Cisco Duo Multi-Factor Authentication requires urgent patch installation

Content

Problem summary

Cisco Duo authentication servers will disallow old certificates on 31 March 2026. This means certain versions of the client software will stop working.

All existing versions of IBM FlashSystem and SAN Volume Controller software include a version of the client which will not work after this date.

A patch is available for all systems running 8.6.0 and later software, which will install an updated Cisco Duo client to prevent this issue. 

Note: The patch installation is non-disruptive, and (unlike a standard software install), does not require a reboot of the nodes within the system.

The Cisco notification for this change is available at: https://help.duo.com/s/article/9451?language=en_US 

If you're not sure whether you use Cisco Duo, check the output from the lsauthmultifactorduo CLI command. If the output says it is disabled, the system is not affected by this issue.

Action plan

1. Ensure you have a working superuser password, to allow local login and system configuration.
2. Install the appropriate patch for your system. This should be completed as soon as possible, and before 31 March 2026. Once the patch has been successfully installed, the system is no longer exposed to the issue. If it is not possible to immediately install the patch, work around the issue by disabling multi-factor authentication, or using locally-authenticated users until the patch is installed.

For systems with 8.5.2 or 8.5.3 software: Upgrade to a later release, then use one of the patches below.

For systems with 8.6.0 - 8.6.3 software:

Either:

• Manually download the patch from Fix Central here, and copy it to /upgrade on the configuration node using scp, or
• If Cloud Callhome is configured, you can choose to download directly to the system using the CLI command listed below.

After downloading the patch, install it using the applysoftware CLI command as documented here.

Download commands:

For systems with 8.7.0 - 9.1.2 software:

Either:

• Manually download the patch from Fix Central here, and copy it to /upgrade on the configuration node using scp, or
• If Cloud Callhome is configured, you can choose to download directly to the system using the CLI command listed below, or download the patch from the GUI "available patches" panel.

After downloading the patch, install it using the GUI or the applysoftware CLI command as documented here.