*** 12.5.0 Aug 2026 Platform Hotfix ***

Name:   pform-hotfix-12.5.0-02952
Type:   Hotfix
Date:   Fri Aug 28 14:50:12 UTC 2026

Build:  12.5.0-02952


Issues fixed in pform-hotfix-12.5.0-02952:

SMA1000-9429  [Vulnerability] Pre-authentication SSRF via unintended forward-proxy
SMA1000-9424  [Vulnerability] Post-authentication Remote Code Execution (RCE) Vulnerability

Issues fixed in previous pform-hotfix-12.5.0 releases:

SMA1000-9058  [Vulnerability] RCE in SMA1000
SMA1000-9059  [Vulnerability] Pre auth SSRF
SMA1000-8873  Disable folder modifications in file explorer
SMA1000-8892  FIPS: RSA verification is buggy
SMA1000-8947  FIPS/CC: signature algorithms are not restricted per FCS_TLSC_EXT.1.5 in NDcPPv3.0e
SMA1000-8593  Appliance utilizing high memory, observed multiple unit cores
SMA1000-8800  Third-party agents take up too much disk space, prevent hotfixes/updates
SMA1000-8835  Appliance drops user frequently causing production issues
SMA1000-8844  CouchDB logs about source/destination addresses are using the wrong address when accessed through the port 6984 NGINX proxy
SMA1000-8847  Remove usage of NGINX Unit -- it has been abandoned by its maintainers
SMA1000-8862  Citrix XML service apps not working and the ICA file does not load.
SMA1000-8904  FIPS: Turning on MGMT_STRICT_CERTIFICATE_VALIDATION with syslog-over-TLS crashes
SMA1000-8916  EntgenD fails to start
SMA1000-8927  VNC Workplace Shortcut with custom Port 5933 not displayed after upgrading to 12.5.0 March 2026 Hotfix.
SMA1000-8931  [Vulnerability] CVEs affect OpenSSH versions prior to 10.3
SMA1000-8967  AMC allows invalid IPv4 address in subnet resources, causes PS to fail parsing policy_file.xml
SMA1000-8665  AD user needs to login with logon name when attribute is set to userPrincipalName.
SMA1000-8761  couchquery utility fails to validate replication status
SMA1000-8780  Usage of cryptographically insecure Math.random()
SMA1000-8781  the setting Limit session length to credential lifetime is not working on 12.5.0
SMA1000-8795  Adding 12.5.0 node to 12.4.3 CMS stops GTO Service availability
SMA1000-8796  Byte order mismatch in broadcast packet detection causing VIP subnet broadcasts to be incorrectly routed
SMA1000-8818  uploading a license file does not reset the registration to License Manageer for standalone appliances
SMA1000-8822  SEM fails to download on Chrome and Edge
SMA1000-8850  SMA1000 is out of date on Horizon/Workspace client branding
SMA1000-8853  Unspecified IP addresses (0.0.0.0 and ::) as resources are not valid routing destinations
SMA1000-8863  AD ADV authentication failure for forest child users & cross-forest trust users.
SMA1000-8867  AWS Deployment fails with 2 dns server pushed through VPC based dhcp
SMA1000-8871  GTO certificate name validation is case-sensitive
SMA1000-8894  GTO DNS alert is active on CMS even though external delegations are correct
SMA1000-8922  CVE-2026-43038: Update kernel for ICMP error
SMA1000-8948  CMS Licenses lost defaults to SonicWall losing company information increasing logging on the device restored.
SMA1000-8978  Exclude all GTO node names and IPs by default in tunnel
SMA1000-9006  Apache HTTP/2 memory vulnerabilities (CVE-2026-49975)
SMA1000-8026  CMS spike license does not automatically activate when there are email licenses
SMA1000-8607  Appliance reboots if we access IPv6 resource via MC Android 5.0.25-542 using IPv6 full stack
SMA1000-8680  [Vulnerability] TOTP bypass when using AD/LDAP authentication in AMC
SMA1000-8709  [Vulnerability] SQL injection on AMC User Sessions page
SMA1000-8740  CVE-2026-24486: python-multipart arbitrary file-write
SMA1000-8760  Enabling FIPS leads to appliance crashing and being irrecoverable.
SMA1000-3802  Protect exported appliance configuration
SMA1000-8345  Possible user name password enumeration vulnerability
SMA1000-8393  VNC/RDP improvements: remote copy for VNC, fit-in-window for RDP
SMA1000-8449  AMC showing license warning for spike license
SMA1000-8548  SAML Authentication using default browser option fails intermittently on CT in GTO deployments
SMA1000-8555  Unable to access CMS Admin console
SMA1000-8585  Issue with website shortcut for application that uses web socket connections
SMA1000-8604  Better filesystem error handling
SMA1000-8609  IPV6 File Shares access from workplace is broken
SMA1000-8613  CT 12.4.3-373 users are unable to connect to 12.5.0+Dec HF, but 12.5.0 CT connects fine with 12.5.0 Appliance
SMA1000-8614  Appliance drops 1360 users generates Vmcore takes a while to restore
SMA1000-8618  Folder upload with special characters in sub-folder fails with Workplace
SMA1000-8627  Microsoft Intune does not work with Azure GCC High environments
SMA1000-8641  License on CMS count never matches individual appliance count summed up.
SMA1000-8658  Unable to license Capture ATP service from CMS appliance
SMA1000-8697  Subnet resources with a mask of 0 cause PS failure in 12.5.0
SMA1000-8485  Incorrect display size for RDP shortcut
SMA1000-8519  Need better 'secure erase' functionality for new hardware with NVME drive
SMA1000-8526  PowerDNS version numbers are confusing and hard to validate
SMA1000-8541  Convert Lets Encrypt auto-renewal period from days to percentage of lifetime remaining
SMA1000-8545  Workplace portal name on login page gets folded with multiple words
SMA1000-8572  Capture ATP report is not showing proper filename for filename containing space
SMA1000-8586  Access agent detail is not correct in Session details for connected user with MC
SMA1000-8591  Using Special Character "%" in Custom authentication prompt breaks workplace login
SMA1000-8597  Physical Appliances show deprecated user option 'image' when logging in recovery partition using GRUB.
SMA1000-8619  Appliance generating unit cores not during hotfix installation but post few hours
SMA1000-8631  SAML Authentication fails on Workplace with No-FQDN-Access CEM
SMA1000-8634  Avpsd and logserver cores dumped post-install Pform-hotfix-03245
SMA1000-8639  AMC skips IPv6-literal to standard format conversion when a Policy Variable is used.
SMA1000-8643  Need IPv6 Global Unicast Address as include resource when redirect-all with exclusions is converted to split-tunnel mode
SMA1000-8651  Communities can be orphaned when changes are made with multiple communities open in multiple browser tabs
SMA1000-8656  Enabling or disabling 10 Gig interface does not take effect until Apply All
SMA1000-8660  Logs failing to push to multiple syslog servers
SMA1000-8667  irqaffinity script shows errors on single-homed virtual appliances
SMA1000-8693  Error observed when accessing custom URL resource from Workplace
SMA1000-8694  File-share access fails with file-share resource configured with $ in the path
SMA1000-8699  [Vulnerability] TOTP bypass when using AD/LDAP authentication in Workplace/Connect Tunnel
SMA1000-8735  Design and implement preferred-nodes API for location-based node selection
SMA1000-7783  Add new CEM to suppress SSL connection errors due to cipher, protocol, etc
SMA1000-8212  Unable to update MaxMind Database from appliance in IST timezone
SMA1000-8223  Appliance drops users in node2 with unitd core found
SMA1000-8229  Upload status is not correctly updated when CAPTURE ATP is enabled for file-explorer
SMA1000-8233  Captcha generating code uses insecure random number generator
SMA1000-8236  Insecure random numbers used in email/otp password generation
SMA1000-8254  Radius authentication not working when primary Radius server is down or unreachable.
SMA1000-8319  Post upgrade to 12.5.0 SMA6210 auto rebooted or need to manually reboot make it work again with Unitd cores.
SMA1000-8332  Workplace users disconnected at random intervals with no idle timeout set
SMA1000-8333  AD user variables fail to retrieve with auth attribute UPN when tested on AMC
SMA1000-8336  Workplace login fails on android Chrome/Edge with 12.5.0
SMA1000-8338  Realm Community requiring Secure Endpoint Manager after update to 12.5.0
SMA1000-8347  OpenSSH upgrade due to CVEs
SMA1000-8353  Timeouts for PowerDNS talking to our GTO backend are too short
SMA1000-8409  Inotify race leads to 100% CPU utilization
SMA1000-8413  USGv6 -- Only log compressed IPv6 addresses
SMA1000-8417  Need to increase the 'processing cost' of our local auth and admin passwords
SMA1000-8438  Entropy falls back to RDSEED on AMD Processors
SMA1000-8467  Citrix workspace over ODP is not working in hostname mapped access
SMA1000-8479  Hostnames processed through infoblox for processing DDNS does have issues.
SMA1000-8509  Ensure root filesystem can be safely checked / repaired during boot process
SMA1000-8088  Unable to terminate Idle user in a specific CMS appliance
SMA1000-8183  Getting Submitted by: Unknown in Capture ATP report
SMA1000-8197  Space char in Authentication code affecting the license Registration
SMA1000-8198  /proc values for ipv6 incorrect in pure IPv6 deployment
SMA1000-8210  Restrict Web Proxy base-uri's through Content Security Policy
SMA1000-8246  Unable to see full details of connected user from CMS User Sessions
SMA1000-8248  CMC reset user sessions buttons is disabled until you select an appliance
SMA1000-8251  Test Connection button in CMS gets disable after checking connection for an Appliance
SMA1000-8261  With enabled 'Automatically activate spike license', 'Activate' button working is not expected
SMA1000-8266  Network share resources containing policy variables cause exceptions
SMA1000-8273  Resource access broken with SNAT address pool
SMA1000-8286  Need an option to disable change password option with Local Authentication server
SMA1000-8326  Incorrect time-taken value is logged in a log message by Policyserver
SMA1000-8327  Support TS Farms with load balance info for standalone RDP shortcuts with native RDP client
SMA1000-8349  Update OpenSSL for various CVEs
SMA1000-8352  NTP does not work with 12.5.0 on Hyper-V
SMA1000-8355  Hostname participating names fail for user access if the hostname in caps whereas lower case works fine for user access
SMA1000-8365  Update libcurl for various CVEs
SMA1000-8366  HyperV: Network devices are not present in setools
SMA1000-8367  When you configure Workplace-Styles-Edit Default style-Remove the title and save, error corrupted warning shows up
SMA1000-8370  Unable to Disable "Enable Access to URLs" in WorkPlace Settings
SMA1000-8390  Getting timeout while registering license for CMS
SMA1000-8403  UTF-8, OTP sent to users seen with garbled message (Korean Characters)
SMA1000-8405  PowerDNS update for cache poisoning vulnerability
SMA1000-8411  ActiveSync - New account adding is broken
SMA1000-8416  Upgrade OpenJDK to 21.0.9 for multiple CVEs
SMA1000-8431  Path-relative style sheet import used in Virtual Key Board

Installation instructions:

 1. Login to the AMC as Admin
 2. Go to Maintenance -> Update
 3. Upload 'pform-hotfix-12.5.0-02952.bin' file and click 'Install Update'

The 'pform-hotfix-12.5.0-02952' script will perform the following actions:

 a. Backs up existing files.
 b. Replaces files with updated ones containing the fix.
 c. Adds new files if needed.
 d. Reboots the appliance.

Restore instructions:

If you wish to restore the appliance to the state it was in before applying the hotfix, run the following steps:

 1. Login to the AMC as Admin
 2. Go to Maintenance -> Rollback.
 3. Under hotfixes select 'pform-hotfix-12.5.0-02952' and click 'Remove'