AIMMS PRO On-Premise Release Notes

This page lists everything released on the AIMMS PRO on-premise build pipeline going forward. For Cloud Platform releases (Portal, PRO Cloud builds, and REST API), see AIMMS Cloud Platform Release Notes. For everything released before the Cloud and on-premise pipelines diverged, see the AIMMS PRO Release Notes Archive.

PRO 26.6

AIMMS PRO 26.6.14 Release

On November 5, 2026 we released AIMMS PRO 26.6.14(On-prem build: 26.6.14.1)

You can download the installer here.

Security Fixes

  • Upgraded Jackson from 2.18.11 to 2.18.12, resolving CVE-2026-110879.

  • Removed the unused telemetry component (atp4cxx) from the PRO session. Telemetry is never collected for PRO on-premise. As a result, OpenTelemetry, libcurl and brotli are no longer shipped with PRO on-premise.

  • Upgraded the bundled ARMI library (armi4cxx) to 2.3.1-62, which no longer depends on RapidJSON, resolving CVE-2026-116620.

Resolved Issues

  • The AIMMS PRO AppLauncher (AimmsPROAppLauncher.exe, used for example to run WinUI apps) is now signed with a time stamp. Before, the signature had no time stamp, so it became invalid once the signing certificate expired, and Windows showed the launcher as coming from an unknown publisher during installation.

AIMMS PRO 26.6.13 Release

On October 29, 2026 we released AIMMS PRO 26.6.13(On-prem build: 26.6.13.1)

You can download the installer here.

Security Fixes

  • Upgraded the bundled PostgreSQL to EDB 16.15-3, which upgrades the separate copy of OpenSSL shipped with PostgreSQL (pgsql16\bin\libssl-3-x64.dll and libcrypto-3-x64.dll) from 3.5.7 to 3.5.8, resolving CVE-2026-75803 and CVE-2026-63073. The PostgreSQL version (16.15), service name and data directory are unchanged.

  • Upgraded Jetty from 12.0.36 to 12.0.39, resolving an incorrect authorization issue (CVE-2026-18661), case-sensitive proxy host filtering (CVE-2026-18660) and an information exposure in the HTTP client (CVE-2026-76184).

  • Upgraded the Apache Directory LDAP API, used for Kerberos ticket decoding, from 2.1.5 to 2.1.9, resolving a denial-of-service issue (CVE-2026-103885).

AIMMS PRO 26.6.12 Release

On October 21, 2026 we released AIMMS PRO 26.6.12(On-prem build: 26.6.12.1)

You can download the installer here.

Security Fixes

  • Upgraded Netty from 4.1.137.Final to 4.1.139.Final, resolving CVE-2026-93558 and CVE-2026-93565.

  • Upgraded Guava to 33.7.2-jre, resolving CVE-2026-102554.

  • Upgraded the bundled Expat XML parser from 2.8.5 to 2.9.0, resolving CVE-2026-77214.

Resolved Issues

  • Fixed saving the configuration in the Configurator after uploading a new PKCS#12 (.pfx) certificate, which failed with a NoSuchFileException for a file in the Windows TEMP folder. The uploaded certificate is now validated without consuming the upload, so it can still be stored when the configuration is saved.

AIMMS PRO 26.6.11 Release (On-prem build 26.6.11.4)

On October 8, 2026 we released an update of AIMMS PRO 26.6.11(On-prem build: 26.6.11.4)

You can download the installer here.

Security Fixes

  • Upgraded BouncyCastle (bcprov-jdk18on, bcpkix-jdk18on and bcutil-jdk18on) from 1.85 to 1.86, resolving a BLS12-381 key validation issue (CVE-2026-71891) and an NTRU timing side channel (CVE-2026-18036).

  • Upgraded jsoup from 1.18.3 to 1.23.2, picking up a fix in its HTML Cleaner.

Resolved Issues

  • Fixed uploading a PKCS#12 (.pfx) certificate in the Configurator failing with Illegal char <:> when the browser (for example Internet Explorer, or Edge in IE mode) sends the full client-side path as the file name. Only the file name itself is now used.

  • A failed certificate upload in the Configurator no longer removes the previously configured certificate; the old certificate file is only replaced after the new file has been stored successfully.

AIMMS PRO 26.6.11 Release

On October 5, 2026 we released AIMMS PRO 26.6.11(On-prem build: 26.6.11.1)

You can download the installer here.

Security Fixes

  • Upgraded the bundled OpenSSL library from 3.5.7 to 3.5.9, staying on the 3.5 long-term support line, resolving multiple vulnerabilities, including a critical integrity-check validation issue (CVE-2026-75803) and an out-of-bounds read (CVE-2026-84782). This applies to the OpenSSL used by AIMMS PRO itself; the separate copy shipped with the bundled PostgreSQL in pgsql16\bin remained at 3.5.7 until AIMMS PRO 26.6.13.

  • Upgraded the bundled Expat XML parser from 2.8.2 to 2.8.5, resolving four vulnerabilities, including an out-of-bounds read (CVE-2026-76641) and a use-after-free (CVE-2026-76957).

  • Upgraded Netty to 4.1.137.Final, resolving a critical TLS server-name routing bypass caused by fragmented handshake messages.

  • Upgraded Jackson to 2.18.11, resolving several denial-of-service vulnerabilities in Jackson Core and Jackson Databind (including CVE-2026-68497).

  • Upgraded FreeMarker in the Configurator to 2.3.35, resolving CVE-2026-84939.

  • Upgraded BouncyCastle (bcpkix-jdk18on and bcutil-jdk18on) to 1.85, replacing older versions that were still pulled in transitively.

  • Upgraded the c3p0 connection pool library to 0.14.2, resolving a known vulnerability.

AIMMS PRO 26.6.10 Release

On August 26, 2026 we released AIMMS PRO 26.6.10(On-prem build: 26.6.10.1)

Security Fixes

  • Upgraded the bundled net4cxx networking library to 2.2.1-44 (net4cxx-dev 2.1.1-35), which now disables TLS 1.0 and TLS 1.1 by default, reducing exposure to legacy, insecure TLS protocol handshakes.

AIMMS PRO 26.6.9 Release

On August 25, 2026 we released AIMMS PRO 26.6.9(On-prem build: 26.6.9.1)

Security Fixes

  • Upgraded mchange-commons-java to 0.6.1, resolving a JNDI injection / deserialization gadget vulnerability. The prior c3p0 upgrade only brought in mchange-commons-java 0.4.0 transitively, which remained vulnerable.

Resolved Issues

  • Fixed nightly Configurator backups failing with STATUS_DLL_NOT_FOUND, caused by a missing libiconv-2.dll in the bundled PostgreSQL EDB 16.14-2 build; the bundled PostgreSQL was bumped to EDB 16.15-1, which restores the missing DLL.

AIMMS PRO 26.6.8 Release

On August 14, 2026 we released AIMMS PRO 26.6.8(On-prem build: 26.6.8.1)

Security Fixes

  • Upgraded Jetty from 12.0.33 to 12.0.36, resolving a digest-authentication bypass (CVE-2026-10050).

  • Upgraded Netty to 4.1.136.Final, resolving CVE-2026-59901.

  • Upgraded the Spring Framework (spring-expression / spring-webmvc) to 6.2.19, resolving a known vulnerability.

  • Upgraded the PostgreSQL JDBC driver to 42.7.12, resolving a known vulnerability.

  • Upgraded Apache ActiveMQ (activemq-broker) to 6.2.6, resolving three code-injection vulnerabilities.

  • Upgraded BouncyCastle (bcprov-jdk18on) to 1.85, resolving two vulnerabilities, including a GOST 28147 CTR-mode keystream-reuse issue.

  • Upgraded Apache Mina (mina-core) to 2.2.8, resolving a critical deserialization allow-list bypass vulnerability.

  • Upgraded HttpCore5 (including httpcore5-h2) to 5.4.3, resolving an uncontrolled resource consumption vulnerability in the HTTP/1.1 and HPACK message parsers.

  • Upgraded Jackson Databind to 2.18.9, resolving a known vulnerability.

  • Pinned org.json to a current release, resolving a denial-of-service vulnerability present in a severely outdated transitive version.

  • Upgraded the c3p0 connection pool library to 0.14.0, resolving a known vulnerability.

  • Upgraded Mozilla Rhino to 1.7.15, resolving a known vulnerability.

Improvements

  • Client builds compiled with the newer msvc194 toolchain no longer collide with the older msvc193 (legacy vc143) runtime during ARMI compatibility negotiation; both runtimes are now shipped and identified separately.

  • Updated the bundled OpenSSL library from 3.3.2 to 3.5.7 (LTS).

Resolved Issues

  • Fixed PostgreSQL checkpoint failures after a fresh install, failing it to start properly, caused by missing pg_logical/snapshots and pg_logical/mappings directories.

AIMMS PRO 26.6.7 Release

On July 13, 2026 we released AIMMS PRO 26.6.7(On-prem build: 26.6.7.7)

Improvements

  • Internal build process improvements for on-premise. No functional or behavioral changes in this release.