AVEVA InTouch HMI 2026 release notes

The InTouch HMI 2026 (Version 26.0.000) release notes contain information on new features and enhancements, resolved and known issues, and documentation included in this release.

Expectations and limitations

No InTouch HMI expectations and limitations have been identified in this release.

New features and enhancements

InTouch HMI 2026 (Version 26.0.000) includes a number of new features, hot fixes, and provides support for the latest versions of Microsoft products. Refer to the GCS Technology Matrix for the list of supported Microsoft products.

StringCompareEncrypted() function is deprecated

Starting from this release of InTouch HMI, StringCompareEncrypted() function is deprecated, and will no longer be available for use in InTouch scripts.

• The StringCompareEncrypted script function compared an unencrypted password with an encrypted password entered through a password input field.

• StringCompareEncrypted represented and supported a use case and workflow that is inherently insecure by modern cybersecurity standards, even within the scope of a closed network. Additionally, StringCompareEncrypted used an insecure comparison mechanism which could lead to clear-text password or credential exposure in memory and in the swap file on disk.

Considering these situations, and recent changes in the stance on the use of decryption methods in live systems in the standards within the cybersecurity community and the software industry, the decision has been made to deprecate the StringCompareEncrypted script function from this release.

Importantly, after the upgrade of the InTouch application, all occurrences of the StringCompareEncrypted script function will have no effect at runtime and will always return 0.

SQLDataGrid enhancements

A new property ColumnWidth has been added to the SQLDataGrid graphic custom properties.

For more information, see Custom properties for the SQLDataGrid graphic.

Connected experience enhancements

• Authenticate to Acknowledge Alarms in Operations Control connected experience: You must authenticate using AVEVA Identity Manager to acknowledge alarms when Operations Control connected experience is enabled in the Configurator and application security is configured.

• Offline connected experience: When the System Manager Server that is federated to CONNECT is disconnected from the internet, Operations Control connected experience supports a fallback on-premises user authentication and entitlement check.

• Script functions GetOnPremisesIdentity() and GetFallbackExpiry() are added.

  • Use the GetOnPremisesIdentity() function to get the on-premises identity of the signed in user when in offline connected experience.

  • Use GetFallBackExpiry() script function to retrieve the fall back authentication expiry date and time from machines when the machine is in offline connected experience.

• Shelve, unshelve, acknowledge, and dismiss operations for Signed alarm: If Operations Control connected experience is configured and enabled and if an alarm signature is required, when you try to shelve, unshelve, acknowledge, or dismiss a signed alarm, you will be prompted to authenticate with CONNECT credentials.

• Switch Users: WindowViewer allows switching from the current user to a new user by logging out the current user first and then logging in with the new user.

• Backstage graphical user interface (GUI): A backstage GUI is now available in WindowMaker to simplify user and access-level configuration. This GUI enables administrators to add users and assign InTouch access levels without using scripting, and it utilizes the existing AddPermission mechanism.
  This enhancement is supported in both connected experience and non-connected experience environments. Access levels can be configured for Operating System groups in non-Connected Experience environments and for CONNECT groups in Connected Experience environments.

Enhanced Smart Symbols to Industrial Graphics conversion

Instead of converting window-by-window a new functionality has been introduced to convert all windows in the application in a single operation. While converting a window to an Industrial Graphic, first the content of the window is checked. If it includes a smart symbol, then two graphics are created. The first graphic includes only the smart symbol and acts as a template. The second graphic is created with the name of the window and includes all the window content including the first graphic.

For more information, see Behavior of windows with smart symbol

Import or Export XML to or from Industrial Graphics

From this release, you can import/export one or more Industrial Graphics from or to an XML file.

For more information, see

Import Industrial Graphics to an application

Export Industrial Graphics from an application

Display instance name in Industrial Graphic at runtime

You can now use me.Tagname, me.HierarchicalName, or me.ContainedName to reference the name assigned to the UDT instance via a relative reference.

When visualizing data from UDT instances with Industrial Graphics, me.Tagname associates to the name of the UDT instance that is currently bound to the graphic via the OwningObject property of the graphic. This functionality is supported by three dotfields:

• TagName

• HierarchicalName

• ContainedName

For more information, see Use a UDT instance as an owning object

Non-Admin development in Application Manager and WindowMaker

You can now use the core features of Application Manager, WindowMaker, and WindowViewer without needing Windows Administrator privileges. Previously, most operations in Application Manager and launching WindowMaker required elevated permissions, which could disrupt workflows and limit accessibility. Now you can create and manage InTouch applications, fill them with content, and perform the majority of development and management tasks without Administrator rights. Administrator privileges are only needed for a few specific actions that interact with protected OS resources, such as configuring Windows Services, CPU core affinity, updating security groups, or managing credentials.

For more information, see

Required user privileges to run InTouch HMI

Applying Role-based Security to the Application Folder

Configuring Users and Groups

Dual Historian support

Multi Pens Trend and TrendPen now have the capability to fetch the data from the partner node historian when the primary node historian is down.

If you configure historical logging in InTouch and also specify a Historian partner in the Operations Control Management Console, then the Historian Client automatically detects and selects the online Historian from the redundant pair. The AppEngine automatically sends data to both the primary Historian and the specified partner. If one of the historians is offline, the AppEngine stores the historized data until the Historian comes back online. After the connection is restored, the AppEngine forwards the data to the Historian that was offline.

For more information, see

Understand trend pen historical data retrieval

Configure a multi pens trend

Organize UDT instances by Alarm Groups in Model - Tagname view

Starting from this release of InTouch HMI, the Alarm group property will no longer be available for members. Instead, you will need to assign the Alarm group at the instance level. If you import or migrate a member from an earlier release that had an Alarm group defined, the instances of those members will appear under the Unassigned group in the Model - Tagname view. You must then assign an Alarm group to those instances from the User defined type pane.

For more information, see

Create InTouch tags, UDTs, and Alarm groups from OPC UA server

Edit User-defined data types in the Properties grid

New option in WindowViewer configuration screen

A new option, Use datasource timestamp, allows alarms to use the timestamp from the data server instead of the local system time. This ensures alarms reflect the actual source time, which is especially useful in alarm hotbackup setups. Using the data source timestamp helps prevent duplicate historian records caused by differences in local system times.

For more information, see Configure general WindowViewer properties

Create UDTs and alarm groups from OPC UA items

The External providers option under Tag dictionary lists all the OPC UA server connections configured in the Gateway Communication Driver that is present on the same machine. Using this option, you can now easily create alarm groups and UDTs, in addition to access names and InTouch tags, directly from OPC UA item references. Additionally, the Alarm Group property is now applied at the UDT instance level rather than the UDT member level.

For more information, see Create InTouch tags, UDTs, and Alarm groups from OPC UA server

UDT script support using C# and Python

You can now add scripts as members to UDTs. You will have the options to add, edit, and delete a script. When you choose New or Edit, the script editor appears as a new tab in the main workspace of WindowMaker. Adding scripts to a UDT lets you define logic once and reuse it everywhere that UDT is used. These scripts are preserved during export and import, ensuring functionality remains intact across applications. Scripts can be written in common programming languages such as Python or C#.

For more information, see Use UDT script

InTouch Access Anywhere is not available

InTouch Access Anywhere is not available due to security reasons and will not be part of the System Platform 2026 installation media.

OperatorNode column shows client node name in RDS

In Alarm Client Control, the OperatorNode column displays the physical node name where the alarm operation was performed. The machine name is displayed in uppercase as provided by Windows.

Deprecation of plain text credentials in all controls

To support stronger security posture and modern credential management practices, InTouch HMI has deprecated manual username and password entry, transitioning all users to Named Credentials.

Until this release, InTouch HMI permitted manual username and password entry in several controls. While this approach offers flexibility, it can result in less secure credential handling, such as plain-text or weakly encrypted storage. Enhancing this behavior will help reduce the risk of inadvertent exposure and align with evolving security standards.

Affected Controls:

• TrendClient

• SQLDataGrid

• Distributed name manager history provider

• Alarm Controls

  • Alarm Pareto

  • Alarm DB View Control

  • Embedded Alarm Control

• Alarm Utilities

  • Alarm DB Logger Manager

  • Alarm DB Restore

  • Alarm DB Purge-Archive

Users will no longer be able to add or edit manual usernames and passwords. Existing usage of usernames and passwords in applications will continue to function normally but cannot be modified. Warning messages will be logged in the Operations Control Logger to inform users of the deprecation whenever manual usernames and passwords are accessed. All new applications and any existing applications updated by the user must use Named Credentials.

In the next phase planned for next major System Platform release following this release, support for manual usernames and passwords will be completely removed. During application upgrade, existing usernames and passwords in the controls specified previously will automatically convert to Named Credentials, enabling applications to function immediately after migration. Upon completion, the system will generate a detailed report listing affected applications and symbols, original username and password locations, new Named Credential names, and a summary of all changes.

InTouch application folder is secure by default

Applying role-based security to application folder ensures that only the authorized users can access the resources within the application folder and edit the application. By default, the InTouch application is secure. That is the Limit access to Standalone InTouch Application to users in InTouchDevelopers and InTouchOperators groups option available in the Application Manager under Tools > Node properties > Security is enabled by default. When the security feature is enabled on a node, strict read and write permissions are applied to the InTouch application.

TestPort utility is deprecated

The TestPort utility has been deprecated from this release.

AVEVA Web Client enhancements

The AVEVA Web Client in this release rebuilt with AVEVA's common web framework for greater performance, scalability, and portability of content across products. It also includes enhanced security through role-based access control, updated licensing behavior, and improved configuration and monitoring capabilities.

Note: The Web Client in this release uses a new underlying visualization technology. As a result, you might notice some differences compared to earlier releases.

• Role-Based Access Control

  Use AVEVA Web Client - Role Management plugin in the Configurator to create or manage the RW (Read Write) and RO (Read Only) groups, assign or remove users from groups, assign roles to the user groups, validate group membership, and apply security changes. Role-Based Access Control for the Web Client introduces two new operating system–level security groups.

  • AVEVA Web RW Users

    • Will have access to view the Web Client

    • Will have permission to perform write operations

    • Will have ability to modify, update, or interact with applications where applicable

    • Is intended for operators or personnel requiring modification capabilities.

  • AVEVA Web RO Users

    • Will have access to view the Web Client

    • Will not have ability to edit or modify data

    • Will have restricted UI elements and disabled write actions

    • Is intended for monitoring or supervisory personnel who require visibility but not control.

      Available roles that can be assigned groups are: Read, Write, and License Viewer.

  • Read: Allows you to only view or read the Web Client applications.

  • Write: Allows you to read and write to the Web Client applications.

  • License Viewer: Allows you to view license usage for the Web Client through License Usage Monitor from Web Client application page.

• Server Settings

  The AVEVA Web Client - Settings plugin in the Configurator allows you to configure Web Client website settings. Admins can configure website name, title, and icon using this.

• License Usage Monitor

  License Usage Monitor provides real-time summary of InTouch/OMI web client license usage. You can use License Usage Monitor Report page to view per-user license consumption, including username, session type, and session details. To access this, the user must be assigned the License Viewer role and must also have either the Read role or the Write role.

• Updated licensing behavior for Web Client sessions

  • One fully functional Web Client session is available even without a web server license.

  • The Web Client uses its own license that is separate from the desktop application license

  • The InTouch Web Client uses a server license with a client count parameter.

  • All previously used InTouch licenses listed will stop working starting with the InTouch HMI 2026 release.

  • Reading/writing Galaxy attributes requires a Supervisory Client license, while WindowViewer needs no extra license.

  • If no license is available, the system allows one free R/W session, though Galaxy data write is limited to two hours without supervisory licensing.

  • A web session is defined per user per machine.

  • The web server renews licenses daily and enters a grace period if renewal fails, while single session mode does not renew.

  • Grace period lasts 14 days and maintains existing sessions, but if it expires, the server drops licensed sessions to one.

  • There is no demo mode for Web Client, and systems without a license switch to single session mode.

  • When the web server shuts down, it releases its license and terminates all Web Client sessions immediately

  • For more information, see AVEVA Web Client help.

Restricted DLL loading

Overview

The registry-based mechanism for restricted DLL loading is designed to strengthen system security by controlling which directories are permitted for library loading. This mechanism aims to minimize the risk of malicious or unintended DLLs being loaded into the system.

By default, restricted DLL loading is enabled. It is recommended to test this feature in a test environment first to determine if it affects your application's functionality.

You can enable or disable restricted DLL loading by editing the relevant registry key. This key is generated during installation and has a default value of 1, meaning the feature is on.

• Registry Key Location: HKEY_LOCAL_MACHINE\SOFTWARE\AVEVA\SystemPlatform\Security

• Value name: EnableRestrictedDllLoading

• Type: DWORD (0 = Disabled, 1 = Enabled)

Values

• 0x00000000 (0): Restricted DLL loading is disabled
  

• 0x00000001 (1): Restricted DLL loading is enabled (default)

If the value is not specified, restricted DLL loading remains disabled by default. If the value is set to any value other than 0, restricted DLL loading remains enabled. If the value is set to 0 restricted DLL loading will be disabled.

Test

If your application is affected by this feature, you might encounter some issues in your system. In the Logger you may see some warning or error messages.

This functionality may affect following:

• Application Server

  • Custom Application Objects created with the AOT

  • Custom script libraries

  • IDE Extensions

  • GRAccess-based programs

• InTouch HMI

  • Custom script libraries

  • IDE Toolkit extensions

  • Network Application Development

  • Some Remote Desktop scenarios

Plan for moving forward

In a subsequent release, the feature will always be enabled and can't be disabled.

WindowViewer as a Service

Service account changes

For improved security, the WindowViewer Virtual Service Account has been removed from the Administrators group and no longer has administrative privileges. The account has been added to the ASBSolution, ArchestrAWebHosting, and aaRuntimeUsers groups.

Application path access

When configuring WindowViewer to run as a service in the Application Manager, the system will automatically check if the WindowViewer Virtual Service Account has the necessary permissions to access the selected application path. If the service account does not have read/write access to the application directory tree, the following will occur:

1. Automatic permission grant: The WindowViewer Virtual Service Account will be automatically granted read/write access to the entire application directory tree.

2. User notification: You will see a log message informing you of this permission change.

3. Service configuration: The application will then be configured to run as a service with the appropriate access rights.

Post-upgrade redeployment requirements

Important: After performing a software upgrade, managed applications running as a service must be redeployed to ensure proper service account permissions. If you do not redeploy after an upgrade, the VIEW service account will not automatically have permission to the application folder for the managed application running as a service.

Standalone applications in protected paths

If a standalone application was created in a protected path and configured to run as a service in an earlier release, the VIEW service account may not have the required permissions after upgrade. This is due to the reduced privileges of the VIEW service account.

Issue: After upgrade and machine restart, the WindowViewer service may fail to start with an "Access Denied" error.

Solution: Manually grant read and write permissions to the VIEW service account for the application folder.

Logging

Detailed log messages are provided to help troubleshoot any service configuration issues. Monitor the Operations Control Management Console for information about permission changes and service setup status.

Security notes

• The service account now operates with minimal required privileges for enhanced security.

• Permissions are granted only to specific application directories as needed.

The service account no longer has system-wide administrative access.

Resolved issues

InTouch HMI 2026 includes corrections for the issues listed in the following table. These issues are listed by their Defect ID (IMS number), any assigned Service Request (SR) or Case Number with a brief description of the defect.

InTouch HMI 2026 also includes issues resolved in InTouch HMI 2023 R2 SP1 P01, InTouch HMI 2023 R2 SP1 P02, InTouch HMI 2023 R2 SP1 P03, and InTouch HMI 2023 R2 SP1 P04. For the list of resolved issues, see the respective release notes available on the AVEVA Global Customer Support (GCS) website.

Known issues

This section describes known issues that remain in the release of InTouch HMI 2026.

User documentation

Notice – Online help access: System Platform 2026 does not include online help files or the AVEVA Help Viewer. Context-sensitive help calls now open the corresponding content on docs.aveva.com.

If internet access is not available, selecting a help link displays a QR code that you can scan with an internet-connected mobile device to open the help content.

All product documentation is still available in PDF format on the installation media, and is installed locally when you install System Platform.

The InTouch HMI documentation library is offered in two different media:

• The product documentation is available on the AVEVA documentation portal. To comply with the portal guidelines, the style and tone of the documentation content has been modified. Hence, the content available on the portal may differ slightly from the documentation delivered with the product release.

• Portable Document Files (PDF), which can be viewed with Adobe® Reader®. Each user guide is included on the InTouch installation media as a PDF file.
  The InTouch product library consists of a set of Portable Document Files (PDF) available in the following location of the System Platform installation media:

  \AVEVA System Platform\InstallFiles\CD-Intouch\UserDocs\English

  You need Adobe Reader installed on your computer to view InTouch documentation. You can download the latest version of Adobe Reader from the Adobe Corporation web site:

  http://www.adobe.com/products/acrobat/readstep2.html

  After installing Adobe Reader, double-click a PDF file with your pointing device to view the book with Adobe Reader. You can also open a book with the Adobe Reader Open command from the File menu. Context-sensitive documentation is also available with InTouch online help. Select Help for information about the current InTouch window that you have open on your computer.

  Single user guides in PDF form (included as part of the install):

  • AVEVA™ InTouch HMI Creating Standards for InTouch HMI Components Guide: This guide includes information on creating standards for various InTouch HMI components. It describes how to prepare the development environment, view the application in run time, and work with tags, alarms, and data items in InTouch HMI to connect your application to the physical devices in your plant environment.

  • AVEVA™ InTouch HMI Application Development Guide: This guide includes information on creating and managing InTouch HMI applications locally and in a network environment. It describes how to create visualization windows, draw and animate graphic elements, and use wizards and ActiveX controls in your application. It also includes a reference of the InTouch HMI scripting language and functions, along with details on working with Industrial Graphics in the cloud.

  • AVEVA™ InTouch HMI Application Deployment Guide: This guide includes information on deploying InTouch HMI applications to work with terminal and remote desktop services. It describes how to configure InTouch HMI NAD and use Managed Applications at run time.

  • AVEVA™ InTouch HMI Application Run Time Guide: This guide includes information on using WindowViewer and Web Client to view the InTouch HMI applications in run time.

  • AVEVA™ InTouch HMI Application Maintenance Guide: This guide includes information on migrating and upgrading InTouch applications, components, and alarms. It also describes how to set up an InTouch HMI application on tablet PC or multi monitors.

  • AVEVA™ InTouch HMI Troubleshooting Guide: This guide includes troubleshooting information to understand error messages and resolve issues with the InTouch HMI application, and Web Client.

  • AVEVA™ InTouch HMI Management Guide: This guide includes licensing information for the InTouch HMI application as well as generic and InTouch-specific security configurations. It also describes using other supplementary components.

  • AVEVA™ Web Client: This guide includes information on how to configure and view application graphics on an HTML5 compatible web browser.