Skip to content

Releases: NeroDOC/cisco-clients

Release list

v5.1.20.333

v5.1.20.333 Latest
Latest

Choose a tag to compare

View all tags
@NeroDOC NeroDOC released this 12 Oct 08:22
v5.1.20.333
5a10739
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Cisco Secure Client 5.1.20.333 New Features

Sept 11, 2026

This release includes the following updates and features, and resolves the defects that are described in Cisco Secure Client 5.1.20.333.

  • Support for macOS 27 (Golden Gate)

  • Support and deployment for Endpoint Data Loss Prevention (Windows and macOS predeploy and Apple silicon M only)—Enables you to protect sensitive data on endpoints by controlling what data is transferred to external devices. It extends your data protection policies and ensures that sensitive data remains secure and compliant with your security requirements. For information on managing endpoint data loss prevention, enrolling devices, and troubleshooting, refer to Manage Endpoint Data Loss Prevention Using Cisco Secure Client in Secure Access or Create Deployment in Cisco XDR.

  • Fallback to machine authentication for Network Access Manager (CSCwt18945)—Currently when a smart card is removed, the network connection either drops or remains tied to user-level authorization, depending on the configuration. Now Network Access Manager automatically transitions to machine authentication in these scenarios, ensuring the device stays connected to the network even when the user session is no longer active. This update is essential for maintaining reliable, consistent connectivity and is a signficant efficiency boost for IT departments. It allows for the provisioning of generic PCs without the need to pre-install individual user certificates. Once connected via machine fallback, the system can handle certificate enrollment or push updates seamlessly, which significantly reduces the manual effort of provisioning machines. Refer to Networks, Network Connection Type Pane in the Secure Client Administrator Guide.

  • Release 5.1.20.333 contains the following versions for the various modules:

    • Zero Trust Access—5.1.20.7023
    • Secure Client UI—5.1.20.2493
    • Cisco AnyConnect VPN core—5.1.20.333
    • DART—5.1.20.333
    • Umbrella—5.1.20.333
    • SBL—5.1.20.333
    • Network Access Manager—5.1.20.333
    • Network Visibility Module—5.1.20.333
    • Secure Firewall Posture—5.1.20.333
    • Endpoint Data Loss Prevention (Windows and macOS only)—1.5.0.292
    • ThousandEyes—2.43.2
    • ISE Posture—5.1.20.333
    • Duo Desktop—7.20.0.0
    • Endpoint Visibility Module (Windows and macOS)—1.8.0.5

  • Known Issues: CSCww61247—Linux CSC UI remains in English after changing system language to a supported locale

Cisco Secure Client 5.1.20.333 Bugs

The Cisco Bug Search Tool has detailed information about the following open and resolved caveats in this release. A Cisco account is required to access the Bug Search Tool. If you do not have one, register at https://Cisco.com.

Resolved

Identifier Component Headline
CSCwv68963 gui macOS: Tab key does not move keyboard focus
CSCwt18945 nam NAM: Authentication Fallback option From User+Machine to Machine
CSCwu59612 nam Unable to add Certificate Matching Rule Entries in NAM Profile Editor
CSCwv43776 nam ISE 3.5P3 FIPS: EAP-TLS Auth Failures (DH Errors) with Secure Client 5.1.17.3394+
CSCww04040 opswat-ise ISE Posture Patch Management condition missing Windows Update Agent 1509.x
CSCww16909 opswat-asa macOS: Secure Firewall Posture spikes high CPU when running on macOS 15 and macOS 26
CSCwv47385 vpn Debian client install with ABSOLUTE_INSTALLER_FILE_PATH set does not copy user profiles
CSCwv24739 ztna ENH: Adjust ZTA DNS Caching Behavior
CSCwv89381 ztna ZTA: To Extend TTL Duration for Synthetic IP in ZTA Interceptor
CSCww13742 ztna Apps fail to connect to a named resource after TND deactivates its intercepting ZTA configuration
Assets 22

v5.1.19.1862

v5.1.19.1862

Choose a tag to compare

View all tags
@NeroDOC NeroDOC released this 12 Oct 08:19
v5.1.19.1862
5a10739
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Cisco Secure Client 5.1.19.1862 New Features

July 31, 2026

This release includes the following updates and features, and resolves the defects that are described in Cisco Secure Client 5.1.19.1862:

  • Support in Linux for Zero Trust Access Secure Boot and Kernel Lockdown. Refer to Secure Boot and Kernel Lockdown in ZTA Linux for additional information.

  • Restrict Communication to Trusted Applications—Only Cisco signed applications can communicate with VPN services across all desktop platforms. This enhancement manages inter-process communications between applications based on Cisco's code signing requirements. It impacts all client applications developed using the Secure Client's published API as well. The preference is enabled by default as a security measure in the local policy file. Refer to Local Policy Preferences.

  • Zero Trust Access localized strings are supported for all OSs.

  • Network Location support on Zero Trust Access—Ability to apply the right Zero Trust Access profile based on where a user's device is connecting from, such as a corporate branch, office subnet, data center, or remote network. Refer to Get Started with Network Location Objects for Zero Trust Access.

  • Release 5.1.19.1862 contains the following versions for the various modules:

    • Zero Trust Access—5.1.19.6509
    • Secure Client UI—5.1.19.2351
    • Cisco AnyConnect VPN core—5.1.19.1862
    • DART—5.1.19.1862
    • Umbrella— 5.1.19.1862
    • SBL—5.1.19.1862
    • Network Access Manager—5.1.19.1862
    • Network Visibility Module—5.1.19.1862
    • Secure Firewall Posture—5.1.19.1862
    • Endpoint Data Loss Prevention (Windows only)—1.5.0.292
    • ThousandEyes—2.43.2
    • ISE Posture—5.1.19.1862
    • Duo Desktop—7.19.0.0
    • Endpoint Visibility Module—1.8.0.5 (Windows), 1.7.0.8 (macOS)

  • For related documentation, refer to the Cisco Secure Client (including AnyConnect) Administrator Guide, Release 5.1 with a new look and feel.

Cisco Secure Client 5.1.19.1862 Bugs

The Cisco Bug Search Tool has detailed information about the following open and resolved caveats in this release. A Cisco account is required to access the Bug Search Tool. If you do not have one, register at https://Cisco.com.

Resolved

Identifier Component Headline
CSCwt63680 core Multiple certificate authentication may fail if certificates are cached on the client
CSCwt89046 core ENH: Optimize enabling interceptor debug logging to minimize disruption
CSCwt89139 core ENH Windows: Use an interceptor logging mechanism that doesn't require an external log collector
CSCwu65181 core Secure Client installation on Ubuntu 26.x missing libxml2.so.2
CSCws43583 dart Add option in dartcli to encrypt the bundle
CSCwn45054 nam Add support for enterprise BIGKT KDE in NAM for 802.1x networks
CSCwr67707 nam NAM logs no longer transition to networkState event "Connected"
CSCwu72140 nam Aternity Intel-Riverbed Wi-Fi telemetry upload failure due to IHV interoperability issue with Secure Client NAM
CSCws45813 opswat-ise ENH: Secure Firewall Posture support for CrowdStrike Falcon Firewall on Linux
CSCwt23310 opswat-ise To support MS defender ATP automatic remediation
CSCwt90913 opswat-ise Windows - Need support for Disk encryption Bitlocker 10.x version encryption state check
CSCwu26872 opswat-ise ENH: Sophos Endpoint Agent 2026.x to be supported on AnyConnect Compliance Module
CSCwf92544 umbrella Umbrella agent uses TPS component Newtonsoft.Json 6.0.2
CSCwt18374 vpn Rpm/Deb: Linux ISE CM upgrade/downgrade issues from rpm to script
CSCwu28320 vpn Linux: switching tunnel-groups it not loading Embedded browser, loads in Ext browser instead
CSCwt77234 ztna macOS: Chrome connections subject to ZTA interception may fail if re-attempted after enabling interceptor debug logging
CSCwu50030 ztna Chrome PNA prompt triggered due to ZTA synthetic address on Windows and macOS
CSCwv18649 ztna ZTA TND IPv6 DNS server matching is case-sensitive and can prevents expected TND match
CSCwv26481 ztna ZTA Enrollment choice file signing certificate verified against system clock instead of iat claim
Loading

v5.1.14.145

v5.1.14.145

Choose a tag to compare

View all tags
@NeroDOC NeroDOC released this 12 Oct 08:14
v5.1.14.145
5a10739
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Cisco Secure Client 5.1.14.145 New Features

December 19, 2025

This release includes the following new updates, and resolves the defects that are described in Cisco Secure Client 5.1.14.145.

  • Any 5.1.8 users who upgraded to 5.1.13 prior to November 20, 2025 require no further action to resolve the trust bundle issue described in Cisco Secure Client 5.1.13.177 New Features. Users who are running 5.1.9 to 5.1.12 should refer to the expiry dates listed in Cisco Secure Client 5.1.13.177 New Features to avoid upgrade issues.

    Release 5.1.14 contains a fix for CSCws30211, which prevents an upgrade to those Windows devices not upgraded prior to the expiration dates detailed in CSCws02283.

    Those Windows users affected by CSCws00283 whose devices are beyond the specified expiration dates must upgrade to 5.1.14.145 (or later). MacOS users affected by CSCws00283, and Windows users affected by CSCws00283 whose machines have not yet reached the specified expiration dates, can upgrade to 5.1.13.177 (or later).

  • Linux build filenames have changed:
    Previous Name New Name
    cisco-secure-client-linux64-version-predeploy-k9.tar.gz cisco-secure-client-linux64-version-predeploy-k9.tgz
    cisco-secure-client-linux64-version-predeploy-deb-k9.tar.gz cisco-secure-client-linux64-version-predeploy-deb-k9.tgz
    cisco-secure-client-linux64-version-predeploy-rpm-k9.tgz cisco-secure-client-linux64-version-predeploy-rpm-k9.tgz
    cisco-secure-client-linux64-version-vpnapi.tar.gz cisco-secure-client-linux64-version-vpnapi.tgz
    cisco-secure-client-linux-arm64-version-predeploy-k9.tar.gz cisco-secure-client-linux-arm64-version-predeploy-k9.tgz
    cisco-secure-client-linux-arm64-version-predeploy-deb-k9.tar.gz cisco-secure-client-linux-arm64-version-predeploy-deb-k9.tgz
    cisco-secure-client-linux-arm64-version-predeploy-rpm-k9.tar.gz cisco-secure-client-linux-arm64-version-predeploy-rpm-k9.tgz
    cisco-secure-client-linux-arm64-version-vpnapi.tar.gz cisco-secure-client-linux-arm64-version-vpnapi.tgz

  • Release 5.1.14.145 contains the following versions for the various modules:

    • Zero Trust Access—5.1.14.3417
    • Secure Client UI—5.1.14.1452
    • Cisco AnyConnect VPN core—5.1.14.145
    • DART—5.1.14.145
    • Umbrella— 5.1.14.145
    • SBL—5.1.14.145
    • Network Access Manager—5.1.14.145
    • Network Visibility Module—5.1.14.145
    • Secure Firewall Posture—5.1.14.145
    • ThousandEyes—2.20.1
    • ISE Posture—5.1.14.145

Cisco Secure Client 5.1.14.145 Bugs

The Cisco Bug Search Tool has detailed information about the following open and resolved caveats in this release. A Cisco account is required to access the Bug Search Tool. If you do not have one, register at https://Cisco.com.

Resolved

Identifier Component Headline
CSCwm50768 core Secure Client UI freezes when quitting the application on Windows
CSCws19101 core [ui-cosmetic] no minimum size for columns in the stats screen which can result in hiding all stats
CSCws19124 core [ui-cosmetic] stock Windows icon in the clear browser confirmation dialog
CSCws36722 core ENH: Modifications to UI messages associated with Duo Desktop posture assessments and various system state conditions
CSCws12260 opswat-ise Carbon Black Cloud Sensor 4.10+ not detected by ISE Posture
CSCwq97376 posture-ise Iseagent crash during discovery
CSCwr86453 posture-ise Secure Client Posture Module gets restarted when monitoring 3rd party sends Compliance report check
CSCws11636 posture-ise Windows posture file check fails if file/folder permission is admin read-only
CSCws35955 posture-ise ISE posture agent stuck in "Initializing" state
CSCwr26996 vpn Secure Client erroneously adds I flag to local LAN route on VPN disconnect on macOS
CSCwr69007 vpn AnyConnect Secure Client does not connect due to downloader failing when establishing user tunnel
CSCwr69040 vpn AnyConnect is unable to connect user tunnel due to machine tunnel reconnecting
CSCwr01204 ztna ZTA client IPC to the DHA message broker can cause IPC breakdown when Windows pipe send buffers become exhausted
CSCwr74822 ztna ZTA Agent Enrollment failure due to DHA Posture Client send timeout on Windows Pipc IPC to DUO Trusted Peer Message Broker service
CSCwr90099 ztna ZTA Certificate based enrollment fails to match certificate when chain certificates are only present in user store
CSCwr95996 ztna Running iperf UDP over ZTA may may result in unexpected behaviors
CSCws02618 ztna Ping from non-ZTA device to ZTA-enrolled device fails when on same network
CSCws19128 ztna ZTA pause timer can be set past max value by manipulating system time
CSCws19140 ztna Unable to pass ZTA data when QUIC is enabled
CSCws30211 ztna Upgrading from a release affected by CSCws00283 fails since ZTA service cannot be terminated
Loading

v5.1.9.113

v5.1.9.113

Choose a tag to compare

View all tags
@NeroDOC NeroDOC released this 12 Oct 08:11
v5.1.9.113
5a10739
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Cisco Secure Client 5.1.9.113 New Features

This release includes the following new features and resolves the defects that are described in Cisco Secure Client 5.1.9.113.

  • Enrollment with User Certificates—Without user action or awareness, you can enroll Windows and macOS devices in Zero Trust Access. Refer to Use Certificate Enrollment Without User Action in the administrator guide for additional information.

  • Network Access Manager support for WPA3 SAE Transition (CSCwn15672)—Network Access Manager supports transition mode so that the client can connect to wireless networks that support both WPA2 and WPA3. Client devices can change the network profile from WPA2 PSK to WPA3 SAE, and from WPA2 Enterprise to WPA3 Enterprise, if a transition disable indication is received from an access point when connecting the network. Authentication policies must allow WPA3: if the policy does not allow Network Access Manager to change the configuration from WPA2 to WPA3, a popup is displayed upon receiving a transition disable indication.

  • Network Visibility Module support for EVE integration—Allows Network Visibility Module to report EVE records.

  • Network Visibility Module support for Linux browser plugins (CSCwn78412).

  • Windows Server 2022 is supported for Network Visibility Module on-prem and XDR.

  • By default, HTTP headers are excluded from the Network Visibility Module Data Collection Policy (CSCwn75887).

  • In Umbrella Secure Web Gateway, added IPv4 link-local mapped IPv6 addresses to default exception list (CSCwe39164).

  • The ISE Posture UI tile has been improved by removing the loader experience and replacing it with enhanced messages (CSCwn75759).

  • Release 5.1.9.113 contains the following versions for the various modules:

    • Zero Trust Access—5.1.9.1200
    • Secure Client UI—5.1.9.460
    • AnyConnect VPN core—5.1.9.113
    • DART—5.1.9.113
    • Umbrella—5.1.9.113
    • SBL—5.1.9.113
    • Network Access Manager—5.1.9.113
    • Network Visibility Module—5.1.9.113
    • Secure Firewall Posture—5.1.9.113
    • ThousandEyes—1.229.2
    • ISE Posture—5.1.9.113

Cisco Secure Client 5.1.9.113 Bugs

The Cisco Bug Search Tool has detailed information about the following open and resolved caveats in this release. A Cisco account is required to access the Bug Search Tool. If you do not have one, register at https://Cisco.com.

Resolved

Identifier Component Headline
CSCvr52867 core ENH: Support always-on Linux platforms
CSCwf64711 core Windows multi-homing: cannot connect to split exclude target via secondary interface
CSCwi22704 core Reconnect does not retry when IP address is present but DNS entry is not
CSCwn19905 core macOS: VPN tunnel establishment fails (prior to default gateway MAC address provisioning)
CSCwn48390 core Windows: revisit TCP flow redirect handling in KDF per MS guidelines
CSCwn57079 core DNS queries sent to configured local DNS resolver instead of Umbrella resolver intermittently
CSCwn76322 core macOS Intel: ZTA service fails to start upon reboot
CSCwi37344 dart DART does not collect embedded browser crash dumps
CSCwo40094 download_install Core module should not upgrade when VPN session is active
CSCwi64320 gui Stop bringing the UI to foreground after installing and/or uninstalling the Cloud Management
CSCwn15672 nam NAM support for WPA3 SAE transition disable
CSCwn50681 nam NAM Enable Wireless in German is not translated well
CSCwn92068 nam Fast authentication disabled upon smart card removal despite policy settings
CSCwn75887 nvm Enhancement to exclude HTTP headers by default in Data Collection Policy (DCP)
CSCwn78412 nvm Support for Linux Browser Plugins
CSCwn91660 nvm Delay in export of records
CSCwn91729 nvm Support for EVE records in NVM on-prem
CSCwn96702 nvm SSIDs with UTF-8 characters not reported properly
CSCwm51430 opswat-ise Windows Update Agent 1220.2407.15022.0 detected as 1218.2404.17012.0
CSCwn31640 opswat-ise ISE 3.3 P4 / Trellix Endpoint Security 36.x is not listed under antimalware conditions
CSCwn38100 opswat-ise Failure in definition check for Microsoft Defender ATP
CSCwn60361 opswat-ise Add support for ESET Cyber Security version 8.x in MAC Compliance Module
CSCwn93231` opswat-ise For macOS Crowdstrike def details are not getting updated
CSCwn56255 posture-ise Enhancement: VPN disconnection triggers posture "error" instead of "information"
CSCwn59485 posture-ise Lockdown installer transform is not working for ISE Posture module
CSCwn75759 posture-ise ISE Posture UI tile improvements - No loader and improved messages
CSCwe39164 swg ENH: Add IPv4 link-local mapped IPv6 addresses in default exception list
CSCwm90941 swg ENH: Add IPv4 mapped IPv6 address "::ffff.127.0.0.1" in the default exception list
CSCwf99520 umbrella Umbrella - DNS state is "unprotected" and not getting back to protected state automatically
CSCwo42715 umbrella Reduce time to protection on macOS
CSCwn10030 vpn macOS IPv4 address incompatibilities with iOS hotspot and 464XLAT mobile carrier
CSCwo31872 vpn Upgrade to Cisco Secure Client 5.1.8 removes VPN address from AnyConnect
CSCwo72082 vpn Management tunnel ends up disconnected on underpowered client device
CSCwo05365 ztna Vulnerabilities in nghttp2 1.57.0 CVE-2024-28182
CSCwo32685 ztna ZTA wildcard steering rule causes synthetic NODATA DNS response on Windows
CSCwo75151 ztna Fail to access resource when steering FQDN rule has capital letters
CSCwo76652 ztna ZTA on macOS sometimes fails to detect enrollment after reboot - invalid local user status
Loading

v5.1.7.80

v5.1.7.80

Choose a tag to compare

View all tags
@NeroDOC NeroDOC released this 12 Oct 08:09
v5.1.7.80
5a10739
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Cisco Secure Client 5.1.7.80 New Features

This release includes the following features and support updates, and resolves the defects described in Cisco Secure Client 5.1.7.80:

  • Addition of ThousandEyes 1.219.1—Contains support for integrating ThousandEyes with Secure Client Zero Trust Access and also the ability to read the new ThousandEyes.json profile, which improves the registration workflow for new installations.

  • Tamper Protection for Network Visibility Module (CSCwk30374)—(Windows only) Protects user from stopping/blocking/uninstalling XDR binaries or applications. Refer to XDR Documentation for additional information.

  • Some Secure Client Modules will not work on Windows 11 24H2 unless location permission is set (CSCwm80714). Details are found in Some Secure Client Modules Not Working on Windows 11 24H2 Unless Location Permission is Set.

  • When utilizing out-of-band deployment methods, whether manually or through SCCM, you should initiate pre-deploy installers for software upgrades. It is important to note that you should not remove any Cisco Secure Client (AnyConnect) registry entries within SCCM or other deployment scripts during the upgrade process. For upgrade-related issues, consult with Cisco.

  • The Zero Trust Access Module is supported on Windows ARM64 (CSCwm67479).

  • Support to override system proxy settings in macOS embedded browsers was added (CSCwj04530).

  • Network Visibility Module Process Tree Hierarchy (CSCwm44074)—Until release 5.1.6, the flows reported by Network Visibility Module only included information about the process and its parent process, and not the further process lineage. Now you can choose to report the hierarchy by clicking the Process Tree Hierarchy checkbox in the Network Visibility Module profile editor. A separate record (Process Record) is sent for each process in the process hierarchy. The process records have a unique identifier (PUID) that you can use to link between process records and flow records. Refer to the Network Visibility Module Profile Editor for additional information.

  • Release 5.1.7.80 contains the following versions for the various modules:

    • Zero Trust Access—5.1.7.7561
    • Secure Client UI—5.1.7.1336
    • AnyConnect VPN core—5.1.7.80
    • DART—5.1.7.80
    • Umbrella—5.1.7.80
    • SBL—5.1.7.80
    • Network Access Manager—5.1.7.80
    • Network Visibility Module—5.1.7.80
    • Secure Firewall Posture—5.1.7.80
    • ThousandEyes—1.219.1
    • ISE Posture—5.1.7.80
    • DUO—7.1.0.0

Known Issues:

(CSCwn39981)—Uninstalling VPN RPM packages in RHEL or SUS causes a black screen because the current user GUI/CLI login session gets terminated. Refer to the release note enclosure in the bug ID for a workaround.

(CSCwn72336)—ZTA Flow counts not updating when QUIC is enabled

(CSCwn92376)—ZTA stepup auth not prompting when QUIC is enabled

(CSCwn92381)—ZTA proxy alerts not being shown in UI when QUIC is enabled

Cisco Secure Client 5.1.7.80 Bugs

The Cisco Bug Search Tool has detailed information about the following open and resolved caveats in this release. A Cisco account is required to access the Bug Search Tool. If you do not have one, register at https://Cisco.com.

Resolved

Identifier Component Headline
CSCwj04407 core VPN profile not found when "https://" is used in HostName or HostAddress profile fields
CSCwm17973 core When reconnecting, VPN is not considering switching IP protocols to contact IPv4+IPv6 ASA
CSCwm33282 core Secure Client unable to connect with Linux Kernel 6.9
CSCwm42192 core Cisco Secure Client sends encrypted traffic over Virtual Adapter
CSCwm67479 download_install Cisco Secure Client Windows ARM64 pre-deploy package is missing ZTA module
CSCwh29444 nam NAM sets adapter state to attached when initialization of the OS WLAN API fails
CSCwk17491 nam NAM client may send MACsec packets out of order when throughput is high
CSCwm05134 nam NAM does not work on Windows 11 24H2 without location permission for desktop apps enabled
CSCwm73916 nam NAM group management cipher 0 not supported
CSCwk21228 nvm macOS: VPN throughput significantly impacted with NVM flow collection active
CSCwk30374 nvm Support for Tamper Protection for NVM-XDR on Windows
CSCwm44074 nvm Support for reporting Process Tree Hierarchy for the flows reported by NVM
CSCwm60665 nvm mTLS connection fails when there is no matching criteria configured
CSCwm78358 nvm NVM agent needs to re-resolve the collector name upon handling KDF disruptions
CSCwm83412 nvm NVM: acnvm crash seen on macOS 15.0 platform
CSCwm42511 opswat-ise Need support for Firefox 130.x in ISE
CSCwh05294 posture-ise Osquery Library to execute osqueries
CSCwi65268 posture-ise ISE Posture - DISA Reporting
CSCwm45685 posture-ise Application install check fails once after compliance module change on macOS
CSCwm80714 posture-ise ISE Posture discovery fails on Windows 11 24H2 without location permission for desktop apps enabled
CSCwm26644 swg Move to HTTP/1.1 from HTTP/1.0
CSCwm60952 swg Set the SNI field when connecting to a customer trusted server
CSCwm92420 swg Redirect rules were set during SWG backoff
CSCwm90933 umbrella Secure Access text changes for SSE
CSCwm66922 vpn Proxy settings are not being restored when system resumes from sleep
Loading

v5.1.6.103

v5.1.6.103

Choose a tag to compare

View all tags
@NeroDOC NeroDOC released this 12 Oct 08:05
v5.1.6.103
5a10739
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Cisco Secure Client 5.1.6.103 New Features

This release includes the following features and support updates, and resolves the defects described in Cisco Secure Client 5.1.6.103:

  • Support for macOS 15 (Sequoia). Subsequently, we will drop support for macOS 12 (Monterey). The following known issues exist for running Secure Client on macOS 15:

    • Network Visibility Module: CSCwm50168—Remote username is not reported in logged in user field
    • Network Visibility Module: CSCwm50228—macOS 15 Different Process Name and Parent Process Name are reported for NVM + SWG
    • OPSWAT-ISE: CSCwm12254—macOS 15 Beta: Gatekeeper built-in Firewall 15.x enable remediation functionality not working

  • CSCwm31250—The Windows GUI has a new General tab in the Advanced Window for non-module-specific configurations. Because of the additional General tab and its settings, the Advanced window will always be fully extended. This General tab includes a Settings tab and a Web Browser tab. The Settings tab duplicates our current system menu option to toggle user notifications. Click Show Notifications to enable the UI capability. Within the new Web Browser tab, you can click Clear Data to clear the client's WebView2 browser cache.

  • CSCwj04530—We added an enhancement to the macOS Secure Client Web Browser application to disable the use of System Proxy settings when accessing the Captive Portal through the client's embedded browser. This enhancement prevents potential issues with system proxy settings during the Captive Portal authentication process, for those clients running on macOS 14 (and later). Other client embedded browser authentication flows such as SAML are not impacted, as they will continue to use the system proxy settings.

  • We have provided a different way to match certificates in the Profile Editor Certificate Match panel and include additional filtering of the Template Name and Template Information certificate fields. To minimize the number of certificates sent to the Secure Firewall ASA, you can provide a certificate Template Identifier. Refer to Cisco Secure Client Profile Editor, Certificate Matching for additional information.

  • mDTLS for Network Visibility Module—Allows you to send data securely to the Network Visibility Module Collector. With mDTLS, the Collector can also verify the Network Visibility Module Client's identity before the connection is established and data is received. Refer to Network Visibility Module Profile Editor for additional information. The new feature has the following known issues:

    • CSCwm48552—NVM: Observed exporter is disabled and flows are not getting collected in mTLS setup
    • CSCwm53109—mTLS/DTLS is not working when using CA signed intermediate certificates for collector
    • CSCwm60665—mTLS connection fails when there is no matching criteria configured

  • Release 5.1.6.103 contains the following versions for the various modules:

    • Zero Trust Access—5.1.6.6896
    • Secure Client UI—5.1.6.1307
    • AnyConnect VPN core—5.1.6.103
    • DART—5.1.6.103
    • Umbrella—5.1.6.103
    • SBL—5.1.6.103
    • Network Access Manager—5.1.6.103
    • Network Visibility Module—5.1.6.103
    • Secure Firewall Posture—5.1.6.103
    • ThousandEyes—1.206.0
    • ISE Posture—5.1.6.103

Cisco Secure Client 5.1.6.103 Bugs

The Cisco Bug Search Tool has detailed information about the following open and resolved caveats in this release. A Cisco account is required to access the Bug Search Tool. If you do not have one, register at https://Cisco.com.

Resolved

Identifier Component Headline
CSCvz45813 core ENH: Add a session ID to the AnyConnect logs in order to group series of related message exchanges
CSCwk81619 core Cisco Secure Client embedded browser pops-up certificate selection prompt on SAML-based connections
CSCwm13153 core When Windows display language set to simplified Chinese, CSC crashes
CSCwm41409 core ISE / 'Check null is not found' when saving posture application condition for Kaspersky AV 17.x
CSCwk20887 dart Dartcli execution or ISE Posture non-compliant state launches weird pop-ups if DUO app is missing
CSCwm03920 nam Switch to machine connection upon smart card removal after user logoff
CSCwm56150 nvm mDTLS (Mutual Authentication / Client Authentication for Network Visibility Module
CSCwk14000 opswat-ise Cisco Secure Client 5.1.2.42: Compliance Module 4.3.4015.8192 : Trellix endpoint security 10.7
CSCwk19232 opswat-ise Compliance Module 4.3.4015.8192 cannot detect Trellix Endpoint Security version 10.7.0
CSCwk45967 opswat-ise Antimalware checks are not working on SUSE 12.5
CSCwk49217 opswat-ise Latest Definition Date and Latest Definition Version fields blank for macOS
CSCwk74505 opswat-ise Need support for Windows Update Agent 1219.x in Patch Management posture condition
CSCwk73054 opswat-ise Sophos Endpoint Agent 2024 to be supported on AnyConnect Compliance Module
CSCwk86071 opswat-ise MAC Compliance module support for XProtect version 5270
CSCwk90709 opswat-ise SCCM check fails for standard users on Windows with CM 4.3.4114.8192
CSCwm35873 opswat-ise Win 11 24H2- ISE support to be added for Windows Update Agent (1308.2408)
CSCwk89143 posture-ise macOS 15: Secure Client ISE Agent crashes during gatekeeper built-in firewall remediation stage
CSCwk68967 swg SWG does not detect TND on every network change
CSCwm66026 umbrella Unprotected state when waking from sleep in certain circumstances
CSCwm54103 umbrella Umbrella cloud update does not work with macOS using build 5.1.5.65
CSCwm66038 umbrella SWG proxy URL to be intercepted by KDF in macOS (like Windows)
CSCwf94506 vpn Cert matching criteria "Certificate Template Information" unavailable causing authentication failures
CSCwj04530 vpn Captive Portal does not load in embedded browser on macOS in a specific scenario
CSCwj83190 vpn Cert matching criteria "Certificate Template Information" unavailable causing authentication failure
CSCwm11696 web Using client hints to differentiate between ARM and Intel packages during web-launch execution
CSCwk53066 ztna ZTA Module not intercepting all queries from Edge browser
Loading

v5.1.5.65

v5.1.5.65

Choose a tag to compare

View all tags
@NeroDOC NeroDOC released this 12 Oct 07:57
v5.1.5.65
5a10739
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Cisco Secure Client 5.1.5.65 New Features

This release includes the following features, and resolves the defects described in Cisco Secure Client 5.1.5.65:

  • Option to send DART bundle directly to TAC. Refer to Run DART to Gather Data for Troubleshooting for additional information.

  • Option to suppress connection retries after a connection failure or disconnection of a VPN session. The default is disabled; but when enabled, the client will stop periodic connection retries. Refer to Cisco Secure Client Profile Editor, Preferences (Part 2) for additional information.

  • Additional posture settings for EDR updates (CSCwj05606)—New ASDM UI setting in Configuration > Remote Access VPN > Posture (for Secure Firewall) > Posture Settings. When For EDR update, Skip Internet Check before VPN is active is enabled, the Endpoint Detection and Response (EDR) security software retrieves information from its respective server and performs posture assessment, without verifying if the security software is up-to-date. Refer to Cisco Secure Firewall ASA Series VPN ASDM Configuration Guide for additional information.

  • Release 5.1.5.65 contains the following versions for the various modules:

    • Zero Trust Access—5.1.5.6663
    • Secure Client UI—5.1.5.1171
    • AnyConnect VPN core—5.1.5.65
    • DART—5.1.5.65
    • Umbrella—5.1.5.65
    • SBL—5.1.5.65
    • Network Access Manager—5.1.5.65
    • Network Visibility Module—5.1.5.65
    • Secure Firewall Posture—5.1.5.65
    • ThousandEyes—1.200.1
    • ISE Posture—5.1.5.65

Known Issues:

  • CSCwi49003—Network Visibility Module is not reporting the Safari Browser Plugins for macOS
  • CSCwj80335—On macOS, SWG backoff for noNetwork doesn't change the state when IPv4 alone is enabled
  • CSCwm00171—On Mac M-series chip machine, TE is failing to install with CSC_5.1.5.58 build

Cisco Secure Client 5.1.5.65 Bugs

The Cisco Bug Search Tool has detailed information about the following open and resolved caveats in this release. A Cisco account is required to access the Bug Search Tool. If you do not have one, register at https://Cisco.com.

Resolved

Identifier Component Headline
CSCwd61331 core AnyConnect Always On AllowedHost using FQDN can result in connectivity failure
CSCwj60270 core Always-On: add support for suppressing connection retry
CSCwk69124 core Linux embedded browser stopped on 5xx and 4xx http response codes not allowing login
CSCwk89880 core Windows: TCP packet with multiple DNS response payloads causes BSOD, with Network Visibility Module or Umbrella SWG active
CSCuw86771 dart ENH: DART should provide option to upload .zip to service request
CSCwj50019 nam Transition mode for WPA2/WPA3 personal networks no longer allows selection of WPA3
CSCwk12016 nvm vpnagent tries to start another instance of Network Visibiliy Module agent when one is already running
CSCwk13032 nvm NVM XDR: DART is not collecting the NVM Bootstrap profile information in Network Visibility Module logs for macOS
CSCwk40536 nvm Sending browser plugins' data in Osquery data template
CSCwk45278 nvm Support for reporting of Zero Trust Access intercepted flows by Network Visibility Module
CSCwf74451 opswat-ise ISE Posture not accurately detecting FileVault state (On/Off) on M2 Macs
CSCwi79424 opswat-ise ISE 3.1 Posture Module failing to report definition date for Trellix Endpoint Security for Windows
CSCwj44776 opswat-ise macOS Sonoma 14.x with hard drives encrypted + FileVault are failing as disk posture condition
CSCwj50577 opswat-ise AnyConnect Compliance Module can't uninstall Mozilla Firefox
CSCwj55259 opswat-ise macOS needs support for XProtect version 2191.x
CSCwj96109 opswat-ise Windows Update Agent 1217.x is not available
CSCwk04245 opswat-ise Need support for Firefox 126.x in ISE
CSCwk27660 opswat-ise ISE: Latest Windows Update Agent version 1218.x is not visible in patch management posture condition
CSCwj77424 posture-ise Missing RTMGRP_LINK in netlink registration on Linux platform
CSCwj82165 posture-ise ENH: To add cURL debug logs
CSCwk21434 posture-ise ISE posture stuck when Trust Network Detection terminates a reconnecting VPN
CSCwk46435 posture-ise Custom Registry reporting capacity similar to application and hardware conditions
CSCwh00386 swg Browsing slowness is for 25 to 35 sec on macOS when Umbrella + PAC + AnyConnect VPN is running
CSCwj43288 swg On macOS, SWG back off for noNetwork doesn't change the change the state
CSCwh49588 vpn Cached certificate is used for authentication followed by SCEP enrollment
CSCwj40176 vpn Secure Client AlwaysONVPN with ConnectFailurePolicy "Open" does not detect VPN gateway reachability
CSCwj44873 vpn AnyConnect / Secure Client fails establishing IKEv2/IPsec VPN for first time post upgrade
CSCwk70323 vpn macOS: Agent crashes when connecting ios devices for debugging
CSCwj48775 ztna Add support for intercepting connect to IPv4-mapped IPv6
CSCwk08377 ztna ZTA client not intercepting access to FQDN resource with a superset FQDN rule also configured
Loading

v5.1.4.74

v5.1.4.74

Choose a tag to compare

View all tags
@NeroDOC NeroDOC released this 12 Oct 07:48
v5.1.4.74
5a10739
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Cisco Secure Client 5.1.4.74 New Features

This release includes the following features and support updates, and resolves the defects described in Cisco Secure Client 5.1.4.74:

  • Dual-Home Detection for Windows—Disables untrusted interfaces so that a multi-homed endpoint doesn't switch from a corporate network to a public network, leaking private corporate information. It requires enabling Secure Trusted Network Detection in the profile, which sends an HTTPS probe to the configured trusted servers as an additional check once trusted network is detected by the static DNS setting. Refer to Cisco Secure Client Profile Editor, Preferences (Part 2) for more details on the Disable interfaces without trusted server connectivity while in trusted network checkbox.

  • Support for WPA3 Enterprise GCMP256—However, WPA3 Enterprise GCMP256 networks require an Integrity Group Temporal Key (IGTK) for Protected Management Frames (PMF), and Network Access Manager is unable to set this using the OS Independent Hardware Vendor interface, as part of the WLAN component.

    You can disable the Network Access Manager setting of the PMF IGTK until a Windows fix becomes available. A Windows fix is available to set IGTK keys. Some older network drivers do not provide support for IGTK GMAC256.

    The IGTK fix is available in the following Windows releases:

    • Windows 10 22H2 KB5036979 OS Build 19045.4355
    • Windows 11 22H2 KB5036980 OS Build 22621.3527
    • Windows 11 23H2 KB5036980 OS Build 22631.3527
    • Windows 11 21H2 KB5037770 OS Build 22000.2960

    WPA3 Enterprise AES networks require setting the IGTK using CMAC128 keys. WPA3 Enterprise GCMP256 networks typically require setting the IGTK using GMAC256 keys.

    The setting of the PMF IGTK can be disabled to allow a connection to a network configured to provide Protection of Management Frames (PMF). If the Windows fix is not yet available, and you can't avoid connecting to a network with PMF enabled, you need to modify the Windows registry editor by adding the following registry key as a DWORD and setting it as described to disable the use of IGTK by the Network Access Manager:

    HKEY_LOCAL_MACHINE\SOFTWARE\Cisco\Cisco Secure Client Network Access Manager\DisableIGTK set to 1

    Note

    This IGTK fix only applies to WPA2/WPA3 Enterprise networks. It does not apply to WPA3 Personal (SAE) or WPA3 Open (OWE). We strongly discourage against disabling the PMF IGTK unless necessary as it provides protection of wireless management frames. Also, Network Access Manager currently supports only the following ciphers for the PMF IGTK:

    CMAC128—which requires the OS fix

    GMAC256—which requires the OS fix

  • Cisco Secure Client Cloud Management 1.0.3.433 now supports deployment for macOS. To get started, install the XDR Default Deployment for macOS on your macOS devices or create new macOS deployments by clicking Create New on the Deployments page. Client Management documentation is available here.

  • ZTA supports interoperability with Network Visibility Module.

  • This Secure Client release coincides with Network Visibility Module Collector release 5.1.4.67.

  • Release 5.1.4.74 contains the following versions for the various modules:

    • Zero Trust Access—5.1.4.6433
    • Secure Client UI—5.1.4.1158
    • AnyConnect VPN core—5.1.4.74
    • DART—5.1.4.74
    • Umbrella—5.1.4.74
    • SBL—5.1.4.74
    • Network Access Manager—5.1.4.74
    • Network Visibility Module—5.1.4.74
    • Secure Firewall Posture—5.1.4.74
    • ThousandEyes—1.195.0
    • ISE Posture—5.1.4.74

Known Issue: CSCwk42371—ZTA/Mac: non-US time format not shown correctly in Config Sync and Statistics UI

Cisco Secure Client 5.1.4.74 Bugs

The Cisco Bug Search Tool has detailed information about the following open and resolved caveats in this release. A Cisco account is required to access the Bug Search Tool. If you do not have one, register at https://Cisco.com.

Resolved

Identifier Component Headline
CSCwe48679 core KDF DNS caching should support DNS requests over TCP
CSCwh56499 core ENH: Allow the secure client to use a different language other than the local language of the device
CSCwi18018 core Vulnerabilities in openssl 1.0.2q
CSCwi18072 core Vulnerabilities in openssl 1.1.1n CVE-2023-4807 and others
CSCwi19138 core Vulnerabilities in sqlite 3.35.5 CVE-2022-35737
CSCwi37591 core Windows: SAML auth fails due to embedded browser control failure to set focus
CSCwi58881 core Vulnerabilities in curl 7.64.0 CVE-2023-46218
CSCwi65764 core Vulnerabilities in sqlite 3.1.1 CVE-2023-7104
CSCwi65779 core Vulnerabilities in openssl 1.1.10 CVE-2023-5678
CSCwi66029 core Vulnerabilities in curl - multiple versions CVE-2023-46219
CSCwj14505 core Secure Endpoint "start" button display as Record in Japanese language
CSCwj19626 core The VPN client is unable to configure private-side proxy settings
CSCwj58395 core TNDv6 when moving to trusted: client spends long time reconnecting instead of applying TND policy
CSCwj58541 core TND policy not applied with dual stack setup when profile host only resolvable to IPv6 address
CSCwj59856 core macOS: Local LAN target not reachable after TND VPN disconnect
CSCwj83051 core libwebkit2gtk-4.0 dependency causing embedded browser launch failure on Ubuntu 24.04
CSCwj83839 core csc_zta_agent crashes when a private resource is being accessed after ZTA client cert is revoked
CSCwh29307 gui CSC UI crashing during upgrade from headend due to toolbar PNG corruption
CSCwj34889 gui Linux Secure Client GUI hangs when selecting or disconnecting SAML based tunnel group
CSCwj43486 gui macOS CSC GUI app auto start not working reliably with 5.1.x
CSCwh37673 nam Add NAM support for WPA3 GCMP256
CSCwj77457 nam NAM cannot connect when PMF is optional and NIC does not support PMF
CSCwj80126 nvm Day0: NVM installation is failing with latest kernel on ubuntu24.04
CSCwj81971 nvm Network Visibility Module installation fails on latest Ubuntu22.04.4
CSCwk03480 nvm HTTP host additionally capture HTTP method and target URL
CSCwk12148 nvm Added support for link local flows
CSCwj53538 posture-ise ISE Posture should handle space in Call Home List
CSCwj92612 posture-ise Service unavailable: ISE Posture not working on non-English Windows OS + 5.1.3.62
CSCwk46435 posture-ise Custom Registry reporting capability similar to application and hardware conditions
CSCwk09260 umbrella punycode "xn--" found in mergelocaldomains file causing problems doing local domain resolution
CSCwe06920 vpn Proxy cannot be changed by macOS users while using "do not modify" proxy setting
CSCwj48522 vpn Cisco Secure Client for Windows Privilege Escalation Vulnerability
CSCwj88732 vpn macOS: VPN connect fails when multiple split include networks match a local subnet
CSCwj68515 ztna ZTA client not accepting configuration with underscore character in domain rule
CSCwj68647 ztna Windows: ZTA client unable to intercept SMB flows initiated by name
CSCwk06167 ztna Windows: ZTA service initialization fails with large number of NICs
Loading

v5.1.3.62

v5.1.3.62

Choose a tag to compare

View all tags
@NeroDOC NeroDOC released this 12 Oct 07:45
v5.1.3.62
5a10739
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Cisco Secure Client 5.1.3.62 New Features

This release includes the following features and support updates, and resolves the defects described in Cisco Secure Client 5.1.3.62.

  • macOS 11 is no longer supported.

  • This 5.1.3.62 release will not support Ubuntu 24.04 LTS.

  • Umbrella added support for FedRAMP in Secure Web Gateway (SWG) and Domain Name System (DNS) clients.

  • Bypass Default Localization —a new preference in AnyConnect Local Policy file allows you to disable the default localization files embedded within the client.

  • The Microsoft issue that was preventing the connections to networks with PMF enabled has been corrected and verified. As a result of the Windows update, the implementation to disable the setting of PMF IGTK within Network Access Manager or to modify the Windows registry is no longer necessary in the fixed versions of Windows, listed below. The Microsoft IGTK fix for WPA2/WPA3 Enterprise networks has been addressed for Windows 10 22H2 KB5036979, Windows 11 22H2 KB5036980, and Windows 11 23H2 KB5036980. Microsoft estimates that the fix for Windows 11 21H2 will be available in May 2024.

  • Additional client details are now visible in the Zero Trust Access Module UI

  • Release 5.1.3.62 contains the following versions for the various modules:

    • Zero Trust Access—5.1.3.6177
    • Secure Client UI—5.1.3.1110
    • AnyConnect VPN core—5.1.3.62
    • DART—5.1.3.62
    • Umbrella—5.1.3.62
    • SBL—5.1.3.62
    • Network Access Manager—5.1.3.62
    • Network Visibility Module—5.1.3.62
    • Secure Firewall Posture—5.1.3.62
    • ThousandEyes—1.189.1
    • ISE Posture—5.1.3.62

  • Known Issues:

    • CSCwj92612—Service Unavailable: ISE Posture predeploy and NSA web deploy are broken on Windows 10 and 11 for non-English OSs when upgrading to Secure Client 5.1.3.62. To use ISE Posture without interruption, do not upgrade to Secure Client 5.1.3.62 until a fix is announced.
    • CSCwi98914—USB cases are working as expected still system scan is giving non-compliant on Windows 10
    • CSCwj81971—Network Visibility Module installation fails on Ubuntu 22.04.4

Cisco Secure Client 5.1.3.62 Bugs

The Cisco Bug Search Tool has detailed information about the following open and resolved caveats in this release. A Cisco account is required to access the Bug Search Tool. If you do not have one, register at https://Cisco.com.

Resolved

Identifier Component Headline
CSCwh36395 core Output of "vpncli.exe stats" doesn't give info of "notice: Connected to IP/FQDN"
CSCwh56499 core ENH: Allow the Secure Client to use a different language other than the local language of the device
CSCwi37591 core Windows: SAML auth fails due to embedded browser control failure to set focus
CSCwi66032 core Vulnerabilities in libressl 3.4.2 CVE-2023-35784
CSCwi66040 core Vulnerabilities in zlib 1.3 CVE-2023-45853
CSCwi69374 core macOS: captive portal remediation not possible via AnyConnect browser with PAC file proxy settings
CSCwi69388 core macOS: AnyConnect browser used only intermittently for captive portal remediation
CSCwi72260 core macOS: "Too many open files" failures logged, VPN connections failing after a while
CSCwi75848 core Client Profile Editor cannot be loaded when using the Cisco Secure Client image 5.1
CSCwi95666 core macOS: VPN Agent unable to start when installing CSC 5.1 without a user logged in locally
CSCwj09644 core Secure Client management tunnel fails to connect with socket error
CSCvu57988 dart ENH: DART should include a copy of the windows registry in the support bundle
CSCvy66557 dart ENH: DART for Windows should include the Device ID
CSCwe59992 download_install SUSE 15.5: Vpndownloader is not working through web-deployment via ISE
CSCwi27071 gui Secure Client 5 GUI.ico customization failure
CSCwj43486 gui macOS CSC GUI app auto start not working reliably with 5.1.x
CSCwj85414 nam Network Access Manager loses connection if a smartcard certificate is used and ISE is not properly configured
CSCwh82810 nvm Start and intermediate flows are not reporting in Linux
CSCwi17719 nvm Vulnerabilities in grpc - multiple versions
CSCwi17729 nvm Vulnerabilities in c-ares - multiple versions
CSCwi49003 nvm NVM is not reporting the Safari Browser Plugins for macOS
CSCwj27599 nvm CLI proxy support for NVM XDR on Windows
CSCwh57757 opswat-ise ENH: Support for IBM BigFix Client 11.x for macOS
CSCwh82964 opswat-ise ENH: ISE Posture support for Heimdal Thor Agent 3.x
CSCwi96966 opswat-ise Installation check failure for Trellix Endpoint Security for Linux Threat Prevention
CSCwj05825 opswat-ise ISE Posture is not detecting Kaspersky Endpoint Security 11.x with CM 4.3.3765.8192
CSCwh96305 posture-ise ISE Posture intermittently throws "internal system error"
CSCwj02135 posture-ise [wireless] ISEposture goes to Service Unavailable on SUSE clients
CSCwb40977 swg Decoupling SWG from URC
CSCwj24659 umbrella File and Product version for UmbrellaDiagnostic application needs to be updated
CSCwf21427 vpn Management tunnel connection fails if user tunnel profile has Always On enabled with FQDN exceptions
CSCwf98780 vpn macOS: Xcode 15 device discovery not working with IPv6 tunnel-all VPN
CSCwi70170 vpn AnyConnect on Linux: VPN cannot be established after updating libxml2 to version 2.12
CSCwj48522 vpn Cisco Secure client CODE EXECUTION IN CISCO SECURE CLIENT WITH NAM
Loading

v5.1.2.42

v5.1.2.42

Choose a tag to compare

View all tags
@NeroDOC NeroDOC released this 12 Oct 07:42
v5.1.2.42
5a10739
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Cisco Secure Client 5.1.2.42 New Features

This release includes the following features and support updates, and resolves the defects described in Cisco Secure Client 5.1.2.42.

  • (CSCwh29292) Dynamic split tunneling can now perform both dynamic exclusion from a tunnel and dynamic inclusion into a tunnel for a given configuration, as needed. For example, with enhanced dynamic split exclude tunneling, traffic matching a dynamic include domain may be dynamically included into a tunnel, if necessary to override a static split exclude network. Refer to About Dynamic Split Tunneling in the Cisco Secure Client (including AnyConnect) Administrator Guide, Release 5 for additional details.

  • In the profile editor, wildcards can now be added at the beginning or end of the Host Address in Load Balancing Server List.

  • We have implemented a Network Access Manager addition to disable the setting of PMF IGTK until a Windows fix becomes available. Microsoft estimates that fixes for Windows 10 22H2 and Windows 11 21H2 (and later) should be available in the first half of calendar year 2024, which will allow you to set the IGTK from the Network Access Manager. Until then, you can disable the setting of PMF IGTK and allow a connection to a network configured to provide Protection of Management Frames (PMF). If the Windows fix is not yet available, and you can't avoid connecting to a network with PMF enabled, you need to modify the Windows registry editor by adding the following registry key as a DWORD and setting it as described to disable the use of IGTK by the Network Access Manager:

    HKEY_LOCAL_MACHINE\SOFTWARE\Cisco\Cisco Secure Client Network Access Manager\DisableIGTK set to 1

    Note

    This IGTK fix only applies to WPA2/WPA3 Enterprise networks. It does not apply to WPA3 Personal (SAE) or WPA3 Open (OWE). We strongly discourage against disabling the PMF IGTK unless necessary as it provides protection of wireless management frames.

  • You must have the appropriate AnyConnect VPN version (5.1.2.42) to interoperate with the Zero Trust Access Module (5.1.2.5191).

  • Windows 10 ARM64 is no longer supported.

Cisco Secure Client 5.1.2.42 Bugs

The Cisco Bug Search Tool has detailed information about the following open and resolved caveats in this release. A Cisco account is required to access the Bug Search Tool. If you do not have one, register at https://Cisco.com.

Resolved

Identifier Component Headline
CSCwf21453 core RetainVpnOnLogoff errors when attempting to validate proxy settings
CSCwh73937 core ENH: macOS AnyConnect to support Dynamic Split Exclusions based on CNAME DNS responses
CSCwi07144 core Vulnerabilities in zlib - multiple versions
CSCwi78167 core Wildcard support to load balancing servers for AO configuration
CSCwi27062 nam NAM unable to connect to Eero mesh APs
CSCwi27137 nam NAM does not recognize default PMF IGTK cipher
CSCwi38780 nam NAM does not complete connection for fast transition wireless network with PMF enabled
CSCwi48979 nvm NVM HTTP Host support for macOS client
CSCwi49003 nvm NVM is not reporting the Safari Browser Plugins for macOS
CSCwi50185 posture-ise ISE Posture: PSN discovery failure
CSCwh29292 vpn ENH: Allow DSI and DSE configuration together along with static split exclude
CSCwi17408 vpn ENH: Allow bypassing proxy access hardening for split tunneling via group policy setting
CSCwi33431 vpn Multiple ZTA versions show as installed after predeploy/webdeploy upgrades
Loading