Thycotic incident

Platform: PRA Remote Application Session Disconnecting

Notice Resolved View vendor source →

Thycotic experienced a notice incident on October 13, 2026, lasting 1d 6h. The incident has been resolved; the full update timeline is below.

Started
Oct 13, 2026, 01:13 PM UTC
Resolved
Oct 14, 2026, 07:28 PM UTC
Duration
1d 6h
Detected by Pingoru
Oct 13, 2026, 01:13 PM UTC

Update timeline

  1. resolved Oct 15, 2026, 08:30 AM UTC

    At approximately 9:13 PM UTC on October 13, 2026, some customers experienced premature disconnections when launching PRA Remote Application sessions. The sessions terminated after approximately 2–3 minutes. Root Cause: A recent update to the FreeRDP library introduced a regression bug that omitted the RAIL (Remote Applications Integrated Locally) client handshake during Remote Application sessions. Without this handshake, the target host treated the session as inactive and terminated it after the configured idle timeout. Resolution: The PRA engine was patched to restore the RAIL client handshake for Remote Application connections. The fix was deployed and connectivity was restored for affected customers by approximately 12:34 PM UTC on October 14, 2026. Affected Components: Platform: Privileged Remote Access - US, APAC (Singapore) and AU Backfill Notice: This incident was added to our status page retrospectively to provide an accurate record of service impact. More information on backfill incidents is available here.

  2. postmortem Oct 20, 2026, 11:36 PM UTC

    ## Incident Overview A subset of customers using Privileged Remote Access \(PRA\) Remote Application sessions experienced session disconnections approximately 2 to 3 minutes after launch. Reports were received from customers across the SEA, AU, UAE, CA, UK, and US regions. * **Start:** October 13, 2026, 21:13 UTC * **End:** October 14, 2026, 19:28 UTC ## Root Cause and Remediation A scheduled update was rolled out regionally to our remote session service as part of ongoing security compliance work. This update included a new version of a third-party remote desktop protocol component, which introduced a behavioral change that prevented a specific connection handshake from completing during session initialization. As a result, affected sessions were automatically logged off for approximately 2–3 minutes after connecting successfully. Because these disconnections completed cleanly, without generating errors in system logs or traces, the issue was not detected by existing monitoring systems before the first customer report on October 13, 2026. A fix to restore the required connection handshake was identified and deployed across all affected regions by approximately 19:28 UTC on October 14, 2026. ## Preventative Actions * Expand our automated Remote Application test coverage to include extended duration sessions, so time-dependent issues are caught before release. * Add monitoring for session duration anomalies, specifically tracking sessions that disconnect at consistent short intervals \(e.g., ~2 to 3 minutes\), even when the disconnection appears clean. We sincerely apologize for the disruption this caused and appreciate your patience while we worked to resolve it.