HCL BigFix is pleased to announce a number of enhancements to BigFix Remote Control.
Ubuntu Desktop Support: Wayland compatibility
Remote Control now officially supports Ubuntu Desktop with both Target and Controller availability, enabling the Wayland display server across Ubuntu Desktop 22.04, 24.04, and 26.04 alongside RHEL 10, while Ubuntu Desktop 20.04 is supported exclusively with the X11 display server.
Some limitations for Wayland:
- On Wayland, manual permission approval is mandatory.
- Ubuntu 24.04+ and RHEL 10+ support a "restore token" to bypass these prompts on future connections.
- Drawing Tool, Highlight Tool and Open URL features are not available on Wayland.
- Reboot that includes an auto reconnection is not supported on Wayland.
- Screen capture is only possible if a user is logged in.
- Screen capture is possible on lock screen only by installing the gnome extension “Allow Locked Remote Desktop”.
- The On Demand Target does not support Ubuntu 20.04, RHEL 7 and RHEL 8.
- Chat GUI is not working on Wayland targets on RHEL 10.
For detailed usage notes and limitations, please refer to the documentation.
Support of Windows 11 26H2 and macOS 27
Remote Control now supports Windows 11 26H2 and macOS 27 Golden Gate.
Web Controller support for Managed Sessions from the Server and reconnection feature
This release introduces Web Controller support for unattended and managed sessions directly from the Remote Control Server UI. Please note that the Target must be reachable by the Broker to establish the session.
Additionally, the Web Controller now supports reconnection with the Broker session.
Please note: The Web Controller currently has limited functionality compared to the standalone application. We plan to continuously enhance this new component with additional features in future releases. For detailed usage notes and limitations, please refer to the documentation.
Redesigned global search on the Server
The Server for every report now scans the entire dataset across all pages instead of limiting results to the currently visible page. The new global search feature is available in the top left corner of every page.
Note: the maximum number of visible rows per page has been limited to 100.
Removal of JNLP, Java™ Web Start and LWP plugins into the Server
This version of the Server removes support for JNLP, Java™ Web Start and the Lite Web Portal plugins (Firefox plug-in, Internet Explorer Active X and Java™ Applet).
The following properties have been removed from the ondemand.properties file:
- ondemand.enable.plugins
- ondemand.enable.jnlp
- ondemand.enable.executable
The following property has been removed from the trc.properties file: - always.use.preinstalled.controller
Duplicate GUID fix
Automatically resolves duplicate GUID issues occurring on unattended Targets.
Important: for this fix to take effect, both Server and Targets must be updated to this version.
FIPS 140-3 module sunset date for Server and Controller
The FIPS 140-3 module available on the Server and the Controller can be used until August 8, 2029. After this date, for security reasons, if FIPS is enabled, a new update of the Server and the Controller will be required.
Update of IBM WAS Liberty, IBM Java, and OpenSSL
This release includes the following updates:
- Open Liberty version is 26.0.0.10
- Semeru Java version is 25.0.5.0
- OpenSSL version is 3.5.9
- Log4j 2.25.5
**Fixed vulnerabilities**
This release addresses the following vulnerabilities:
- CVE-2026-67164: Sensitive Information Exposure in URL.
Affected components: Remote Control Server and Broker.
- CVE-2026-55831: affects io.netty:netty-codec-http.
- CVE-2026-55833: affects io.netty:netty-codec-http.
- CVE-2026-56745: affects io.netty:netty-codec-http.
- CVE-2026-59901: affecting io.netty:netty-codec.
- CVE-2026-56819: affecting io.netty:netty-codec-http2.
- CVE-2026-89407: affecting com.fasterxml.jackson.core:jackson-core.
- CVE-2026-91776: affecting com.fasterxml.jackson.core:jackson-databind.
- CVE-2026-91777: affecting com.fasterxml.jackson.core:jackson-databind.
- CVE-2026-89425: affecting com.fasterxml.jackson.core:jackson-databind.
- CVE-2026-68497: affecting jackson-databind.
- CVE-2026-114820: Improper trust management flaw enabling Man-in-the-Middle certificate spoofing.
- CVE-2026-91403: Truststore validation vulnerability allowing unauthorized TLS certificate spoofing.
- CVE-2026-75595: Improper TLS handshake handling causing mutual authentication bypass.
- CVE-2026-75596: Algorithmic complexity vulnerability causing remote TLS Denial of Service.
- CVE-2026-73086: Integer overflow leading to predictable cryptographically secure pseudo random output.
- CVE-2026-67163: CSV Injection.
- CVE-2026-67136: Missing Authentication for components download.
- CVE-2026-56486: Improper management of Path-relative style sheet import allow to execute malicious code in certain web pages.
- CVE-2026-107969: Host Header Injection Leading to Open Redirect.
Affected components: Remote Control Server.
**Resolved Defect Articles:**
- KB0134828: Form Re-submission after Cancel click when adding the same certificate into the Server
- KB0134640: Domain name not updated after callhome
- KB0134062: Rosetta installation is required even if Target and On-demand Target are built with Universal binaries
- KB0133998: DOC update to specify the lack of support for SQL Server named instance and cluster
- KB0133839: Sorting feature is not available into Server from 10.1 FP5
- KB0133721: Server - Connection pool settings are ignored by Open Liberty
- KB0132889: DOC: change the controller properties file name
- KB0133261: Transfer of a Folder
- KB0132385: DOC: JAVA_TOOL_OPTIONS env variable should not be persistent to install Server on SQL Server 2025
- KB0131686: Unable to start active session
- KB0131494: Removing JNLP, Java Web Start and LWP plugins
- KB0130665: The Server should skip the checks with all the enabled Password Policies if the login is made through SSO
- KB0127317: Change max page size for "All Targets" in Remote Control UI
**Published site version:**
Remote Control, site version 87 (Build Number 10.1.0.0736)
With kind regards,
The BigFix Remote Control Team