Release Name: v2026.09
Latest Hotfix Name: N/A
Release Date: 2026-09-30
Latest Hotfix Date: N/A
These are the release notes of Monopam v2026.09
Monopam is a Privileged Access/Account Management solution for enterprise-level organizations. Monopam has enterprise grade features, and these features help companies to secure their privileged account and access critical environments.
These release notes contains following information.
-
New Features
-
Improvement
-
Bug Fixes
New Features
In this release 16 New Features published.
|
Key |
Version |
Type Name |
Release Notes |
|---|---|---|---|
|
MPAM-625 |
v2026.09 |
New Feature |
Monopam exposes an MCP server so AI clients (Claude Code, Cursor, VS Code, Claude Desktop) can work with Monopam under user consent, with a kill switch that revokes access immediately. |
|
MPAM-631 |
v2026.09 |
New Feature |
AI clients can open and drive brokered SSH, database, RDP/VNC and Kubernetes sessions through Monopam, under the caller's own permissions and with full audit. |
|
MPAM-633 |
v2026.09 |
New Feature |
Adds Script Flow: a visual designer with flows and flow runs, script chaining, AI analysis, record actions, a parallel node and alerts. |
|
MPAM-634 |
v2026.09 |
New Feature |
Third-party vendors can be invited for time-bound, recorded access to selected resources. |
|
MPAM-635 |
v2026.09 |
New Feature |
Gateways can be grouped by location into Sites. Resources use the gateways of their site unless explicit gateways are set on the resource. |
|
MPAM-637 |
v2026.09 |
New Feature |
Discovers privileged accounts through network sweeps, SSH keys, Linux service accounts, Active Directory, databases and AWS IAM. Findings land in a Discovered Accounts queue and can be imported into the vault. |
|
MPAM-640 |
v2026.09 |
New Feature |
Monopam credentials and projects can be synchronized into Kubernetes Secrets through Monopam Operator 2.0, with auto sync, External Secrets Operator support and Kubernetes service account authentication. |
|
MPAM-641 |
v2026.09 |
New Feature |
Reviewers can draw on recording videos, leave timestamped shared notes and quote lines in text recordings. |
|
MPAM-643 |
v2026.09 |
New Feature |
AD Bridging access policies can limit access to defined time windows (phase 2). |
|
MPAM-645 |
v2026.09 |
New Feature |
Monopam raises an alert when a managed certificate is changed outside Monopam. |
|
MPAM-651 |
v2026.09 |
New Feature |
Certificate deployments to multiple targets run atomically, with a snapshot and rollback for all target types. The behavior is opt-in on renewal. |
|
MPAM-652 |
v2026.09 |
New Feature |
Operators can roll back a certificate deployment on selected targets only, instead of rolling back every target. |
|
MPAM-653 |
v2026.09 |
New Feature |
Resource Scan finds certificates on F5, FortiManager, FortiGate, NetScaler and Panorama resources and sends the findings to approval before import. |
|
MPAM-658 |
v2026.09 |
New Feature |
Adds SSL Visibility Appliance as a deployment target with version selection, key data import and an AI-driven console automation for the device. |
|
MPAM-660 |
v2026.09 |
New Feature |
Service-based certificates get the same management capabilities (inventory, renewal, deployment and alerts) as other certificate types. |
|
MPAM-662 |
v2026.09 |
New Feature |
When a certificate is discovered, a Script Flow can query an external API with the certificate details and write the result as the certificate owner. |
Improvement
In this release 12 Improvements published.
|
Key |
Version |
Type Name |
Release Notes |
|---|---|---|---|
|
MPAM-632 |
v2026.09 |
Improvement |
Passwords, passphrases and private keys used to open a session are masked in the session output returned to MCP clients. Session recordings are left unchanged. |
|
MPAM-654 |
v2026.09 |
Improvement |
Appliance deployment targets such as F5, FortiManager and NetScaler are defined by selecting a Monopam Resource, reusing its address and credentials. |
|
MPAM-656 |
v2026.09 |
Improvement |
FortiManager targets support selecting multiple ADOMs and loading ADOMs, devices and VDOMs from the appliance, and Kubernetes targets let the operator pick the cluster context. |
|
MPAM-664 |
v2026.09 |
Improvement |
All certificate operations can require approval. Import approval is tied to the certificate, with a preview and a full audit trail. |
|
MPAM-666 |
v2026.09 |
Improvement |
F5 Building Template supports VIP selection by name or IP, profile cloning, TLS and cipher overrides, SNI and running all changes in a single transaction. |
|
MPAM-668 |
v2026.09 |
Improvement |
A private key can be added to a certificate that was imported without one, and certificate and key files can be imported as separate .crt and .key files. |
|
MPAM-670 |
v2026.09 |
Improvement |
Approval policies get a "Do not allow it" mode that rejects matching operations outright, and the Allow Self Approval setting is now actually enforced. |
|
MPAM-674 |
v2026.09 |
Improvement |
The rule builder shows value inputs for NUMBER and DATE properties, so rules such as Days Left or Expires On comparisons can be written. |
|
MPAM-675 |
v2026.09 |
Improvement |
Vault tokens support the encoding modifiers :url, :base64, :sh and :ps, so secrets with special characters are passed correctly to launchers such as WinSCP. |
|
MPAM-676 |
v2026.09 |
Improvement |
Scripts can run on Windows targets with PowerShell or Cmd engines through the agent, and a modal shows the output live while a script runs. |
|
MPAM-677 |
v2026.09 |
Improvement |
Web automations can handle reCAPTCHA Enterprise and invisible captcha challenges through the captcha service. |
|
MPAM-678 |
v2026.09 |
Improvement |
Gateway sessions no longer fail when the gateway has no recording (capture) settings configured, and the gateway list flags gateways that are missing them. |
Bug Fixes
In this release 11 Bug Fixes published.
|
Key |
Version |
Type Name |
Release Notes |
|---|---|---|---|
|
MPAM-617 |
v2026.09 |
Bug |
Copy and paste into PuTTY from the desktop app no longer adds extra characters. |
|
MPAM-618 |
v2026.09 |
Bug |
A server granted through a Request Policy is now visible in the resource list. |
|
MPAM-679 |
v2026.09 |
Bug |
A saved approval policy rule showed "Certificate (unknown)" in the editor and could not reach a decision because of an empty rule group. The editor and rule evaluation were fixed. |
|
MPAM-680 |
v2026.09 |
Bug |
Policies in deny mode were not applied to deferred operations, so an operation that should have been rejected went to approval instead. Deferred checks now read the policy mode. |
|
MPAM-681 |
v2026.09 |
Bug |
The SSH bastion opened the target terminal at a fixed 80x24 size and ignored PuTTY pty and window-change requests, which broke line redraws. Terminal size and resize events are now forwarded to the target. |
|
MPAM-682 |
v2026.09 |
Bug |
The Windows agent did not return the exit code and output of PowerShell commands it executed. Both are now returned correctly. |
|
MPAM-683 |
v2026.09 |
Bug |
Saving an edited vault item could fail with "Credential is not valid". The validation was fixed so valid edits are saved. |
|
MPAM-684 |
v2026.09 |
Bug |
The Resources list sorted only by title, so resources with live sessions were lost among thousands of entries. Resources with active connections are now listed first. |
|
MPAM-685 |
v2026.09 |
Bug |
Deployments to Linux and generic targets intermittently stopped with "IFeatureCollection has been disposed" because background work still used the finished HTTP request context. The background work now runs independently of the request. |
|
MPAM-686 |
v2026.09 |
Bug |
On FortiManager 7.4.10 not all certificates were read, because device errors were silently discarded during the scan. Errors are now surfaced and certificates deployed to an ADOM are read and shown correctly. |
|
MPAM-687 |
v2026.09 |
Bug |
F5 Building Template steps failed with HTTP 401 at a customer site because the step credential was handled incorrectly (for example, the Username field was not saved). Credential handling in the step was fixed. |