Appian Hotfixes

On This Page

This page lists all the recent hotfixes for Appian 26.6.

Note: Appian Cloud customers can refer to MyAppian to see your latest hotfix version.

For self-managed customers, hotfixes are supported for quarterly releases only. Apply hotfixes for Appian on Kubernetes by upgrading to the latest Appian on Kubernetes images for the relevant quarterly release.

Hotfix package (17 Oct 2026)

This cumulative hotfix package includes all resolved issues listed below in a single download. This hotfix is required for any Appian 26.6 installations not currently up to date with the latest hotfixes.

To apply the hotfixes, you'll need to upgrade to the latest Appian on Kubernetes images for the relevant quarterly release.

After installing, you will be running on Appian 26.6.482.0.

You can view your current self-managed Appian version by logging into your Appian environment as a designer or system administrator and clicking the navigation menu > About Appian.

The package resolves the following issues.

26.6.481.0 (17 Oct 2026)

Security Updates - Critical

26.6.480.0 (15 Oct 2026)

Security Updates - Critical
AP-72575 - Medium
Fixed an issue that resulted in failures when sorting on a related record fields for unsynced record types.
AP-67507 - Low
The Reset Authenticator App button in the Admin Console now appears only when MFA is on for all users by default.
AP-71961 - Low
Updates a dependency for ICU timezone update compliance.

26.6.445.0 (08 Oct 2026)

Security Updates - Critical
AP-73087 - High
A data race existed in the federated query framework where query metrics were read without proper synchronization while another thread was concurrently initializing the query execution. Under the right timing conditions, this could result in a gateway crash, causing in-flight queries against connected databases (such as MariaDB, Snowflake, or other federated sources) to fail. The fix adds proper locking around the metrics read path to prevent concurrent access.
AP-72577 - Medium
Fixed an issue where opening long dropdowns on small screen sizes blocked part of the page
AP-73172 - Medium
Fixed an issue that caused failed connections to the Appian Cloud database when querying unsynced record types on sites with dynamic scaling for data fabric queries enabled.
AP-73162 - Low
Fixes an issue in which binlogs were not getting purged appropriately upon upgrading to MariaDB V11.8.

26.6.415.0 (01 Oct 2026)

Security Updates - Medium
AP-67193 - Medium
Fixed a bug where password reset links failed to open the reset page when strict servlet compliance was turned on.

26.6.400.0 (24 Sep 2026)

Security Updates - Critical
AP-71014 - High
Fixes an issue where there was a possible race condition in the full sync lifecycle.
AP-72313 - High
Fixed an issue that caused the edit form for control panel hierarchy items with a large number of data fields to load slowly.
AP-71812 - Low
A new site property is available that reduces the number of open connections to external databases at startup by opening connections only upon initially querying the database.

26.6.365.0 (17 Sep 2026)

Security Updates - High
AP-65942 - High
Resolved an issue where a!update incorrectly threw an error when updating a dictionary with keys that differ only by case (e.g., "b" and "B"), even though standard dictionaries are case-sensitive and treat these as distinct keys. a!update now correctly handles case-sensitive dictionary keys as expected.
AP-69131 - High
Process Modeler Output Expression Evaluation Fix Resolved an issue in the Process Modeler where complex node output expressions—including nested indexing, multi-dimensional arrays, and recordType! references in process variables—failed to evaluate properly or broke variable mappings. Custom output expressions across process model nodes now evaluate consistently as expected.
AP-33618 - Low
Fixed an issue which could occur when multiple records were created from the same database table, but didn't sync the changes made by the other record during a Write Records execution.
AP-70540 - Low
Improve Large Temp Folder Deletion Performance

26.6.341.0 (10 Sep 2026)

Security Updates - High
AP-69740 - Critical
Fixed an issue where logout was sometimes blocked when the user menu was hidden.
AP-69599 - Medium
Fixes an issue in which an admin console data source and a tomcat data source have the same name and a conflict error occurs upon connection. In this case, the admin console data source will instead take precedence.

26.6.316.0 (03 Sep 2026)

Security Updates - Critical
AP-66465 - High
Fixed an issue where autoscaled processes were unable to evaluate expressions containing an equals sign.
AP-69245 - Medium
Fixed an issue that caused record action menus to fail to load for users after upgrading to Google Chrome 152.
AP-70063 - Medium
Feature Toggle Added for Parallel k Evaluation Cache
AP-65692 - Low
Top-level menus in the Process Modeler (File, Edit, etc.) failed to render in newer Chrome versions due to the deprecation of XSLT 1.0. This has been fixed by replacing the deprecated API with a pure JavaScript implementation.
AP-67488 - Low
Addition of SHA-1 Column in the users.csv DataMetrics file. This denotes the number of users present for a SHA-1 SAML Configuration in Admin Console.Additionally, this also includes changes to include a new entry in the "admin_console.csv" to track if the site has SHA-1 enabled SAML Configurations at all.Note: If the customer is streaming either of these logs for use in their downstream systems, they need to be aware of the column addition as it might impact their data ingestion
AP-68090 - Low
Memory usage improvements for specific query patterns in ADS.

26.6.288.0 (01 Sep 2026)

AP-69245 - Medium
Fixed an issue that caused record action menus to fail to load for users after upgrading to Google Chrome 152.
AP-70063 - Medium
Feature Toggle Added for Parallel k Evaluation Cache

26.6.287.0 (28 Aug 2026)

AP-69245 - Medium
Fixed an issue that caused record action menus to fail to load for users after upgrading to Google Chrome 152.

26.6.285.0 (27 Aug 2026)

Security Updates - Critical
AP-66037 - High
Fixed an issue where closing or refreshing a browser tab in Google Chrome did not release locks on design objects (such as Interfaces, Expression Rules, and AI Skills). This previously caused users to see a "You Are Already Editing" prompt when reopening the object even if no other tabs were active.
AP-67903 - High
Fixed an issue that caused query failures when referencing related fields with secondary uniqueness constraints on unsynced record types.
AP-71014 - High
Fixes an issue where there was a possible race condition in the full sync lifecycle.
AP-67063 - Medium
Fixed a database performance issue where concurrent OAuth Client Credentials integrations receiving error responses (401/403/404) could cause excessive writes to a single database row, leading to row-lock contention and site degradation under high load.
AP-67135 - Medium
Updated the data service to automatically reuse VPN connectivity configurations for queries against unsynced record types.
AP-70063 - Medium
Feature Toggle Added for Parallel k Evaluation Cache
AP-61875 - Low
Significantly reduces site startup time on high-availability configurations.
AP-65501 - Low
Added the ability to maintain a schema name of 'appian' on the cloud database instead of enforcing the default 'Appian' schema name when migrating from an on-prem installation using a lower case naming convention to a cloud installation.
AP-70540 - Low
Improve Large Temp Folder Deletion Performance
AP-71812 - Low
A new site property is available that reduces the number of open connections to external databases at startup by opening connections only upon initially querying the database.

26.6.261.0 (21 Aug 2026)

Security Updates - High
AP-66296 - Medium
Fixed an issue that prevented the configuration of incremental syncs for record types synced from database views
AP-66695 - Medium
Fixed SharePoint "Add Document" uploads failing with connection reset when the document stream delivered fewer bytes than the declared Content-Length.
AP-67480 - Low
Updated the font for the SSO Terms of Service to match the native Terms of Service page.

26.6.235.0 (13 Aug 2026)

Security Updates - Critical
AP-63601 - Critical
Fixed an issue where Autoscale executor pods could run out of memory when running a high volume of Autoscale processes containing timer events. Internal timer resources were not being released during normal scaling operations, causing memory to grow over time until the pod crashed. Timer resources are now properly released during scaling, keeping memory stable regardless of how long the pod runs.
AP-66419 - High
Fixed an issue where an HTTP integration using an OAuth 2.0 connected system returned a 401 Unauthorized error after the application was deployed toanother environment, even after re-authorizing the connected system.
AP-63131 - Medium
Fixed LDAP limit concurrent session bug
AP-65237 - Medium
Fixed an issue where the checkBoxField component improperly displayed an error when duplicate values are supplied
AP-65527 - Medium
Fixed a Record Type Designer issue in which records could not be edited within Data Preview if they contained translation strings.
AP-66047 - Medium
The "Call Web Service" smart service failed with error APNX-1-4229-003 after upgrading to 26.6 due to credential lookups being incorrectly routed through a plugin-authorization check. Since the web service activity is a core platform component without a plugin identity, all stored credential requests were rejected. This has been resolved in 26.6.215.0 and 26.8.0.60.
AP-66374 - Medium
Fixed an issue where the latest Sonnet model was not selected as the default model when "Auto" was selected in the Agent Designer.
AP-65872 - Low
Updated the color of disabled text on choice components to be more visible

26.6.205.0 (06 Aug 2026)

Security Updates - Critical
AP-65067 - High
Enables a!callLanguageModel to work with GPT 5.4
AP-65419 - Medium
Fixed an issue with agent auto model selection. Agent now correctly uses sonnet 4.6
AP-65116 - Low
Authentication failures now log the user's subclaim identifier, email address, and preferred username (as configured in the IdP) in tomcat-stdOut.log. This enables administrators to correlate failed authentication attempts with entries in login-audit.csv by matching the logged identifier and username.

26.6.185.0 (30 Jul 2026)

Security Updates - High
AP-64016 - Critical
This fix is for customers on 26.0.156.0 that are seeing error messages connecting to LCP APIs. Error message in the Appserver log like "Translation error in LCP API: No translation chain found".
AP-50418 - High
Fixed an issue where internal Appian objects — specifically 2 system Web APIs (SYSTEM_WEBAPI_importObject, SYSTEM_WEBAPI_importTypes) and 25 internal test folders — were accidentally imported into customer content stores during the 26.3 upgrade due to a broken wbspec exclude pattern (root cause: , fixed in ). On sites that also had a custom data type plugin defining a conflicting Text type, this caused an UnresolvedReferencesException at startup, crashing the site entirely.A one-time startup migration (InternalBundledAppsCleanupMigration) has been introduced that automatically detects and removes these persisted internal objects on affected sites. The migration runs exactly once per site (guarded by a MigrationFlag), is skipped on dev/CI environments where the internal-bundled-apps/ directory is present on disk, and is non-fatal — individual deletion failures are logged as warnings without blocking startup. Fresh sites and sites that were never affected are handled safely with no-op behavior.Fix versions: 26.3, 26.6, 26.7 (Master)
AP-63379 - High
Fixed an issue that caused memory usage to grow unnecessarily in data service real-time store components
AP-63861 - High
Added an informational banner in the Admin Console to clarify that Microsoft Azure AI models are unavailable for AI agents and that Appian-managed models are used instead.
AP-60278 - Medium
Fixed an issue that resulted in failure to pushdown certain join operations for unsynced record types.
AP-63586 - Low
Authentication failures now log the principal identifier in tomcat-stdOut.log, allowing administrators to cross-reference failed attempts with entries in login-audit.csv by mapping the username with the identifier logged.
AP-63587 - Low
Eliminated duplicate and unnecessary logged error statements which appear upon clearing phpMyAdmin sessions.
AP-63687 - Low
Integrated GPT model mappings (GPT 5.4/5.1 and GPT 5.4-mini/5-mini) to satisfy GovCloud and regional data residency compliance
AP-64296 - Low
Updated AI model selection to automatically fall back to supported OpenAI models when Anthropic is unavailable. This ensures AI features continue to function in environments where Anthropic models are disabled.

26.6.156.0 (24 Jul 2026)

Security Updates - High
AP-63351 - High
Fixed an issue where tomcat-stdOut.log could be spammed with "Unable to locate run" messages
AP-63529 - High
Fixed an issue where basic users lack access to UIs with Agent Chat
AP-59860 - Medium
Fixed an issue where email ingestion would fail entirely when any recipient (To, CC, or BCC) had an email address whose local part started with "process", "processmodel", or "processmodeluuid" but was not a valid Appian routing address (e.g., processing@gmail.com, processmodeling@company.com). The routing logic was stripping the prefix and calling Long.valueOf() on the remainder without first validating it was numeric, causing a NumberFormatException that aborted the entire email — including any valid Appian routing recipients on the same message.A regex-based numeric validation (NUMERIC_ID_PATTERN) has been added before parsing the substring as a routing ID. Non-matching addresses are now silently skipped, allowing valid Appian routing recipients on the same email to be processed normally.Fix versions: 26.3.455.0, 26.6.145.0, 26.7.0.150
AP-62172 - Medium
Fixes a SQL Server and Write Records issue in which a database permission error occurs when attempting to set a primary key value to an empty string or a null value.
AP-61700 - Low
Resolved an environment issue impacting government sites that use Appian-managed encryption keys for cloud database encryption.
AP-62078 - Low
Updated date placeholder values for several locales

26.6.127.0 (20 Jul 2026)

AP-62172 - Medium
Fixes a SQL Server and Write Records issue in which a database permission error occurs when attempting to set a primary key value to an empty string or a null value.

26.6.126.0 (16 Jul 2026)

Security Updates - Critical
AP-59137 - High
Fixed an issue that caused unnecessary data service bulk ingestion component memory spikes during full record syncs.
AP-61178 - Medium
Updated a!isPhoneNumber() to correctly validate recently allocated Australian phone numbers.
AP-62202 - Low
Allows sys admins to enable/disable AI LCP API Logging

26.6.105.0 (10 Jul 2026)

Security Updates - Critical
AP-58846 - High
Fixed an issue where mobile users with MFA enabled were stuck in the In-App Browser after completing MFA, instead of being redirected back to the mobile app.
AP-55670 - Low
Added metrics and traces for the SQL API.
AP-55673 - Low
SQL API debugger.
AP-57416 - Low
Integration GET and the HTTP File Download smart service now support non-ASCII file names in Content-Disposition response headers. The RFC 5987 filename* parameter is decoded, enabling correct handling of internationalized file names. When both filename and filename* are present, filename* takes priority per RFC 6266.
AP-58334 - Low
a!genAIModels() function returns additional metadata for each model.
AP-58838 - Low
SQL API backports to ensure parity between 26.6 and main for the MCP server usage of SQL API.
AP-58998 - Low
Advanced IDP Tools and Extract from Document Extraction Smart Services show Usage Groups (Input) and AI Actions Consumed (Output) parameters.
AP-60136 - Low
Fixed an issue that caused Autoscaled processes to error when an executor restarts unexpectedly.
AP-60485 - Low
AI Actions values are now visible in the Monitoring grid for AI Agent runs.

26.6.75.0 (02 Jul 2026)

Security Updates - Critical
AP-59505 - Critical
Fixed an issue where streamed a!callLanguageModel() responses could fail to render on HA environments.
AP-58793 - High
Prevents an issue in which record types without an id field prevent site startup in some instances.
AP-60164 - Medium
Fixed an issue that resulted in degraded data service query performance for record views.
AP-56782 - Low
Connected systems can now be successfully updated and deployed across environments without encountering configuration casting failures.

26.6.65.0 (26 Jun 2026)

Security Updates - Critical
AP-44284 - High
Fixed an issue that caused autoscaled process execution to intermittently stall for a few minutes.
AP-52214 - High
Making JavaMail's SSL path immune to global SSLContext mutation
AP-55683 - High
This ticket helps ADS in our debugging when the query debugger is off so that we successfully get redacted query aliases in our logs.
AP-57686 - High
Bug fix for AI Copilot in Data Fabric (Azure)
AP-58308 - High
Fixes an issue in which specifying a site type did not result in a multi-word site purpose to be displayed in its entirety on the phpMyAdmin banner.
AP-56374 - Medium
Fixed an issue with process-backed records which can occur when querying the records with specific record type field references.
AP-58840 - Low
Fixes an issue that could cause failures when creating new records through Codeless Data Modeling.

Feedback

Was this page helpful?