Impex release information

Release Type: General

Release date: 2026-09-09

The IMPEX 6.2.0 release

This release centres on three things: USBProtect can now open archives that are nested inside other archives, the ICC supports Single Sign-On against your own identity provider, and installations whose self-signed CA certificate stopped being accepted in 5.9.0 repair themselves on upgrade.

The most important changes:

  • Nested archive extraction. USBProtect now extracts archives found inside other archives, and plain archives as well as encrypted ones. Anything found in an extracted file is traced back through every layer to the file that was on the medium, so a finding is always attributable to something the operator can see.
  • Single Sign-On for the ICC. Administrators can sign in with Microsoft Entra ID or Active Directory Federation Services instead of a local account.
  • Self-repairing self-signed CA certificates. Installations still using the CA certificate the ICC generated for itself before 5.9.0 lost trust between the ICC and the REPO, and Stations and DataLocks could no longer fetch configuration or upload scan results. Upgrading now repairs the certificate in place, keeping the existing key. No manual steps are needed.
  • A new Dashboard in the ICC. What was the Overview is now a Dashboard with a Health tab, gathering certificate and disk status in one place and warning ahead of a certificate expiring rather than after.
  • Wider audit logging. Fetching a Daily Station Token, and downloading or using a Network Edit or Disable UDEV bundle, are now recorded as audit events on both the ICC and the station.

ICC changes

  • ICC now supports Single Sign-On with Microsoft Entra ID and Active Directory Federation Service (ADFS). Please see the documentation for what needs to be in place on your IdP for it to work seamlessly.
  • ICC now parses the installed TLS certificates and adds all Subject Alt Names (SAN) and Common Name (CN) to the allowed hosts list. This makes it possible to have an internal hostname for the ICC server that is different from the name that people access it with.
  • We moved the “Run Tasks” option on the Station Detailed View from “Edit” mode to be shown by default.
  • We changed the Overview view to Dashboard and added a Health tab which shows the status of important parts, like certificate status for the ICC and REPO together with the disk status which we had earlier. This view shows warnings when certificates are approaching expiry.
  • Self-healing for self-signed CA certificates generated before 5.9.0. Only customers using the self-signed certificates the ICC generates automatically when no other certificate is present are affected. In 5.9.0 the updated Python subsystem started rejecting CA certificates that did not have a Key Usage extension, which meant older self-signed CA certificates were no longer trusted. This caused trust between the ICC and the REPO to stop verifying, and Stations and DataLocks could not fetch configuration or upload scan status to the ICC. By regenerating the CA certificate with the existing CA key, we add the missing CA attributes and get things running again. Note that this means you might need to trust the ICC cert again in your browsers.
  • Downloading the Daily Station Token, Network Edit and Disable UDEV Signify bundles now generates an audit log entry.
  • Fixed a bug where the same file extracted from two different archives was not seen as unique and was rejected by the ICC.
  • The lists of file filter rules, device filter rules, filter sets and network scan keys are now given a sort order before they are paginated. Without one the database was free to return rows in any order, so an entry could appear twice on one page and be missing from another.
  • The Add File Filter Rule dialog now pre-populates the Set it was opened from. If the Add File Filter Rule is opened on a quarantined file it will pre-populate the Set with the active Set the station uses where the file was quarantined from.
  • The username echoed back on the login page after a failed sign in is now quoted correctly.

Repo changes

  • Self-healing for self-signed CA certificates generated before 5.9.0. See the explanation under the ICC changes section for more details.

USBProtect changes

  • Added support for extracting plain archive files from the file browser. This is done in much the same way as for encrypted archives. Most of the scan engines will scan plain archives regardless of whether they are extracted or not, so this is not a necessary step, but it helps with traceability and with Yara.
    • Supports most archive formats and files that are archives under the hood: zip, 7z, tar.gz, pkg, rpm, docx, odt, msi, etc.
  • Added support for extracting nested archives, both plain and encrypted.
  • Replaced time keeping services written in Python/Perl with a new version written in Go. This simplifies and modernizes the time keeping on the stations. We also locked it down and sandboxed it with Landlock.
  • When the Hide Network option was set, the Network Status modal incorrectly claimed the gateway was unreachable. Fixed.
  • Using the Daily Station Token, and using the Network Edit and Disable UDEV Signify bundles, now generates an audit log entry.
  • Hardened archive extraction. 7za is now run with wildcard matching and symbolic link following turned off, and it is no longer given an output path it could expand, so a crafted archive cannot influence where its contents are written.
  • Paths given to the storage daemon are now checked for symbolic links in every directory component, so a link cannot redirect an operation out of the areas it is confined to.
  • Quarantining a file with a very long name could fail, because the length was checked against the limit for a whole path when the limit that applies to a single filename is shorter. Such files now fall back to being named after their checksum, as was intended.
  • Receipts now escape every character before they are typeset, so an unusual filename cannot disturb the printed result.
  • Fixed the height of the station configuration selector.

XTransfer changes

  • Files whose names hold characters an SMB server cannot store no longer fail the upload. Those characters, along with control characters and trailing spaces and dots, are encoded before the file is sent. The encoding is reversible, so the original name can still be recovered.

DataLock changes

  • The DataLock scan driver was rewritten in Go to allow code to be shared with the USBProtect product.
  • DataLock now has a customer manual of its own.
  • Receipts now escape every character before they are typeset, so an unusual filename cannot disturb the printed result.
  • Quarantining a file with a very long name could fail, because the length was checked against the limit for a whole path when the limit that applies to a single filename is shorter. Such files now fall back to being named after their checksum, as was intended.
  • The Impex version was left unset on scan reports uploaded to the ICC from 6.0.0 onwards. This release sets it, and fills it in on earlier scans that are missing it.
  • If rendering a PDF fails, a placeholder text file is written in its place, so the rest of the scanned files are still forwarded rather than the transfer stalling.
  • Handing an upload to impex-outgoing no longer follows symbolic links.

Antivirus Engines

  • The update definition scripts on the endpoints got several fixes for handling hiccups in updates like missing Last-Modified headers, network issues and logging of sensitive data.

Documentation changes

  • Updated screenshots where functionality changed in the ICC manual.
  • Added information to the ICC manual on DataLock Server Host Key Policy, the new Dashboard with Health status on ICC and REPO certificates, the UDEV signify bundle and details on how to configure OpenID Connect for Keycloak, Microsoft Entra ID and Microsoft ADFS.
  • Added description and examples to the Logging chapter in the ICC manual on what the AUDIT log events look like when Daily Station Token and signify bundles get downloaded and used in the stations.
  • Documented Xtransfer functionality in the Station manual
  • Documented the different error message one can get for USB devices in the Station
  • Added documentation on the Screensaver, Lock screen, current logged in user and battery indicator to the Station manual
  • Documented the new user editable configuration in the Station manual

Information

Operating system packages

All system components have been updated to their respective latest versions.

Online Documentation

Further details and configuration guidance are available in the official documentation:

https://sysctl.se/impex/documentation/

SBOM

Each ISO and VHD release has a software bill of materials (SBOM) to make introspection of the release easy to integrate with a number of security tools. Current and historical SBOMs are available for download at the customer portal.

Update Instructions

For networked Impex stations, this release will be automatically installed as part of the regular update process. No manual steps are required from administrators or users. The system will apply the update seamlessly in the background, ensuring that the latest fixes are in place without any interruption to normal operations.

For standalone Impex stations, your organisation needs to download the update from portal.sysctl.se in accordance with the update instructions in the chapter “USBProtect in offline mode” in the Impex USB Protect user manual.

Sysctl web page

https://www.sysctl.se

Sysctl page for Impex releases

https://sysctl.se/impex/releases/

Sysctl documentation for Impex

https://sysctl.se/impex/documentation/

Sysctl customer portal

https://portal.sysctl.se/

Sysctl RSS/Atom

https://sysctl.se/feed.xml