26.6.8
Published: 19 August 2026
Bug fixes
Fixed an issue where navigating directly to another URL instead of completing the forced password-reset screen let a user reach a fully authenticated session, including classic UI admin pages, while still using an expired password.
Fixed six critical CVEs by updating bundled third-party libraries: BouncyCastle (CVE-2026-8763, CVE-2026-59650, CVE-2026-58062, CVE-2026-5588) and Jackson (CVE-2026-54513, CVE-2026-54512).
Fixed an issue where creating or editing a custom check on a large fleet triggered a forced monitoring cycle on every affected system at once, which could overload the Avantra Server and cause AgentAlive critical alerts. Forced cycles are now capped at 100 systems by default (configurable with the customcheck.forcecheck.maxsystems parameter). Above that limit, agents pick up the change on their next regular cycle instead.