. Configurable Session Limits: Administrators can now configure limits on the number of concurrent login sessions per user account in the User Console. This enhancement improves security by reducing the risk of unauthorized concurrent access and supports session‑management best practices.
3. Automatic Session Cleanup and Management Tools: User sessions are now automatically removed from tracking upon logout or session expiration. New command‑line options are also available to manually clear all sessions or a specific user’s session, simplifying session administration.
4. TLS 1.3 Support: Added support for TLS 1.3 for both Data Platform and User Console by aligning TLS handling with the operating system’s default security protocols, improving compliance with modern security standards.
5. Background Inventory Deletion: Inventory deletion can now be executed as a background maintenance task using a new NormalizeCMD option, with real‑time progress visible in the Maintenance page. This replaces the previous UI‑blocking deletion behavior.
6. PostgreSQL Update Process Improvements: The PostgreSQL update process has been streamlined to reduce errors and operational friction in certain environments, resulting in a more reliable upgrade experience
7. Third‑Party Component Upgrades: Updated key third‑party components to the latest supported versions to improve security and stability, including:

• Apache Tomcat → 9.0.116
• Java (Corretto) → 1.8.0_482‑b08
• PostgreSQL → 14.22‑2

Resolved Issues:

• Improved platform security by updating Microsoft.Data.OData and other UI and backend libraries to newer, more secure versions.
• Fixed Data Platform Scheduling Service that allowed invalid dates to be configured.
• Resolved security and dependency updates across UI frameworks, including jQuery UI, DataTables, Bootstrap, Angular, Moment, and Moment Timezone.
• Fixed an issue where normalization could fail on Oracle databases with a “snapshot too old” error by optimizing query execution and reducing rollback segment pressure.
• Corrected an issue that prevented updates to Product Co‑exist settings in the User Console from being saved.
• Fixed a Docker usageLastUsed issue that could result in loss of data fidelity when rewriting XSF files during normalization.
• Applied a security update for Apache Log4j, updating components to version 2.25.3.
• Resolved an HPUD extractor issue where large disk volumes could cause overflow or timestamp errors during normalization.
• Fixed a race condition that could occur during service startup, improving platform reliability.
• Resolved an SQL error that could occur when ingesting multiple XSF files during normalization.
• Fixed an issue with the SyncPermission command so report permission metadata is retrieved correctly for both SQL Server and Oracle databases.
• Addressed SQL syntax compatibility issues affecting customers using older versions of MSSQL.
• Fixed an issue with CAC authentication and personal certificates where wizard flows could become blocked by repeated certificate prompts.
• Resolved a User Console issue during patch deployment that could cause unexpected Tomcat restarts and deployment failures.
• Fixed an error where the mapping step could fail when Advanced Deduping was enabled.
• Corrected an issue that could cause LDAP connection tests to fail in the User Console wizard under certain conditions.

Link to Release Notes

What’s New in This Release: 5.5.81

New Features and Enhancements:

1. Windows Server 2025 Support: Added support for Windows Server 2025 in both Admin Console and User Console, ensuring the platform runs seamlessly on the latest operating systems for future-proof deployments.
2. Advanced Deduping Enhancements: Supports evidences discovered in nested paths and allows administrators to configure search patterns directly in the Admin Console. 
3. Excel Extractor moved to OpenXML: Excel Extractor now uses OpenXML instead of OLE DB, improving stability, memory handling, and performance when processing large or complex Excel files during normalization.
4. Faster User Console Service Operations: Startup and shutdown processes for the User Console Service have been optimized, reducing downtime during deployments, maintenance, and service restarts for a smoother user experience.
5. User Console Disconnection Alert: Provides proactive alerts when the User Console loses connectivity with the Admin Console, improving transparency and user experience by immediately informing users about connectivity issues.
6. Qualys Asset Import Performance Optimization: Introduces a new concurrent processing flow while maintaining backward compatibility with existing V2 API implementations. Processes multiple API requests in parallel within configured rate limits, maintains data integrity through proper synchronization mechanisms.
7. Configurable Session Limits: Administrators can now set limits on the number of concurrent logon sessions per user account, improving security and preventing misuse or denial-of-service scenarios.
8. Third-Party Component Upgrades: Key components have been updated to enhance performance, security, and compliance with modern standards.

• Apache Tomcat → 9.0.113
• PostgreSQL → 14.20
• OpenJDK → 1.8.0_472

Resolved Issues:

• Fixed issue where deletions in Mashup data sources were not reflected in User Console reports for Oracle environments.
• Reduced default session timeout to 30 minutes to improve security and minimize idle exposure.
• Updated jquery and related libraries to the latest versions to address security vulnerabilities.
• Resolved issue preventing newly added Viewer users from accessing previously shared public reports.
• Corrected regression that caused failures during the data publishing process.
• Eliminated error "Error retrieving metadata" during configuration or startup for User Console, ensuring smoother setup.
• Enhanced publish step performance for multi-inventory normalization, reducing processing time.
• Fixed missing DLL (HtmlAgilityPack.dll) issue that caused upgrade failures for long-time users.
• Ensured full catalog reset executes properly when initiated from Admin Console for accurate system refresh.

Link to Release Notes

What’s New in This Release: 5.5.80 (September 2025)

New Features and Enhancements:

• New Resume Process feature allows you to restart a failed Normalize job from the exact step where it stopped. (Formerly, you would have had to re-run the entire workflow.)
• Improved SAML-related pages in the Configuration Wizard for Data Platform and for User Console. Improvements include enhanced validation and certificate handling as well as some new proxy settings.
• Enhanced the Maintenance page to add a new Database Maintenance tab. This enhancement allows administrators to proactively manage database size and improve system performance through configurable cleanup options.
• This release Introduces a ServiceNow data extraction module that enables direct, secure, API-based data retrieval without requiring a ServiceNow MID Server.
• The following third-party components have been upgraded to the versions shown below:
  • Apache Tomcat has been updated to 9.0.108.
  • PostgreSQL has been updated to 14.19.
  • OpenJDK has been updated to 1.8.0_462-462.
  • Pentaho has been updated to 9.3.0.10.888

Resolved Issues:

• Improved session validation mechanisms to enhance protection against unauthorized access and ensure greater security for User Console sessions.
• Added server-side input validation for report sharing in the User Console. This update ensures that only valid recipients can be entered.
• Issue with Normalize job resolved. The performance of the output step for processing XSF files has been substantially improved.
• Resolved a Data Platform Configuration Wizard issue that could occur when using a site other than the Default Web Site by improving support for custom IIS websites.
• Two issues related to the latest Newtonsoft upgrade were fixed:
  • Resolved an issue where the NormalizeCMD -EXPORTTOSERVICENOW command failed.
  • Resolved an issue where the NormalizeCMD -IMPORTPROCESS command failed.
• User Console banner: Issue with I Decline button fixed. Enhanced banner dismissal logic to ensure compatibility with modern browsers like Chrome, Edge, and Firefox.
• Fixed an issue with the normalization PUBLISH step in which an Arithmetic overflow error could occur.
• Small symlink files are preserved during HPUD XSF data processing.

Link to Release Notes for more details.

What’s New in This Release: 5.5.79 (June 2025)

New Features and Enhancements:

• Microsoft Intune Extractor: Data Platform can now ingest asset inventory data from Microsoft Intune. To enable, contact Flexera Support and open a support case to receive a new license file.
• Microfocus Integration: Improvement has been made to Microfocus integration when normalizing XSF files and choosing the Update option.
• CyberArk Integration: Now supports retrieving credentials for UNC paths from the vault.
• ServiceNow Integration: JWT support added for enhanced security.
• Active Directory Reliability: New option in the User Console to select up to three optimal AD global catalog servers.
• Qualys Extractor: Added serial number to list of attributes collected by the Qualys Asset Inventory Extractor.
• Technopedia Sync: Force a full Technopedia catalog sync from the Admin Console when performing an ad-hoc Technopedia sync.
• Third-party components upgraded to the versions below:
  • Apache Tomcat has been upgraded to 9.0.105
  • PostgreSQL has been upgraded to 13.21
  • OpenJDK has been upgraded to 1.8.0_452-452-b09

Resolved Issues:

• Fixed XSF file import/normalization failures caused by redundant XML elements
• Resolved missing background search re-index notifications during certain activities
• Eliminated unwanted whitespace in OS records published to MATCH_HOST_SW_PROD
• Added End of Sale Date to the Lifecycle and Support page for hardware in the User Console
• Fixed SAML login issue where users couldn’t re-access Admin Console after closing the browser
• Corrected drill-through errors in Normalize Highlights report post-normalization
• Fixed Updater.exe database patch failures due to impersonation issues with Windows accounts
• Resolved issue where StandAlone extractor didn’t recognize SimpleTask config files
• Fixed Updater.exe to explicitly set encryption to false when secure connections aren't configured
• Fixed permission denied error in GetCatalogVersion command when run without admin rights.

Link to Release Notes for more details.

What’s New in This Release Version: 5.5.78 (March 2025)

New Features and Enhancements:

• Supports extracting data from Qualys Asset Inventory, using the Global IT Asset Inventory API
• .NET 4.8 added as an offline prerequisite for installation
• New log maintenance job that can be run manually or scheduled
• Embeds SQL Server components, eliminating need for offline prerequisites.
• PsExec has been removed from the installer
• Third-party components upgraded to the versions below:
  • Tomcat has been upgraded to: 9.0.100
  • PostgreSQL has been upgraded to: 13.20
  • OpenJDK has been upgraded to: 1.8.0_442
  • Pentaho has been upgraded to: LTS 9.3.0.8 

Resolved issues:

• Fixed erroneous creation of new Publish schema during execution
• Resolved Jamf API Extractor failure due to removed devices
• Fixed Normalize process failure with spreadsheets
• Resolved authentication failures for users with many groups
• Fixed issue to skip malformed records during data processing
• Corrected performance issue with FNMS SQL extractor
• Fixed SAML authentication failure due to missing policy configuration
• Resolved service crash due to CyberArk credential retrieval failure
• Fixed issue causing continued Inventory processing after critical failure
• Improved logging for errors during setup's Activation step
• Corrected API functionality issue when using IP address for activation
• Reduced volume of LDAP queries during certain UI operations

Link to Release Notes

Recently, a vulnerability within Apache Log4j caught widespread public attention and has security, operational and development teams alike scrambling for analyzing the impact within their own eco system and to apply mitigations if necessary. The wide use of Log4j and the ease of the exploitation of the vulnerability makes this vulnerability very suitable for quick and effective use within exploitation campaigns. Shortly after publication of the vulnerability Proof of Concepts (PoCs) and reports of exploitation began to arrive. 

Various teams across different Flexera solutions have been working overtime to ensure that our customers get immediate visibility on the impact of this and other vulnerabilities. This article is intended to help explain how Flexera Data Platform (with Technopedia) can help you identify and remediate this vulnerability.

For the status of impacted Flexera products, please see this announcement .

Affected products may be detected in your inventory to provide a directional assessment. This can help you determine where to look closer, but a definitive vulnerability status may not be possible due to a lack of version granularity depending upon the application in question.

Data Platform customers can expect to see:

• All impacted Apache log4j products and/or releases are captured in Technopedia
• Any existing discovered data (a.k.a. evidence) that maps to the impacted products and/or release are recognized. Note that any new evidence that customers bring in their inventory may still need to go through the gap-fill process.
• If the entitlement to InfoSec Content Pack is active:
  • impacted products will be identified with any CPE’s associated with the impacted products and/or releases are linked
  • up-to-date Secunia Advisory information linked to the available CPE’s is provided 
  • CVE references associated with the vulnerabilities. The publication is dependent upon review/approval by the National Vulnerability Database (NVD).
  • threat intelligence associated with the advisory (as provided by Flexera’s Secunia Research)
• If the entitlement to Lifecycle and Support Content Pack is active:
  • lifecycle dates (EOL and/or Obsolete dates) for Apache log4j releases which can help you determine supported versions and the upgrade path(s)

To have a look at how the vulnerability works, we must look at the Log4j functionality of lookups. Essentially, this functionality allows values to be added to the Log4j configuration [1]. One part of the functionality allows JNDI lookups where multiple protocols are supported – one being LDAP. If an attacker can control parts of what gets logged, then arbitrary code might be downloaded from an attacker-controlled LDAP server (or other JNDI endpoints). The request for the download will be initiated from your own system. Such control is not uncommon, just think about servers logging User-Agent HTTP headers, usernames or chat messages from chat interfaces.

A logged string may contain something like the below string and an attack will potentially go ahead.

This vulnerability affects Apache Log4j versions prior to 2.15.0 and can be referenced via the CVE identifier CVE-2021-44228.

However, the fix for CVE-2021-44228 in version 2.15.0 is incomplete, which led to the acknowledgment of a further vulnerability that is exploitable in certain configuration scenarios [3]. Essentially, exploitability relies on the use of a non-default Pattern Layout with a Context Lookup and where an attacker has control over Thread Context Map (MDC) input data.

Said variant received the additional CVE identifier CVE-2021-45046. This vulnerability is fixed in version 2.16.0 of Apache Log4j.

Initially, the vulnerability was only expected to be exploitable to result in a Denial of Service (DoS) impact and was rated with a lower severity, but Apache revisited their analysis and admitted that arbitrary code execution is possible [4].

The story could have ended there, but, unfortunately, a further vulnerability has been acknowledged shortly after [5].

The vulnerability, associated with the CVE identifier CVE-2021-45105, has a lower impact, namely, its remote exploitation through Thread Context Map data results in a Denial of Service (DoS) condition solely. The issue results from an uncontrolled recursion when handling self-referential lookups and causes a stack overflow and process termination in the end.

The Apache Log4j team has released the version 2.17.0 to fix this CVE.

To note, Apache also released versions in the 2.3.x and 2.12.x branches even though the Apache Log4j team doesn’t support the Java 6 and Java 7 platforms anymore. Users of Log4j need to keep in mind, that such lack of support will result in unfixed security issues down the road and thus can hardly be recommended.

Even the Log4j 1.x version branch, which is End of Life (EOL) though, could be exposed to a similar exploitation scenario like the original vulnerability in the 1.2 version. However, the vector is severely more limited as the JMSAppender needs to be used by an application and any potential attacker needs write access to the Log4j configuration [2]. Typically, such write access will be restricted to privileged persons when following security best practices and thus will likely result in a lower risk from this specific variation of the vulnerability.

This variation affecting Apache Log4j version 1.2 can be referenced via the CVE identifier CVE-2021-4104 and also is referred to as “Log4Shell”.

Keep in mind, that using any product version that is EOL constitutes a large risk on its own as security issues won’t get fixed. The recommendation, as always, is to upgrade any EOL versions to a supported and secure product version.

References

[1] https://logging.apache.org/log4j/2.x/manual/lookups.html

[2] https://mail-archives.apache.org/mod_mbox/www-announce/202112.mbox/raw/%3C1a5a0193-71c4-0613-ca92-f5...

[3] https://lists.apache.org/thread/83y7dx5xvn3h5290q1twn16tltolv88f

[4] https://logging.apache.org/log4j/2.x/security.html  

[5] https://lists.apache.org/thread/6gxlmk0zo9qktz1dksmnq6j0fttfqgno

To see how other Flexera solutions can help customers get immediate visibility on the impact of this and other vulnerabilities, please go this main article on the Community Hub where you can find the complete detail across all Flexera solutions.