Finding vulnerable components with SLM and SAM Core – guidance document

With PHP2Shell (CVE-2026-109618 / CVE-2026-109619) and Broccoli2Shell (CVE-2026-111497) published within days of each other, many of you have asked how to use Snow License Manager and SAM Core to find affected devices. The attached document walks through it.

It covers:

• How to work out what a vulnerable component looks like on disk, and which products bundle or embed it

• Installed software versus file evidence, and why file evidence often finds the copies you didn't know about

• Step by step: finding recognised applications, then using the Files per computer report to get exact versions and paths

• What the standard inventory does not see (DLLs, shared libraries, non-default folders, statically linked code, language packages, containers) and how to close those gaps

• A checklist you can reuse for the next vulnerability

PHP2Shell and Broccoli2Shell are used as worked examples, but the document is meant as general guidance for detecting future vulnerabilities of this kind.

Please note: the guidance is based on a standard setup with the default inventory agent configuration. If you have changed your agent configurations (for example scan paths or file types) or the settings that control which file extensions are transferred to the frontend, your results may differ from what is described: you may see more files, or fewer.

Always check the latest vendor advisories for fixed versions before acting.

Questions and feedback are welcome in the comments.

Official release of Snow Integration Manager 26.3.0

We are pleased to announce the release of Snow Integration Manager 26.3.0

This release includes: 

·      Oracle Linux Virtualization Manager connector: Added a new connector for collecting inventory from OLVM environments into SAM on Snow Atlas and Snow License Manager.

·      Discovery data from file connector: Added support for populating the DiscoveryDate field in discovery manifests.

·      ServiceNow ITSM connectors: Added a configurable page size for computer data retrieval.

·      ServiceNow ITSM connectors: Fixed OAuth authentication through connector-configured proxy servers.

·      HCL BigFix connector: Fixed duplicate device identity attributes that could cause incorrect device merges.

·      VMware vSphere connector: Fixed BIOS serial-number formatting for inventoried virtual machines.

·      VMware vSphere connector: Fixed proxy configuration restoration after aggregation.

·      BMC Discovery connector: Improved handling of software records with missing names.

·      HCL BigFix connector: Fixed missing records when processing large paginated datasets.

·      Microsoft Hyper-V connector: Fixed authentication for service accounts specified in UPN format.

·      Red Hat OpenShift Virtualization connector: Corrected host and datacenter identity mapping.

·      Snow XML connector: Improved processing of network adapter data without a MAC address.

·      HCL BigFix connector: Improved validation of software-instance and software-metric inclusion rules.

Customer Impact:

Oracle Linux Virtualization Manager Connector

Before this release: Customers using Oracle Linux Virtualization Manager, including those transitioning from the legacy Oracle VM platform, did not have a supported SIM connector for collecting OLVM virtualization inventory into SAM on Snow Atlas or Snow License Manager. This resulted in limited visibility into OLVM-managed hosts, virtual machines, clusters, and their relationships, increasing reliance on manual collection or alternative approaches.

After this release: The new connector automatically collects inventory from OLVM environments through the OLVM API and imports OLVM-managed hosts, virtual machines, clusters, and their relationships into SAM Core on Snow Atlas and Snow License Manager. This expands virtualization inventory coverage, reduces reliance on manual processes, and helps customers transitioning from Oracle VM to OLVM maintain visibility across their virtualized environments to support license-compliance processes.

For configuration information, refer to the Oracle Linux VM connector user guide.

Discovery Data From File Connector

·      The addition of the DiscoveryDate field provides a consistent discovery timestamp, improving metadata consistency and reliable processing across discovery sources.

ServiceNow ITSM Connectors

·      The configurable page size improves computer-data retrieval reliability by allowing customers to adjust the number of records retrieved according to their environment and payload size.

·      OAuth requests now use the proxy settings configured in the connector, supporting reliable ServiceNow authentication in environments that require proxy communication.

HCL BigFix Connector

·      Corrected device identity mapping prevents distinct devices from being incorrectly merged, improving device identification and host-to-virtual-machine relationships.

·      Improved pagination ensures complete processing of large datasets, reducing the risk of missing software inventory records.

·      Improved filtering validation prevents inconsistent software-instance and software-metric selections, supporting more complete and reliable inventory data.

VMware vSphere Connector

·      Preserving BIOS serial numbers exactly as reported by VMware vSphere improves consistency when comparing or combining data from multiple inventory sources.

·      Correct restoration of proxy settings allows subsequent connector operations to use the appropriate network configuration without restarting Snow Integration Manager.

BMC Discovery Connector

·      Filtering software records with missing names prevents malformed records from disrupting downstream processing while preserving valid software inventory data.

Microsoft Hyper-V Connector

·      Correct handling of UPN-formatted service accounts supports successful authentication and data aggregation against remote SCVMM servers.

Red Hat OpenShift Virtualization Connector

·      Corrected host and datacenter mapping improves the accuracy of reporting, grouping, and license allocation in Snow Atlas and Snow License Manager.

Snow XML Connector

·      Allowing network adapter data without a MAC address aligns validation with the XML schema and improves XML data-processing reliability.

Release information

Product: Snow Integration Manager

Release Tier: Minor Release

Release Version: 26.3.0

Release Date: 2026-09-21

Release Availability: GA

Release Notes: SIM 26.3.0 Release Notes

Product Documentation: SIM Documentation, ITSM Documentation

Distribution method: Installer available for downloads here

Title: Snow Productivity Optimizer v26.1.0 is now available 

Snow Productivity Optimizer v26.1.0 is now available. Customers using Snow Productivity Optimizer v3.x and earlier versions, formerly named Snow Automation Platform, should plan to update before these versions reach End-of-Life and End-of-Support. 

Affected versions 

Snow Productivity Optimizer v3.x and earlier versions will reach End-of-Life on March 31, 2027. 

Key dates 

End-of-Life (EOL): March 31, 2027 

End-of-Support (EOS): June 30, 2027 

What this means 

After March 31, 2027, affected versions will no longer receive updates, maintenance, or security patches. After June 30, 2027, Flexera will discontinue technical assistance for these versions. 

Recommended next steps 

Customers should update to Snow Productivity Optimizer v26.1.0 as soon as their team is ready. Upgrading now gives your organization time to validate the update, complete any internal change processes, and keep your environment current before the EOL and EOS dates. 

Snow Productivity Optimizer v26.1.0 is now available from the Snow Product Downloads page on the Flexera Community, through the Snow Update Service, or through your partner. Documentation for updating via the Snow Update Service is also available to support your update planning here. 

If you have questions or need help with your update, please contact your Flexera account team or Flexera partner. 

Official Release of Snow License Manager 26.3.1

Released on September 18, 2026

Release information

Product: Snow License Manager

New version: 26.3.1

Release date: Sep 18, 2026

General availability: Sep 18, 2026

Distribution: Snow Update Service

Current status: Released 

Please find more about the content of the release in the Release notes.

Known Issue: Compliance Calculation Failure in Snow License Manager 26.3.0

Dear Customers,

We would like to inform you of a known issue identified in Snow License Manager 26.3.0 that may cause the Compliance Calculation process to fail in specific scenarios.

Description

After upgrading to Snow License Manager 26.3.0, the Compliance Calculation process may fail with the following error:

05:00:53,927 71  ERROR   ErrorHandlingTaskBlockRunner; Error occured in task block SnowSoftware.LicenseManager.Licensing.Service.Taskflow.Blocks.FetchTaskBlock.

System.AggregateException: One or more errors occurred. ---> System.InvalidCastException: Specified cast is not valid.

This behavior is caused by a known defect introduced in version 26.3.0. Flexera Support can help confirm whether a specific Compliance Calculation failure is related to this issue.

When Does the Issue Occur?

The issue may occur when a license contains an organization distribution record, which is commonly created when licenses are manually assigned to an organization node below the Root Organization.

Affected environments may have one or more of the following characteristics:

• Licenses have been manually assigned to organization nodes.
• License purchase prices contain decimal values.
• Compliance Calculation begins failing immediately after upgrading to SLM 26.3.0 when the above conditions are present.

Potential Impact

Because the failure occurs during Compliance Calculation, the issue may go unnoticed if calculation logs are not regularly reviewed. In such cases, customers may first observe that:

• Compliance data is no longer being refreshed.
• Compliance-related reports are no longer reflecting current information.
• Expected compliance updates are not being generated.

Current Status

Our engineering team has identified the root cause and is actively working on a resolution.

A hotfix will be available starting September 14, 2026 for customers affected by this issue, followed by an official release of Snow License Manager 26.3.1 later that week.

If you are experiencing Compliance Calculation failures after upgrading to SLM 26.3.0, please contact Flexera Support for assistance.

We apologize for any inconvenience and appreciate your patience while we work to resolve this issue.

Official Release of Snow Inventory Oracle Hardware Scanner 2.4.2

Released on September 2, 2026

Release information

Product: Snow Inventory Oracle Hardware Scanner

New version: 2.4.2

Release date: Sep 2, 2026

Distribution: Snow Update Service, Package builder and Product Downloads 

Current status: Released

Please find more about the content of this release in the Release notes.

Official Release of Snow Inventory Oracle Middleware Scanner 3.6.2

Released on September 2, 2026

Release information

Product: Snow Inventory Oracle Middleware Scanner

New version: 3.6.2

Release date: Sep 2, 2026

Distribution: Snow Update Service, Package builder and Product Downloads 

Current status: Released

Please find more about the content of this release in the Release notes.

Official release of Snow Inventory Java Scanner 3.6.2

Released on September 2, 2026

Release information

Product: Snow Inventory Java Scanner

New version: 3.6.2

Release date:  Sep 2, 2026

Distribution: Snow Update Service, Package builder and Product Downloads 

Current status: Released

Please find more about the content of this release in the Release notes.