Fixed issues

Last published : Nov 05, 2026
Related information
What's new

UniconOS 2609.1

Release date 2026-11-04
Important:
UniconOS 2609.1 fixes the security vulnerabilities CVE-2026-98432 in the Linux kernel and CVE-2026-111497 in the Qt WebEngine library. The vulnerabilities affect UniconOS 2603 LTSR CU2 and 2609. If you run UniconOS 2609, upgrade to 2609.1.

Security hardening

  • The Linux kernel was updated to 6.18.59, which fixes the vulnerability CVE-2026-98432.
  • The copy of the Brotli decoder bundled with Qt WebEngine was patched, which fixes the vulnerability CVE-2026-111497.

UniconOS Management 2609.1 (formerly Scout 15)

Release date 2026-10-30
Important:
UniconOS Management 2609.1 fixes the security vulnerability CVE-2026-111497 in Scout Board. The vulnerability affects UniconOS Management 2601 to 2609. If you run one of these versions, upgrade to 2609.1.
On-premises Scout Cloud Gateway (SCG) uses the Node.js installed on its host. Update Node.js on the SCG host to version 24.22.1 or later.
Note:
After the upgrade, check your configuration labels:
  • When ScoutServer starts, it checks the passwords saved in configuration labels. A password that it can't read stays unchanged and isn't sent to devices. Autologin settings from that label aren't applied, network profiles with that password are left out, and applications don't get that password. For each of them, ScoutServer logs the label and the setting in eluxd.log, with "left unchanged". Enter these passwords again in Scout Board.
  • Devices keep the mirroring settings from configuration labels until their configuration is rebuilt. Open each label that sets mirroring options, choose Edit, then Apply. You don't need to change anything. Devices receive the rebuilt configuration at their next contact.
  • Network drives from a configuration label now replace only the OU's network drives with the same name. The OU's other drives stay, so a label can no longer remove an OU drive.

Fixed issues

Device grid, views & UI

  • After the device grid of an OU was filtered by a MAC address typed with separators, every OU showed only "Error!" instead of its devices.
  • After signing in, Scout Board briefly showed the name of the previously signed-in user.

Configuration correctness

  • Fixed several bugs with configuration labels.
  • On the base configuration, "Apply and check independent configurations" failed with "Error in value definition: invalid message format: Configuration ID missing".
  • After a configuration import between OUs, the display settings of the target OU couldn't be configured.
  • With "Apply name template only to new devices" set, an OU filter that moved an existing device still renamed it.

ScoutServer stability & database resilience

  • ScoutServer could stop unexpectedly when its database connection was briefly lost.
  • After a brief loss of the database connection, ScoutServer could stop sending commands to devices and stop running scheduled jobs until it was restarted.
  • If the ScoutBoardDBLayer service started before ScoutServer, it stayed disconnected from ScoutServer, so mirroring and live device status in Scout Board stopped until the service was restarted.
  • In License Server mode, ScoutServer stopped right after starting when its database had been moved to another SQL server or restored.

Security hardening

  • Scout Board now runs on Node.js 24.22.1 and rejects requests compressed with Brotli, which fixes the vulnerability CVE-2026-111497.
  • Some executable files of the installer weren't signed, so endpoint protection could block the setup.

UniconOS Management 2609 (formerly Scout 15)

Release date 2026-10-13

Fixed issues

Device grid, views & UI

  • An OU could not be chosen when using multiple filters.
  • Dynamic Device Groups were not displayed in Scout Board.
  • OU filters did not work correctly.
  • Applying a saved or Default view removed the drag handle and could remove the row checkbox.
  • The Manage-administrators list overflowed the page when long.
  • The device table stopped updating live.
  • Devices that onboarded while an administrator was signed in stayed invisible in their OU and were counted as "hidden devices".
  • The Execute-action dialog showed the wrong state when switching actions.
  • Move dialogs collapsed the OU tree shortly after opening, so nothing could be moved into a nested OU.
  • Overwriting a saved view could create a second view with the same name instead of replacing it.
  • The device list could not be sorted by device ID.

Configuration correctness

  • Comparing settings/settings match issues.
  • The Citrix default for Key Passthrough Escape Shift was not loaded and Escape Char showed the wrong value.
  • Replacing or deleting an application icon in Scout Board does not reach a devices.
  • App icons were embedded once per application in the device configuration instead of once per icon.
  • Environment variables set via a Configuration Label could not be encrypted.
  • An application free parameter without a value hung the configuration build.
  • ScoutServer sent no config reply when a Setup had no ScreenSettings row, so the device booted with no apps.

Rights and admin management

  • A permission denial logged the admin out instead of showing a "not permitted" message.
  • When merging AD group rights, OU and device entries were incorrectly combined in certain scenarios.

Audit logging

  • An OU-filter modify/delete recorded a successful Monitor audit row even when the row was already gone.
  • Audit rows recorded the percent-escaped URL segment as the object name, so a deleted label or rule was logged incorrect.

ScoutServer stability & database resilience

  • An OU delete walked the entire device fleet inside a single transaction.
  • ScoutServer crash/deadlock issue and crash handling.
  • On a classic AlwaysOn AG, group_id was unreadable on SQL 2022 / ODBC Driver 18, so ScoutServer lost its license after a failover.
  • Scout Board could not recover from a DBLayer timeout without a service restart.
  • Scout Board showed "Scout Server is not responding" while the ScoutServer process was healthy.

Device status & lifecycle

  • Duplicate device rows were created on every reboot when a ClientIdentifier had more than one row.
  • A device stayed "Updating" in Scout Board after an update finished because the UpdateDevice row was never closed.
  • Asset tags could never be retracted or corrected — Scout kept a stale/placeholder chassis tag indefinitely.

OU import/export & configuration import

  • Advanced device configuration import failed.
  • OU import created OUs without the device-visibility flag, leaving imported OUs hidden from onboarding.
  • OU config import did not apply keyboard, mouse settings.
  • A duplicate OU name aborted the import instead of skipping that OU.
  • OU import wrote the first scheduler job and silently discarded the rest.

Security hardening

  • Request handlers SQL injection, path traversal, permission checks.
  • Public REST API Endpoints returned HTTP 500.
  • Public REST API Endpoints returned HTTP 400.

UniconOS 2609 (formerly eLux 7)

Release date 2026-10-13

Fixed issues

Authentication, Imprivata & smart card

  • UniconOS Imprivata failed to verify CA-signed server certificates; only self-signed certificates worked.
  • Smart-card login overwrote the configured Kerberos default realm with the certificate UPN suffix.
  • Imprivata EPM caused a 25-second delay before the AD password-change dialog appeared.
  • Imprivata tap-out did not disconnect the CWA session when closeOnLock=true.
  • Imprivata service jumped to the full offline retry interval on the first failure, turning a one-second transient into a five-minute outage.
  • An Imprivata slash card caused an empty desktop and a dialog double-free crash.
  • The Imprivata badge-enrollment dialog did not honor the default domain.
  • The Imprivata AD default domain configured in Scout Board was not written to terminal.ini.
  • The Imprivata PIN-change option was shown to users who had not set up a PIN.
  • Logging in with user name and password prompted an unwanted Imprivata PIN enrollment.
  • The %HOSTNAME% macro was not expanded for Imprivata fast-user-switching credential injection.
  • Multiple VDI desktop launches were inconsistent, and fast user switching to a different policy broke the UniconOS UI.
  • A PureAuth unlock-failed screen appeared when PureAuthLogin=true was missing.

Display, monitors & graphics

  • Monitor layout and primary-monitor settings were lost after a reboot.
  • Windows moved between displays after the display layout was changed.
  • Monitor rearrangement was not saved on the Dell OptiPlex 7020.
  • The NVIDIA display driver caused a black screen on all NVIDIA outputs.
  • The screensaver caused graphics to hang on some NVIDIA devices.
  • The screensaver crashed.
  • Icons were broken.
  • A monitor node was missing from the layout, causing cursor-movement issues.
  • Three external-monitor rotation issues appeared randomly.
  • The Display section monitor tiles were too large.
  • Self-Service dialog became unresponsive for a long time when the monitor layout changed before login.
  • Device configuration submenus overlapped the parent menu and did not flip to the side with free space.

Audio, peripherals & collaboration apps

  • The "Test Speaker" button did not play any sound on some devices.
  • Volume extended keys did not work on the Dell OptiPlex 3000.
  • Multimedia keys still worked even when "Extended Keys" was disabled.
  • An active USB drive was not displayed in the RDP session.
  • The Zoom app could not be reopened after being closed with the X button.
  • Microsoft Teams could not be opened.
  • AWS Connect calls were dropped.

Printing

  • Auto-discovered printers failed to print.

Networking, VPN & proxy

  • Global network proxy authentication settings were not applied to web browsers.
  • DNS failed and SCEP did not work over a Cisco VPN connection.
  • UniconOS could not reach UniconOS Management server during shutdown when a VPN was active.
  • The Cisco Secure Client caused high CPU load.
  • A single click on the Network icon (wired/LAN) disconnected the network, with no way to make the toggle configurable.
  • Writing DisableConnectivityCheck=true in terminal.ini sometimes had no effect.
  • NetworkAccessControl ignored TPM2Fallback when TPM key generation failed.
  • The 802.1x profile was not configured when the SCEP WPA configuration changed.

Device management

  • A device switched to the "unmanaged" status when configuration processing timed out.
  • Applying a configuration could terminate a running application.
  • Scout Cloud Gateway changes were not logged correctly.
  • The mirror session bar no longer showed the UniconOS Management admin name.
  • Advanced file entries were not cleaned up on configuration changes.
  • The virtual keyboard enable/disable setting configured in Scout Board was not written to terminal.ini.
  • The settings for the design and layout of the virtual keyboard did not work reliably in all scenarios.
  • User variables were not set successfully from user attributes.
  • Screen mirroring via mirror invitation failed because the VNC server rejected webrtcify's local (127.0.0.1) connection.
  • Self-Service did not reset StoreFront/CWA state when the authenticated UniconOS user changed.

Boot, shutdown & session stability

  • Reboot did not complete, blocking shutdown for up to 30 minutes.
  • The TPM lock reset retry loop added about 30 seconds to every boot.
  • A notification pop-up could remain on screen indefinitely.
  • Logging off a locked UniconOS user required the user's password.
  • In some scenarios, idle power actions were triggered too late.

Firmware & updates

  • The "firmware update running" popup was shown even when no firmware update was needed.
  • An extra firmware-update dialog appeared after clicking "perform later".
  • The AuthVR5 cache caused firmware-update failures.
  • Firmware updates did not distinguish between local and UniconOS-triggered updates correctly.

Migration (igel2UniconOS)

  • igel2UniconOS migration did not work on LG AIO CN devices.
  • igel2UniconOS migration failed to migrate Lenovo endpoints with an EFI-partition "device or resource busy" error.
  • igel2UniconOS migration continued even when the downloaded archive was not a valid ZIP file.

StoreFront & browser sessions

  • A published resource without an icon aborted StoreFront resource parsing.
  • The store-add timeout (120s) was too short for NetScaler Gateway MFA and was not configurable.
  • On captive portals, duplicate browser windows and a spurious smart-card prompt appeared.
  • Citrix Workspace failed to enumerate.
  • The Omnissa Horizon Client could not copy its configuration on a read-only root filesystem.
  • The native WebKitGTK Caps Lock indicator was shown in built-in browser web content.

Security hardening

  • The boot shim is dual-signed with both the Microsoft 2011 and 2023 UEFI CA signatures.
  • libidm was updated to parse the OpenSSL 3.5.5.
  • The Linux kernel was updated to 6.18.48 to pull in a batch of serious security fixes.
  • FreeRDP was updated to 2.6.1 (fixes CVE-2026-45700).
  • OpenVPN was updated to 2.5.11-0ubuntu0.22.04.4 (fixes CVE-2026-12932, CVE-2026-12996 and CVE-2026-13698).
  • OpenVPN was updated to 2.5.11 (fixes CVE-2026-35058 and CVE-2026-40215).
  • CUPS was updated to 2.4.1 (fixes CVE-2025-58436, CVE-2025-61915, CVE-2025-58060 and CVE-2025-58364).
  • alsa-lib was updated to 1.2.11.
  • Security updates for alsa-lib due to the critical vulnerability CVE-2026-56109.
  • Security updates for cifs-utils due to the critical vulnerability CVE-2026-12505.
  • Security updates for curl due to the critical vulnerabilities CVE-2026-8286, CVE-2026-8458, CVE-2026-8924–8925, CVE-2026-8927, CVE-2026-9547.
  • Security updates for ffmpeg due to the critical vulnerability CVE-2026-40962.
  • Security updates for glibc due to the critical vulnerabilities CVE-2026-4046, CVE-2026-5435, CVE-2026-5450, CVE-2026-5928, CVE-2026-6238.
  • Security updates for graphite2 due to the critical vulnerability CVE-2026-50593.
  • Security updates for gst-plugins-good1.0 due to the critical vulnerabilities CVE-2026-39043–39044, CVE-2026-53705.
  • Security updates for gzip due to the critical vulnerabilities CVE-2026-41991–41992.
  • Security updates for jbig2dec due to the critical vulnerabilities CVE-2023-46361, CVE-2026-38076.
  • Security updates for krb5 due to the critical vulnerabilities CVE-2026-11850, CVE-2026-40355–40356.
  • Security updates for libarchive due to the critical vulnerabilities CVE-2026-5745, CVE-2026-14164.
  • Security updates for libexif due to the critical vulnerabilities CVE-2026-32775, CVE-2026-40385–40386.
  • Security updates for libgphoto2 due to the critical vulnerabilities CVE-2026-40333–40335, CVE-2026-40338–40341.
  • Security updates for libidn due to the critical vulnerability CVE-2026-57053.
  • Security updates for libinput due to the critical vulnerability CVE-2026-50292.
  • Security updates for libnfs due to the critical vulnerability CVE-2026-53689.
  • Security updates for librabbitmq due to the critical vulnerabilities CVE-2023-35789, CVE-2026-44235–44236.
  • Security updates for libsoup2.4 due to the critical vulnerabilities CVE-2026-2369, CVE-2026-5119.
  • Security updates for libxfont due to the critical vulnerabilities CVE-2026-56001–56003.
  • Security updates for libxml2 due to the critical vulnerability CVE-2026-6653.
  • Security updates for libxpm due to the critical vulnerability CVE-2026-4367.
  • Security updates for mailcap due to the critical vulnerability CVE-2026-10037.
  • Security updates for ncurses due to the critical vulnerability CVE-2025-69720.
  • Security updates for nghttp2 due to the critical vulnerability CVE-2026-58055.
  • Security updates for nss due to the critical vulnerability CVE-2026-12318.
  • Security updates for ntfs-3g due to the critical vulnerabilities CVE-2026-42616–42618, CVE-2026-46569–46572, CVE-2026-56135–56136.
  • Security updates for openssh due to the critical vulnerabilities CVE-2026-59995–60002.
  • Security updates for openssl due to the critical vulnerabilities CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34182, CVE-2026-42766–42767, CVE-2026-42770, CVE-2026-45445–45447.
  • Security updates for pam due to the critical vulnerability CVE-2026-54411.
  • Security updates for perl due to the critical vulnerabilities CVE-2026-8376, CVE-2026-42496.
  • Security updates for poppler due to the critical vulnerability CVE-2026-10118.
  • Security updates for python3.10 due to the critical vulnerabilities CVE-2025-13462, CVE-2025-69534, CVE-2026-1299, CVE-2026-1502, CVE-2026-2297, CVE-2026-3276, CVE-2026-3644, CVE-2026-4224, CVE-2026-4519, CVE-2026-4786, CVE-2026-6019, CVE-2026-6100, CVE-2026-8328, CVE-2026-9669.
  • Security updates for qtdeclarative-opensource-src due to the critical vulnerability CVE-2025-12385.
  • Security updates for qtsvg-opensource-src due to the critical vulnerability CVE-2023-32573.
  • Security updates for qtwebengine-opensource-src due to the critical vulnerability CVE-2025-9900.
  • Security updates for samba due to the critical vulnerabilities CVE-2026-6949, CVE-2026-15779, CVE-2026-58216, CVE-2026-58218, CVE-2026-58221–58222, CVE-2026-58224.
  • Security updates for sqlite3 due to the critical vulnerabilities CVE-2026-11822, CVE-2026-11824, CVE-2026-50812–50813.
  • Security updates for squid due to the critical vulnerabilities CVE-2025-59362, CVE-2025-62168, CVE-2026-32748, CVE-2026-33515, CVE-2026-33526, CVE-2026-47729, CVE-2026-50012.
  • Security updates for systemd due to the critical vulnerabilities CVE-2023-7008, CVE-2026-40226.
  • Security updates for tar due to the critical vulnerabilities CVE-2025-45582, CVE-2026-5704.
  • Security updates for uriparser due to the critical vulnerability CVE-2025-67899.
  • Security updates for vim due to the critical vulnerabilities CVE-2026-35177, CVE-2026-43961, CVE-2026-46483, CVE-2026-47162, CVE-2026-47167, CVE-2026-52858–52860, CVE-2026-55693, CVE-2026-55892, CVE-2026-55895, CVE-2026-57452, CVE-2026-57455–57456, CVE-2026-59856–59858.
  • Security updates for wget due to the critical vulnerabilities CVE-2026-15146, CVE-2026-58469–58472.
  • Security updates for xz-utils due to the critical vulnerability CVE-2026-34743.
  • Security updates for linux-kernel (6.18.38 → 6.18.48) due to 1783 CVEs.