Appian Hotfixes

On This Page

This page lists all the recent hotfixes for Appian 26.3.

Note: Appian Cloud customers can refer to MyAppian to see your latest hotfix version.

For self-managed customers, hotfixes are supported for quarterly releases only. Apply hotfixes for Appian on Kubernetes by upgrading to the latest Appian on Kubernetes images for the relevant quarterly release.

Hotfix package (05 Nov 2026)

This cumulative hotfix package includes all resolved issues listed below in a single download. This hotfix is required for any Appian 26.3 installations not currently up to date with the latest hotfixes.

To apply the hotfixes, you'll need to upgrade to the latest Appian on Kubernetes images for the relevant quarterly release.

After installing, you will be running on Appian 26.3.840.0.

You can view your current self-managed Appian version by logging into your Appian environment as a designer or system administrator and clicking the navigation menu > About Appian.

The package resolves the following issues.

26.3.840.0 (05 Nov 2026)

Security Updates - Critical

26.3.815.0 (29 Oct 2026)

Security Updates - Critical
AP-77285 - High
Fixed issue where Process Model was not getting unlocked because of usage of the deprecated unload event.

26.3.810.0 (27 Oct 2026)

Security Updates - Critical
AP-67593 - High
Fixed an issue that caused process execution errors when automated archived process deletion configuration is configured incorrectly.
AP-77354 - High
Removed eMudhra intermediate CA certificates from Appian's bundled Java trust stores, so Appian no longer trusts TLS certificates issued through them.

26.3.795.0 (22 Oct 2026)

Security Updates - Critical
AP-73692 - Low
Reduced the instance of an application server restart when a query causes an out of memory error.

26.3.766.0 (17 Oct 2026)

Security Updates - Critical

26.3.765.0 (15 Oct 2026)

Security Updates - Critical
AP-72575 - Medium
Fixed an issue that resulted in failures when sorting on a related record fields for unsynced record types.
AP-69140 - Low
Makes changes to the data server for compliance with new ICU timezone data.

26.3.730.0 (08 Oct 2026)

Security Updates - Critical
AP-73087 - High
A data race existed in the federated query framework where query metrics were read without proper synchronization while another thread was concurrently initializing the query execution. Under the right timing conditions, this could result in a gateway crash, causing in-flight queries against connected databases (such as MariaDB, Snowflake, or other federated sources) to fail. The fix adds proper locking around the metrics read path to prevent concurrent access.
AP-73172 - Medium
Fixed an issue that caused failed connections to the Appian Cloud database when querying unsynced record types on sites with dynamic scaling for data fabric queries enabled.
AP-73162 - Low
Fixes an issue in which binlogs were not getting purged appropriately upon upgrading to MariaDB V11.8.

26.3.705.0 (01 Oct 2026)

Security Updates - High
AP-67193 - Medium
Fixed a bug where password reset links failed to open the reset page when strict servlet compliance was turned on.

26.3.685.0 (24 Sep 2026)

Security Updates - Critical
AP-71014 - High
Fixes an issue where there was a possible race condition in the full sync lifecycle.

26.3.660.0 (17 Sep 2026)

Security Updates - High
AP-70540 - Low
Improve Large Temp Folder Deletion Performance

26.3.635.0 (10 Sep 2026)

Security Updates - High
AP-69740 - Critical
Fixed an issue where logout was sometimes blocked when the user menu was hidden.
AP-69428 - Medium
Updated the data service to enable PrivateLink connectivity configurations for queries against unsynced record types.
AP-69599 - Medium
Fixes an issue in which an admin console data source and a tomcat data source have the same name and a conflict error occurs upon connection. In this case, the admin console data source will instead take precedence.

26.3.611.0 (03 Sep 2026)

Security Updates - Critical
AP-69245 - Medium
Fixed an issue that caused record action menus to fail to load for users after upgrading to Google Chrome 152.
AP-70063 - Medium
Feature Toggle Added for Parallel k Evaluation Cache
AP-65501 - Low
Added the ability to maintain a schema name of 'appian' on the cloud database instead of enforcing the default 'Appian' schema name when migrating from an on-prem installation using a lower case naming convention to a cloud installation.
AP-65692 - Low
Top-level menus in the Process Modeler (File, Edit, etc.) failed to render in newer Chrome versions due to the deprecation of XSLT 1.0. This has been fixed by replacing the deprecated API with a pure JavaScript implementation.
AP-67488 - Low
Addition of SHA-1 Column in the users.csv DataMetrics file. This denotes the number of users present for a SHA-1 SAML Configuration in Admin Console.Additionally, this also includes changes to include a new entry in the "admin_console.csv" to track if the site has SHA-1 enabled SAML Configurations at all.Note: If the customer is streaming either of these logs for use in their downstream systems, they need to be aware of the column addition as it might impact their data ingestion

26.3.583.0 (01 Sep 2026)

AP-69245 - Medium
Fixed an issue that caused record action menus to fail to load for users after upgrading to Google Chrome 152.
AP-70063 - Medium
Feature Toggle Added for Parallel k Evaluation Cache

26.3.582.0 (28 Aug 2026)

AP-69245 - Medium
Fixed an issue that caused record action menus to fail to load for users after upgrading to Google Chrome 152.

26.3.580.0 (27 Aug 2026)

Security Updates - Critical
AP-66037 - High
Fixed an issue where closing or refreshing a browser tab in Google Chrome did not release locks on design objects (such as Interfaces, Expression Rules, and AI Skills). This previously caused users to see a "You Are Already Editing" prompt when reopening the object even if no other tabs were active.
AP-67135 - Medium
Updated the data service to automatically reuse VPN connectivity configurations for queries against unsynced record types.
AP-61875 - Low
Significantly reduces site startup time on high-availability configurations.

26.3.555.0 (21 Aug 2026)

Security Updates - High
AP-66296 - Medium
Fixed an issue that prevented the configuration of incremental syncs for record types synced from database views
AP-66695 - Medium
Fixed SharePoint "Add Document" uploads failing with connection reset when the document stream delivered fewer bytes than the declared Content-Length.

26.3.530.0 (13 Aug 2026)

Security Updates - Critical
AP-64997 - High
Fixed an issue where the query document tool would fail when used with GPT 5.4
AP-63131 - Medium
Fixed LDAP limit concurrent session bug
AP-65527 - Medium
Fixed a Record Type Designer issue in which records could not be edited within Data Preview if they contained translation strings.
AP-66533 - Medium
Fixed an issue where AI agents did not receive multi-record query results, causing them to incorrectly retry the query.
AP-65944 - Low
Fixed an issue in the Record Type Designer's edit data preview functionality in which some values appear as empty when editing, though the modified value is properly saved.

26.3.510.0 (06 Aug 2026)

Security Updates - Critical
AP-65067 - High
Enables a!callLanguageModel to work with GPT 5.4

26.3.490.0 (30 Jul 2026)

Security Updates - High
AP-50418 - High
Fixed an issue where internal Appian objects — specifically 2 system Web APIs (SYSTEM_WEBAPI_importObject, SYSTEM_WEBAPI_importTypes) and 25 internal test folders — were accidentally imported into customer content stores during the 26.3 upgrade due to a broken wbspec exclude pattern (root cause: , fixed in ). On sites that also had a custom data type plugin defining a conflicting Text type, this caused an UnresolvedReferencesException at startup, crashing the site entirely.A one-time startup migration (InternalBundledAppsCleanupMigration) has been introduced that automatically detects and removes these persisted internal objects on affected sites. The migration runs exactly once per site (guarded by a MigrationFlag), is skipped on dev/CI environments where the internal-bundled-apps/ directory is present on disk, and is non-fatal — individual deletion failures are logged as warnings without blocking startup. Fresh sites and sites that were never affected are handled safely with no-op behavior.Fix versions: 26.3, 26.6, 26.7 (Master)
AP-63587 - Low
Eliminated duplicate and unnecessary logged error statements which appear upon clearing phpMyAdmin sessions.
AP-63687 - Low
Integrated GPT model mappings (GPT 5.4/5.1 and GPT 5.4-mini/5-mini) to satisfy GovCloud and regional data residency compliance
AP-64000 - Low
Updated AI model selection to automatically fall back to supported OpenAI models when Anthropic is unavailable. This ensures AI features continue to function in environments where Anthropic models are disabled.

26.3.465.0 (24 Jul 2026)

Security Updates - High
AP-59860 - Medium
Fixed an issue where email ingestion would fail entirely when any recipient (To, CC, or BCC) had an email address whose local part started with "process", "processmodel", or "processmodeluuid" but was not a valid Appian routing address (e.g., processing@gmail.com, processmodeling@company.com). The routing logic was stripping the prefix and calling Long.valueOf() on the remainder without first validating it was numeric, causing a NumberFormatException that aborted the entire email — including any valid Appian routing recipients on the same message.A regex-based numeric validation (NUMERIC_ID_PATTERN) has been added before parsing the substring as a routing ID. Non-matching addresses are now silently skipped, allowing valid Appian routing recipients on the same email to be processed normally.Fix versions: 26.3.455.0, 26.6.145.0, 26.7.0.150
AP-62172 - Medium
Fixes a SQL Server and Write Records issue in which a database permission error occurs when attempting to set a primary key value to an empty string or a null value.
AP-61700 - Low
Resolved an environment issue impacting government sites that use Appian-managed encryption keys for cloud database encryption.
AP-62078 - Low
Updated date placeholder values for several locales

26.3.436.0 (20 Jul 2026)

AP-62172 - Medium
Fixes a SQL Server and Write Records issue in which a database permission error occurs when attempting to set a primary key value to an empty string or a null value.

26.3.435.0 (16 Jul 2026)

Security Updates - Critical
AP-59137 - High
Fixed an issue that caused unnecessary data service bulk ingestion component memory spikes during full record syncs.
AP-61178 - Medium
Updated a!isPhoneNumber() to correctly validate recently allocated Australian phone numbers.

26.3.410.0 (10 Jul 2026)

Security Updates - Critical
AP-58846 - High
Fixed an issue where mobile users with MFA enabled were stuck in the In-App Browser after completing MFA, instead of being redirected back to the mobile app.
AP-57416 - Low
Integration GET and the HTTP File Download smart service now support non-ASCII file names in Content-Disposition response headers. The RFC 5987 filename* parameter is decoded, enabling correct handling of internationalized file names. When both filename and filename* are present, filename* takes priority per RFC 6266.

26.3.395.0 (02 Jul 2026)

Security Updates - Critical
AP-59505 - Critical
Fixed an issue where streamed a!callLanguageModel() responses could fail to render on HA environments.
AP-58308 - High
Fixes an issue in which specifying a site type did not result in a multi-word site purpose to be displayed in its entirety on the phpMyAdmin banner.
AP-60136 - Low
Fixed an issue that caused Autoscaled processes to error when an executor restarts unexpectedly.

26.3.372.0 (25 Jun 2026)

Security Updates - Critical
AP-58793 - High
Prevents an issue in which record types without an id field prevent site startup in some instances.
AP-56086 - Medium
Fixed an issue with startup performance caused by the translations system record type when multiple locales are configured.
AP-58840 - Low
Fixes an issue that could cause failures when creating new records through Codeless Data Modeling.

26.3.351.0 (19 Jun 2026)

Security Updates - Critical
AP-44284 - High
Fixed an issue that caused autoscaled process execution to intermittently stall for a few minutes.
AP-52214 - High
Making JavaMail's SSL path immune to global SSLContext mutation
AP-57686 - High
Bug fix for AI Copilot in Data Fabric (Azure)
AP-56374 - Medium
Fixed an issue with process-backed records which can occur when querying the records with specific record type field references.

26.3.320.0 (11 Jun 2026)

Security Updates - High
AP-55683 - High
This ticket helps ADS in our debugging when the query debugger is off so that we successfully get redacted query aliases in our logs.
AP-56305 - High
Fixed an issue where deleting the default CSS profile before saving changes caused an admin console error.
AP-51813 - Medium
Authenticated administrative users could bypass access restrictions on the /suite/shared-logs/ endpoint using crafted path normalization sequences (;/../). This allowed traversal from permitted directories into restricted internal log directories such as /internal/, /data-server-sensitive/, /tomcat/, and /service-manager/. The fix adds validation in the ListingsServletFilter to reject paths containing dot-segments (..) or path parameters ( before processing, ensuring restricted directories remain inaccessible. Affected versions: master, 25.3-maint, 25.4-maint, 26.3-maint.
AP-54706 - Medium
Prevents an email smart search index failed alert sent for composite key records on sites that use smart search.
AP-56176 - Medium
Fixed an issue where null values supplied to sortInfo in dropdown components would incorrectly result in an error.
AP-56640 - Medium
Fixed an issue where using Billboard Images in Portals caused an error.
AP-52715 - Low
Fixed an issue in which new database connections were not able to be created due to the number of existing idle sessions.
AP-56301 - Low
Code Cleanup

26.3.295.0 (04 Jun 2026)

Security Updates - High
AP-51119 - Medium
Resolved an issue which resulted in a script to kill runaway EDP queries failing to deploy at startup in some circumstances.
AP-52720 - Medium
Fixed an issue where data metrics were not being logged correctly.
AP-54765 - Medium
Fixed an issue where null values supplied to choiceValues in dropdown components would incorrectly result in an error.
AP-53317 - Low
Previously, any change to Name, Relationship, Field, Record List Action, Related Action, or Detail View triggered immediate LLM calls to update long and business description.Now, description regeneration is batched with a 1-hour delay whenever a record type gets modified

26.3.265.0 (28 May 2026)

Security Updates - Critical
AP-51361 - Medium
Fixed an issue where browser back-button navigation could expose cached login credentials after logout.
AP-51736 - Medium
Fixed an issue where the start process smart service function incorrectly treated child process errors as successful completions.
AP-54014 - Medium
Increases the number of attempts to create the health check role upon startup on Windows server.
AP-51842 - Low
Fixed an issue in portal and site objects in Appian Designer which sometimes caused recent error messages to appear under the wrong date for users in timezones with high UTC offsets.
AP-53323 - Low
Reduces the size of the startup log by logging orchestrator discovery events to a separate log file.
AP-53562 - Low
Removed the default cpu limit for phpMyAdmin, maintaining the site property for site-specific control

26.3.240.0 (21 May 2026)

Security Updates - High
AP-53607 - High
Added automatic retry handling for data service query requests that fail due to transient internal network errors.
AP-44179 - Medium
Resolved an issue that caused a!queryRecordType to filter out records that have a null search result map.
AP-52907 - Medium
Fixed an issue where the text field's align parameter being set to "DEFAULT" produced an error.
AP-52962 - Medium
Fixed an issue in the header content layout where a list of null header parameter results in an error instead of no header.
AP-53490 - Medium
Fixed an issue where the screen was unresponsive after Tempo task reassignment.
AP-48814 - Low
Optimized process design engine usage when executing high volume of autoscaled processes.
AP-52904 - Low
Fixed an issue in the Execute Generative AI Skill Smart Service where the input and output parameters didn't update based on the AI Skill type.

26.3.216.0 (15 May 2026)

Security Updates - Critical
AP-51112 - High
Fixed an issue which caused backload processes to fail on encrypted sites.
AP-51975 - High
Bug Fixes
AP-50039 - Medium
Fixed an issue where the start process smart service node incorrectly treated child process errors as successful completions.
AP-51732 - Medium
Fixed an issue with reporting record type sync filter when the record type doesn't have any data in it.
AP-52318 - Medium
Fixed an issue where some offline form submissions fail due to evaluation differences between the device and the server.
AP-52475 - Medium
Fixed an issue in the cloud database in which events in custom schemas failed to be enabled after a high-availability site was restarted.
AP-50271 - Low
Excluded vis-network from the default CSS loader and added a dedicated loader config that extracts vis-network CSS via MiniCssExtractPlugin without CSS modules, preserving the global class names that the vis-network library expects.
AP-52517 - Low
Fixed an issue where the Execute Generative AI Skill node does not finish the execution.

26.3.191.0 (08 May 2026)

Security Updates - Critical
AP-50834 - High
Fixes an issue on classic cloud implementations in which the cloud database encryption fails when region value is not found.
AP-51031 - High
Fixed an issue with database pod startup which can cause excessive site startup time during a maintenance window.
AP-51684 - High
Fixed an issue which prevents creating a record from an underlying table identified by a composite primary key when any of the key fields falls outside the range of the first 100 fields on the table.
AP-50619 - Medium
Fixed an issue that intermittently caused an error while submitting a task.
AP-51697 - Medium
Fixed an issue where validation groups on records-backed dropdown components were returning false positive validation messages.
AP-52318 - Medium
Fixed an issue where some offline form submissions fail due to evaluation differences between the device and the server.

26.3.165.0 (30 Apr 2026)

Security Updates - Critical
AP-50019 - Critical
Add toggle to allow disabling XML special character escaping in OpenOfficeMerger. When enabled, substitution values containing WordML/ODF XML/SpreadsheetML pass through unescaped, allowing users to inject dynamic tables and formatted content into generated Word/OpenOffice/Excel documents.
AP-49545 - High
The fix addressed two underlying issues that together caused customer upgrades to 26.3 to fail during startup. First, the wbspec.excludes patterns were corrected to align with the updated source directory structure introduced during the webapp packaging refactor, ensuring that internal-bundled-apps/ and related artifacts are no longer unintentionally included in the Docker image. Second, the SYSTEM_WEBAPI_importTypes.xml definition was updated to use a fully qualified system type reference (type!{http://www.appian.com/ae/types/2009}Text?list) instead of an unqualified Text type, preventing conflicts with customer plugins that define similarly named datatypes. Together, these changes resolved the fatal startup UnresolvedReferencesException, restored successful site startup during upgrades, and ensured consistent packaging behavior across all deployment paths.
AP-49891 - High
Fixed an issue that caused system startup and impact analysis to experience significant delays or fail on sites with a large number of record types, fields, or relationships.
AP-51232 - High
Fixed an issue in layouts where a null contents parameter results in an error instead of a layout without contents.
AP-49902 - Medium
Fixed an issue with importing applications when an Interface test scenario referenced a document.
AP-46228 - Low
Tokenized the HTTP client migration feature toggle properties (ae.integration-services.httpClient5.enabled and ae.integration-services.http2.enabled) so they now persist correctly across site restarts.
AP-49084 - Low
Changed the CorruptIndexReportedOnMariaDB alert to resolve once the issue is corrected instead of when the error log is rotated.

26.3.131.0 (23 Apr 2026)

Security Updates - Critical
AP-50019 - Critical
Add toggle to allow disabling XML special character escaping in OpenOfficeMerger. When enabled, substitution values containing WordML/ODF XML/SpreadsheetML pass through unescaped, allowing users to inject dynamic tables and formatted content into generated Word/OpenOffice/Excel documents.
AP-49253 - High
Fixed an issue in which a newly added record with a document was not indexed for smart search until a full sync occurred.
AP-49436 - High
Fixed an issue in which a write records error occurred when a one-many child record with a null value was included.
AP-49659 - High
Fixed an issue where interface froze on record actions without start forms.
AP-49675 - High
Fixed an issue with service-back and salesforce-backed synced records in which executing the sync records smart service while a full sync is running can result in a full sync failure.
AP-48776 - Medium
Fixed an issue where a!recordTypeProperties() failed to evaluate and display translation strings, including those for custom fields across different locales.
AP-49308 - Medium
Fixed an issue regarding dropdowns with placeholders that were empty strings.
AP-40515 - Low
Adds more detail to cloud database startup metrics to monitor step duration and identify areas where improvement could better adhere to maintenance windows.
AP-47453 - Low
Fixed an issue with importing applications when an Interface test scenario referenced a document.

26.3.107.0 (22 Apr 2026)

AP-50019 - Critical
Add toggle to allow disabling XML special character escaping in OpenOfficeMerger. When enabled, substitution values containing WordML/ODF XML/SpreadsheetML pass through unescaped, allowing users to inject dynamic tables and formatted content into generated Word/OpenOffice/Excel documents.

26.3.106.0 (17 Apr 2026)

Security Updates - High
AP-47959 - High
Fixed an issue where failures observed when using a!authorizationLink() for SharePoint connected systems using Authorization Code (With client secret) authentication
AP-46497 - Medium
Adds the capability for an unsynced record type to be created on the same set of schemas as an equivalent synced record type for the datasource.
AP-45962 - Low
Fixed an issue that resulted in intermittent failures when attempting to display record actions in a dropdown.
AP-46353 - Low
Fixed an issue in which the rdbms is reported down during an HA orchestrator restart when the rdbms containers are not restarted.

26.3.80.0 (10 Apr 2026)

Security Updates - High
AP-45257 - Critical
Fixed an issue that caused occasional data service failures when processing full syncs and queries concurrently.
AP-47129 - High
Improved caching behavior at scale for High Availability sites.
AP-43912 - Medium
Fixed an issue where some record data could be lost when mapping the outputs of a child process back to the parent process in a Start Process smart service node.
AP-45177 - Medium
Fixed an issue which prevented including a related one-to-many record type with a composite primary key in a generated record action.
AP-46034 - Medium
Fixed an issue where after converting a Subprocess node to the Start Process smart service, any process parameters that were empty before conversion could never be configured.
AP-46185 - Medium
Fixed an issue with Oracle databases where unnecessary update statements are generated which under certain circumstances cause row lock contention.
AP-46592 - Medium
When both skipped failed syncs and recovery syncs are enabled, the record type stays available when a recovery sync fails.
AP-46933 - Medium
Fixed an issue that prevented control panel functions from working when autoscale is enabled for a process.
AP-47097 - Medium
Fixed an issue that prevented data sync for record types using a Small Int primary key.
AP-45417 - Low
Fixed an issue that in rare cases results in degraded query performance due to unnecessary data service locking patterns.
AP-46028 - Low
Fixes an issue in which a business data source case setting resulted in failure to generate record actions.

26.3.60.0 (02 Apr 2026)

Security Updates - Critical
AP-44857 - Medium
Fix 500 error when checking plugin dependents in AdminConsole

26.3.40.0 (27 Mar 2026)

Security Updates - Critical
AP-42768 - Critical
Fixed an issue in which, in some situations, EDP private link connections did not reach the database due to DNS resolution failure.
AP-43410 - High
Fixed an issue that resulted in the gradual increase of data service disk and memory usage over time between each full record sync.
AP-39843 - Medium
Updated isInvalidAltDomain() to check for domain boundary with dot prefix to properly distinguish between subdomains and sibling domains.
AP-42183 - Low
Fixed an issue where users were incorrectly redirected to the Tempo news page instead of their configured start page after logging out and logging back in. This occurred in environments with MFA and SSO configured, where the admin-configured user start page was not honored on re-login. The fix ensures users are now correctly redirected to the site page defined in the User Start Pages section of the Admin Console.

Feedback

Was this page helpful?