Fixed Issues
The following issues were fixed or resolved in this release.
Table: Fixed issues in 11.8 release
Issue number | Description |
|---|---|
SC-71970 | Updated the collection window start time to fix the issue that caused reports to miss details of jobs created at the hour boundary. |
SC-73821 | Fixed the DTD reports "time period" issue that showed the report scope date and time range details based on the time zone of the server with the latest collected client job instead of picking the actual time zone of selected backup server from scope selection. The report now populates correct date and time ranges in matching with the "time period" range scope inputs by considering individual time zones of the respective backup servers when selected as single backup server from report scope. |
SC-74927 | Fixed the Azure billing probe issue, where the API was failing. |
SC-75180 | Apache HTTP server 2.4.66 is built with OpenSSL 3.0.19 which makes CVE-2025-15467 non-exploitable. |
SC-73640 | Upgraded Logback to version 1.5.25, which makes CVE-2025-11226 and CVE-2026-1225 non-exploitable. |
SC-74923 | Fixed the issue that displayed miscalculated file share data for Azure Storage account probe. |
SC-73674 | Upgraded Spring Framework to 6.2.15, which makes CVE-2025-41254 non-exploitable. |
SC-75152 | Resolved database error APT-DB-107192 (library is invalid) reported by HPDP Session probe data collection that is caused by incorrect parsing of library names containing multiple colons. |
SC-73842 | Fixed the issue with Veeam Backup and Replication policy that prevented identification of the restored device due to incorrect reporting in client name. |
SC-73884 | Fixed the issue causing error while upgrading IT Analytics from 11.6 and 11.7. The error caused by PowerStore connector deployment failure is addressed through correction in constraint definitions in the schema file of its table. |
SC-74466 | Resolved an issue where exporting large reports in Excel either failed or resulted in incomplete output. The export process is improvised to ensure successful export of reports with large volumes of data in Excel format. |
SC-67924 | Upgraded LZ4 to version 1.10.2, which makes CVE-2025-66566 and CVE-2025-12183 non-exploitable. |
SC-75254 | Fixed the issue where the Apache service failed to start due to hard-coded User and Group values (apache) in |
SC-75504 | Fixed the issue where the aptare_agent service was not enabled at boot on SUSE 15 due to improper registration of the SysV init script. The fix registers the init script using insserv, reloads systemd, and enables the service to ensure it starts automatically at system boot. |
SC-74528 | Fixed the issue causing some portal installations with the VENDORJOBID column missing in two Cohesity DataProtect tables and views. |
SC-75675 | Fixed an Apache upgrade issue where SSL certificates were not copied when IT Analytics was installed in a mixed‑ or uppercase path on Linux. The fix preserves case sensitivity in certificate path handling, ensuring certificates are correctly copied and Apache starts successfully after upgrade. |
SC-75978 | Updated Job Summary report to return unique rows to prevent duplicate rows from being displayed. |
SC-75505 | Resolved missing environment values in the DataProtect Active Snapshots By Object report that caused incorrect or broken drilldowns.The query was corrected to join on policy_id and vendor identifiers instead of names, ensuring consistent data population and accurate drilldown results. |
SC-73464 | Resolved issue with NetBackup Audit Report and drilldown report NetBackup Audit Report Details to ensure Changed Attributes count is matching in both reports |
SC-75489 | Fixed an issue where backup forecasting and capacity planning reports displayed inconsistent Total values on mouse-over when using TBytes: the value passed to ByteSizeFormatter is now converted using the correct database input unit, ensuring numeric values and unit labels remain consistent across chart bars and hover details. |
SC-75805 | Resolved the issue where the file-level compression probe was failing with a NullPointerException, caused by null values in optional fields (such as LocalComp) during KB conversion. |
SC-74528 | Fixed an issue where the VendorJobId column was missing from the SDK_CHDP_ARCHIVALDATA and SDK_CHDP_REPLICATIONDATA tables in certain upgraded environments. The upgrade process now adds the missing column and required indexes via upgrade_database.sql when upgrading from older IT Analytics versions, ensuring schema consistency across releases. |
SC-75673 | Fixed an issue in the NetBackup Backup Policy probe where Oracle database instances were missing when a single policy included instances from multiple clients. The client-matching logic was corrected to avoid false matches on empty IP addresses, ensuring all Oracle instances across different client hostnames are correctly recorded and persisted. |
SC-75993 | Fixed a data persistence failure caused by the TIMEZONE column in SDK_DEPS_SNAPSHOT_RULE_INSTANCE being too small to store larger timezone values. The column size has been increased to prevent persistence errors and ensure successful snapshot rule data storage. |
SC-75246 | Fixed an issue where Performance APIs collected data at very fine granularity (5‑second and 20‑second intervals), generating excessively large datasets that caused report and chart failures. The data collection granularity has been updated to 5‑minute intervals, improving report performance, system stability, and user experience. |
SC-75247 | Fixed an issue where the data reduction ratio was persisted as an integer, resulting in inaccurate values in dashboards and reports. The collector now stores the data reduction ratio using a decimal data type, ensuring accurate reporting and trend analysis. |
SC-74564 | Fixed an intermittent DataReceiver persistence failure in Kerberos-authenticated environments where UCP connection pools were recreated based on credential field updated in data-receiver property file. This led to invalid pool lifecycle state (UCP‑45060) and "Failed to get a connection" (UCP‑29) errors. Recreation of connection pool on credential change is now limited to non‑Kerberos mode. |
SC-75290 | Fixed an issue on Windows where reinstallTomcatService.bat utility stopped execution prematurely and failed to reinstall the Agent Tomcat service. The script now uses CALL when invoking other batch files, ensuring control returns correctly and both Portal and Agent Tomcat services are fully reinstalled. |
SC-74684 | Reduced database TEMP usage during data collection by changing how large text (CLOB) fields are saved. The receiver no longer creates temporary LOBs for each value; it binds CLOB data directly (Oracle: string-based CLOB bind with support for pooled statements; other databases: character stream bind), which helps avoid ORA-01652 / TEMP exhaustion under heavy PPDM-style loads. |
SC-76065 | Fixed incorrect policy names for Cohesity DataProtect (product 200900) where numeric identifiers were shown instead of policy/protection group names in related reports. Updated the decode logic to correctly replace identifiers with the proper policy name when valid name data is received, ensuring reports now display the expected policy names. |
SC-75950 | Fixed incorrect Swagger/OpenAPI media type profiles that referenced the external domain ita.com. Updated all API YAML spec files to use the correct cohesity.com domain in the JSON:API Content-Type profile, ensuring accurate and non-misleading API documentation and responses. |
SC-75968 | Fixed NetWorker onboarding failures in large environments caused by excessive REST API payloads from the /global/volumes endpoint. Updated the collector to use field filtering (fl= parameter) to fetch only required volume fields, significantly reducing response size and preventing probe termination during SaveBackup and SaveStorageResource phases. |
SC-75993 | Fixed data persistence failures caused by oversized TIMEZONE values in the SDK table. Increased the column size to accommodate larger timezone data, preventing insert errors and ensuring successful persistence during connector operations. |
SC-75942 | Updated database view aps_v_hnas_virtual_volume to prevent divide by zero error. |
SC-75563 | All Jetty jar versions have been upgraded to 12.1.7, including the version bundled with Data Collector and the Jetty libraries coming from Kafka dependencies. This addresses CVE-2025-5115, CVE-2026-1605, and CVE-2025-11143 vulnerabilities. |
SC-76100 | Realtime log collection failures after upgrade have been fixed by addressing incorrect ownership/permissions on the realtime logs directory. The issue caused "Exception while writing realtime logs" errors due to permission denied when Tomcat attempted to create log files, impacting realtime logs on the policy screen. |
SC-77701 | Resolved the problem that generated unexpected dump files during an automated uninstall by stabilizing the shutdown and exit flow. |
SC-77747 | An issue where hosts in the "All Backup Servers" scope selector were not displayed in alphabetical order when Authorization Attributes (Authz) were enabled has been fixed. The UI now preserves the original sorted order by using an order preserving map during Authz-based filtering, ensuring consistent alphabetical sorting regardless of Authz configuration. |
SC-76110 | An issue where the EMC Avamar Activity Details probe missed the most recent hour of backup data due to incorrect timezone and DST handling has been fixed. The probe now correctly converts timestamps using DST aware timezone offsets, ensuring recent Avamar activity data is fully collected across timezone differences. |
SC-77758 | Fixed an issue in NetBackup Data Collector where CLOB-heavy asset persistence (APT_NBU_ASSET.ASSET_DETAIL) caused excessive TEMP usage due to temporary LOB allocation. The Data Collector persistence logic was updated to free the temporary CLOB space and reducing temporary LOB pressure under load without impacting asset ingest or consumers. |
SC-76120 | Upgraded the Spring Framework to 6.2.15, which makes the following vulnerabilities non-exploitable:
|
SC-76369 | Upgraded Spring Boot and their dependences to 3.5.13, which makes the following vulnerabilities non-exploitable:
|
SC-76370 | Upgraded the Spring Security which makes the following vulnerabilities non-exploitable:
|
SC-75001 | Upgraded Log4j to 2.25.4, which makes the following non-exploitable:
|
SC-75804 | Fixed a parsing failure in the MessageLogsProbe for Alta View customers caused by a StringIndexOutOfBoundsException in the NetBackup parser when handling malformed or skipped filenames. The fix hardens the parsing logic to safely handle invalid bounds, ensuring data collection completes successfully without probe failure. |
SC-75856 | Fixed excessive stack trace logging during NetBackup jobs API requests when using older API versions, where certain job attribute serialization caused noisy logs despite successful (HTTP 200) responses. The resolution recommends updating the API client to use a newer jobs API version (v9.0 or higher, ideally v14.0 via the Accept header), which includes fixes to policy and schedule attributes and prevents the unnecessary stack traces. |
SC-73165 | Fixed an HTTP 500 error in the Cohesity DataProtect ProtectionDetails probe caused by a MissingPropertyException due to improper variable scoping of the REST API command. The fix ensures the command variable is correctly scoped across the logic block and adds warning logs to surface hook/API failures instead of silently ignoring them. |
SC-76121 | Upgraded vulnerable plexus-utils coming from Kafka to 3.6.1. |
SC-76134 | Fixed an issue where Mission Control Backup graphical data was not displayed in the API response. |
SC-76224 | Resolved the problem that prevented a scheduled task from running by updating its timing configuration to use valid future run times. |
SC-77902 | Fixed the issue related to NetBackup FETB data persistence, where MS-Windows policies were incorrectly mapped as MS-Windows-NT, causing ITA to report incorrect information. |
SC-71497 | An issue where Oracle purge jobs failed to delete Veritas Flex Appliance hosts - leaving orphaned SDK_VTFA_* records and impacting DXC reports - has been fixed. The fix introduces a new database procedure to explicitly remove SDK_VTFA-related entries by HostID before deleting the host from base tables, ensuring successful purging without constraint violations or database errors. |
SC-76073 | An issue where the Collection Status page appeared blank or showed incorrect data for multi-device policies has been fixed. The filtering logic has been corrected to use the unique collector identifier instead of a comma-separated policy name, ensuring probe statuses display correctly and only for devices associated with the selected policy. |
SC-76128 | An issue where the EMC Avamar Configuration Changes Probe failed with an Oracle unique constraint violation due to improper handling of NULL default values has been fixed. The probe logic now correctly updates existing dataset records with NULL defaults, preventing duplicate key errors and ensuring apt_avm_dataset_detail reflects the latest data without database errors. |
SC-78034 | Fixed a startup-blocking ORA-00932 ("inconsistent datatypes") error introduced after upgrading to Oracle 19.31, which prevented Tomcat-* services from starting due to failures in common_package.getNbrOfClients(). The fix updates affected stored procedures to ensure consistent datatype handling across CAST/SUBSTR expressions used in SET/CAST/COLLECT operations (including ORDER BY clauses), maintaining type safety for nested-table aggregation under stricter datatype enforcement of Oracle 19.31. |
SC-71991 | The end-to-end file upload library used for data collection is changed to ensure compliance and consistency with licenses and checks, which makes the CVE-2025-48976 vulnerability non-exploitable. |