What’s New in RICOH CloudStream v2.37.0?
Dear All,
We are happy to tell you that RICOH CloudStream v2.37.0 will be released with below release schedule.
Check which component is updated this time from the table below.
| Version category | Version | Update | Detail |
| Release note version | v2.37.0 | ✓ | – |
| Component version (DM) | v1.10.1 | ✓ | See the release note below. |
| Component version (Print&Scan) | v2026.08.06
v2026.08.20 |
✓ | See the release note below. |
Important: Legacy port consolidation — migration dates set.
Migration to port 443 will be carried out progressively starting from 22 October 2026, and port 2560 closes progressively from 12 November 2026.
What you need to do which is same as previous announcement
- Upgrade all PC Clients and Gateways to 2026.06.25 or later, across the whole estate. Watch for machines excluded from auto-update or from your deployment tool.
- Confirm outbound port 443 (TLS 1.2+) to your tenant domain is permitted by your firewall and web proxy, and test from every relevant network segment, not just one.
Components on older versions that cannot reach port 443 will lose connectivity once the migration is enabled, and recovery is manual on every affected machine. Components on 2026.06.25 or later are safe in the same situation: they stay on the legacy port until port 2560 itself closes, which gives you time to fix the firewall.
What is changing
We are consolidating all communication onto port 443 (HTTPS / WebSockets, TLS 1.2 or newer), in two steps:
- Port 2560 (Gateways and PC Clients) – October 2026.
- We are retiring the legacy communication channel on port 2560. Unlike the rest of our communication, this channel cannot be managed, monitored, or updated on a per-customer basis, which is why it is being removed first.
- From 22 October 2026: we enable the migration to port 443 globally, across all data centers. Every Gateway and PC Client that meets both conditions below switches to port 443 automatically.
- From 12 November 2026: port 2560 is closed, progressively, data center by data center.
- All remaining legacy ports — by end of January 2027. Port 443 has been the default requirement and setting for over two years, so the large majority of connections already use only 443. Some older components — certain terminals (Gen2 Emb), clients, mobile apps, and other legacy elements — may still connect over legacy ports. Those ports will be closed by end of January 2027. We are adding tenant-specific reporting so we can identify affected customers ahead of time and notify them through their partner. Reducing the number of open ports also simplifies configuration and lowers the platform’s exposure surface.
Two conditions for a smooth migration
A. PC Client and Gateway on version 2026.06.25 or later. From this version, the component verifies that port 443 is actually reachable before switching to it. If it cannot reach 443, it stays on the legacy port and retries later, without losing connectivity.
B. Outbound port 443 to your tenant domain is not blocked. The component must be able to reach your tenant domain on port 443 with TLS 1.2 or newer: not blocked on the firewall, and not broken by a web proxy or TLS inspection.
Note that upgrading alone does not migrate a component. If it was originally deployed with legacy communication settings, it stays on the legacy port even on a current version. The migration enabled on 16 September is what moves it to 443, and it succeeds safely only when both conditions are met.
No change to
Local communication between clients and on-premises Gateways is unaffected.
——————————————————————————————————————
<What’s updated in RICOH CloudStream version 2.37.0>
※The public beta feature can be utilized by customers in one or more datacenters prior to official production release.
◆DM component（v1.10.1）
＜Bug Fixed＞
We fixed 2 bugs below.
– Auth agnet is unstable and LDAP auth profile error.
Issue：
LDAP authentication through Auth Agent intermittently fails. During the issue, users cannot authenticate through LDAP and access CloudStream services.
Cause：
Multiple factors are identified in the Auth Agent and M-Auth authentication flow.
Under high login load, thread blocking in M-Auth, sequential LDAP validation processing, and duplicate validation requests caused authentication delays and timeouts, resulting in login failures and Auth Agent service instability.
– OIDC Profile is not showing with Firefox web browser.
Issue：
LDAP authentication through Auth Agent intermittently fails. During the issue, users cannot authenticate through LDAP and access CloudStream services.
Cause：
The issue occurs because the OIDC profile options are wrapped in <div> elements. In previous versions of Firefox, these <div> elements were ignored and the options were rendered as direct children of the <select> element. Starting with Firefox 153.x.x, the browser no longer ignores the <div> elements, causing the <select> element to display only the default blank option and preventing the OIDC profiles from being shown.
——————————————————————————————————————
◆Print Scan component（v2026.08.20)
Various improved features and bug fixes have been implemented.
——————————————————————————————————————
◆Print Scan component（v2026.08.06)
Search bar for print queues
The Print Queues list in the Web admin UI now has a search bar, matching the search already available for printers and embedded terminals (Gen2 Emb). Administrators managing large numbers of queues can filter them by name or by the printer they belong to instead of scrolling the full list.
——————————————————————————————————————
◆Common feature for DM component & Print Scan component
No Update.
Release Notes for V2.37.0
+ Added feature
x Improved/changed feature
– Bug fixed
! Limitation
*The public beta feature can now be utilized by all customers with access to all production data center prior to official production release.
Device Management
No updates.
Dashboard/Reporting
No updates.
System
No updates.
Deployment Tool
DM agent
No updates.
Others
– Auth agnet is unstable and LDAP auth profile error.
– OIDC Profile is not showing with Firefox web browser.
Print Scan UI
x Refreshed navigation and menu appearance
The navigation menu and its icons, and the top bar logo layout, have been visually updated for a more consistent look across the product’s web interfaces.
Secondary Gateway
No updates.
PC Client
– Client no longer fails to connect when a proxy exclusion is configured for a domain
The client incorrectly checked proxy exclusion rules against the full host and port instead of the host alone, so a login could fail even though the destination was meant to bypass the proxy. Proxy exclusions are now evaluated correctly.
– Client no longer falls back to the system proxy when a PAC script requests a direct connection
When automatic proxy discovery returned a “no proxy” result from a PAC script, the client could not distinguish that result from a discovery failure, and fell back to system-wide proxy settings anyway. A successful “no proxy” result is now respected, and no further fallback is attempted.
– Client service on Linux and macOS now stops correctly when asked to
The client’s background service on Unix-based platforms did not respond to a stop signal, so commands to stop the service, for example during a controlled shutdown or restart, had no effect. The service now shuts down correctly when requested.
Authentication
– Users are no longer logged out roughly every hour due to a stale directory connection
A pooled directory-server connection that had silently gone stale could be mistaken for the user not existing, which caused a token refresh to fail and the client to log the user out, typically about once an hour. The connection is now recognised as stale and refreshed, so this recurring logout no longer happens.
– IP allow-list on API keys now works when accessed over port 443
When an API key’s allowed-IP restriction was enforced through a reverse proxy on port 443 rather than a direct connection, the restriction was not applied. Requests are now filtered correctly regardless of which port they arrive on.
– User Groups reporting no longer drops group membership for users with no department set
A print or scan job’s group membership was only recorded if the user had a department value set; for users without one, all of their group memberships were silently omitted from reporting. Group membership is now recorded whenever it is available, regardless of whether a department is set.
Performance enhancements
No updates.
Printing
x Secure print preferences no longer revert to a default profile
A defect in preference resolution meant that a user’s saved paper size and color settings could silently fall back to a default profile (Letter size, greyscale) after some time, with no indication that anything had changed; signing out and back in temporarily masked the problem. The underlying lookup and fallback logic has been corrected so a user’s own preferences are no longer silently overridden.
Scanning
– SharePoint Online connector now resolves sites correctly for multi-geo Microsoft 365 tenants
The connector always addressed SharePoint sites relative to a tenant’s default region, so scans failed to reach a site hosted in a different region of a multi-geo Microsoft 365 tenant, with no available workaround. Sites are now addressed correctly for multi-geo tenants.
– A scan-to-download job that already succeeded is no longer marked Failed
If the email notification sent after a scan-to-download job completed took too long to send, the job could be reported as failed even though the document had already been stored and downloaded successfully, and its status was incorrectly reverted to Failed. The document’s status is no longer overwritten once it has reached a final state.
Partner hosted and on-premises installations
No updates.
Ricoh Cloud Terminal (Gen2 Emb)
No updates.
Fujifilm BI Cloud Terminal (Gen2 Emb)
No updates.
HP Workpath Cloud Terminal (Gen2 Emb)
No updates.
Konica Minolta IWS Cloud Terminal (Gen2 Emb)
– Quick scan tiles no longer change position between logins
The order of quick scan workflow tiles on the terminal’s (Gen2 Emb) Quick Actions screen could change from one login to the next, making a tile appear to have moved or gone missing, an effect most noticeable with longer translated labels. Tile ordering is now stable across logins.
– Pressing Enter while filling a scan workflow field no longer logs the user out
On terminals(Gen2 Emb) using the web-based scan workflow form, pressing Enter in a single text field triggered the browser’s default form submission, which reloaded the page and logged the user out. Enter no longer submits the form, so the session is preserved.
Xerox Cloud Terminal (Gen2 Emb)
No updates.
Sharp Cloud Terminal (Gen2 Emb)
No updates.
Brother Embedded Terminal
No updates.
Canon Embedded Terminal
No updates.
Kyocera Embedded Terminal
No updates.
Lexmark Embedded Terminal
No updates.
API
No updates.
Chrome Extension
No updates.
Driver
No updates.
Internet ports
No updates.
Mobile app
No updates.
Messaging
No updates.
Security enhancements
No updates.
Documentation
No updates.
Upgrading of customer-hosted environments
No updates.
Legacy terminal support
To support the ongoing migration away from legacy communication ports, the following terminals(Gen2 Emb) now proactively try to switch to port 443 on startup, rather than only falling back to it if the legacy port fails.
Sharp
– Proactive migration to port 443
The terminal(Gen2 Emb) now attempts to switch to port 443 on startup instead of waiting to fall back to it.
Konica Minolta IWS
– Proactive migration to port 443
The terminal(Gen2 Emb) now attempts to switch to port 443 on startup instead of waiting to fall back to it.
Others
No updates.
Print Scan UI
+ Search bar for print queues
The Print Queues list in the Web admin UI now has a search bar, matching the search already available for printers and embedded terminals(Gen2 Emb). Administrators managing large numbers of queues can filter them by name or by the printer they belong to instead of scrolling the full list.
x Higher default card length limit for new card templates
The default card length limit for newly created card templates has been raised from 20 to 64. The field now also shows a hint explaining that this value has to match across embedded terminals(Gen2 Emb) so that a card works on all devices.
– Printer status no longer stays OK after a terminal(Gen2 Emb) is uninstalled
After uninstalling a terminal(Gen2 Emb) from the Printers page, the printer kept reporting OK instead of Not installed whenever a user had signed in on that terminal(Gen2 Emb) before the uninstall, and stayed in that state for all later install cycles. The status is now reported correctly.
– Deleted certificates are no longer left behind as stale records
When all remaining certificates except the token signing certificate were deleted, either between synchronisation windows or within a single window, the certificate records were not removed and stale entries were left in place. Deletions are now synchronised correctly.
Secondary Gateway
No updates.
PC Client
x Printer ports that the operating system still reports as in use are handled more cleanly
After a printer was removed, the Windows print spooler could continue to treat its port as in use until the spooler service was restarted, which surfaced as a misleading failure when the port was cleaned up. This situation is now handled without reporting a spurious error.
– Print jobs no longer rejected as unsupported data on some Canon devices
PDF jobs produced by the client failed on several Canon imageRUNNER ADVANCE models with the panel error “Could not execute because the file contains unsupported data”, while the same document printed correctly when uploaded through the Web UI. The jobs produced by the client are now accepted by these devices.
– macOS client no longer changes the default printer on every sync
Printer synchronisation on the macOS client changed the default printer each time it ran. The behaviour has been narrowed so that it matches the Windows client.
– Large documents no longer crash the universal print driver
Printing documents of roughly one hundred pages or more could crash the driver because of a buffer overflow, with the job failing before it reached the queue. Large documents now print reliably. This fix requires an updated driver version.
– Advanced print options can be cleared again once they have been used
After an advanced option such as booklet or a setting on the Features tab had been selected once, it behaved as the effective default and could not be turned off, so later jobs were still produced with it even when the option was set to none. Each job now follows the option chosen for it. This fix requires an updated driver version.
Authentication
– Email addresses can again be used as a user full name
Since the previous release it was no longer possible to create a user whose full name is an email address, through either the Web admin UI or the API, because of stricter validation introduced with additional cross-site scripting protection. Such users can be created again.
– Self-registration for session users can be disabled after a licence change (HBT-6511)
On accounts that were created with a direct-print-only licence and later moved to a licence with secure printing, the setting controlling self-registration of session users was hidden, so administrators could not turn it off even though it was still active. The setting is now available regardless of the current licence.
Performance enhancements
No updates.
Printing
No updates.
Scanning
No updates.
Partner hosted and on-premises installations
No updates.
Ricoh Cloud Terminal (Gen2 Emb)
– Jobs from the native PostScript driver are processed correctly
Jobs produced by the vendor’s native macOS PostScript driver arrive without PJL headers, and the Cloud terminal(Gen2 Emb) assumed such jobs were PDF. The terminal now checks the actual format before processing the job.
– Card reader configuration works when port 80 is disabled
Configuring a card reader with the terminal(Gen2 Emb) deployment tool failed on devices that had port 80 disabled, even though only secured ports were expected to be used. The configuration now completes over a secured connection.
Fujifilm BI Cloud Terminal (Gen2 Emb)
– Card authentication survives waking the device from sleep
When the secure print and scan application was set as the screen default, so that it relaunched automatically on wake, card authentication silently stopped working after the device woke from sleep and users could no longer sign in with a card. Card authentication now remains available.
HP Workpath Cloud Terminal (Gen2 Emb)
x Device locking with the authorization agent service
The Workpath terminal(Gen2 Emb) has been updated to 1.6.3, which adds support for device locking through the authorization agent service.
Konica Minolta IWS Cloud Terminal (Gen2 Emb)
No updates.
Xerox Cloud Terminal (Gen2 Emb)
+ Stapling and punching in the copy application
The copy application on the Cloud terminal(Gen2 Emb) now offers stapling and punching options. This matters where device locking is not available and kiosk mode is used to restrict unauthorised use of the device, because only the copy application is then available to users.
Sharp Cloud Terminal (Gen2 Emb)
– Documents are no longer released multiple times
Tapping print all, or the print button in the job list, several times in rapid succession started the print process once per tap, so documents were released repeatedly and errors appeared on the panel. Repeated taps are now ignored while a release is already running.
Brother Embedded Terminal
No updates.
Canon Embedded Terminal
No updates.
Kyocera Embedded Terminal
No updates.
Lexmark Embedded Terminal
No updates.
API
No updates.
Chrome Extension
No updates.
Driver
No updates.
Internet ports
No updates.
Mobile app
No updates.
Messaging
No updates.
Security enhancements
No updates.
Documentation
No updates.
Upgrading of customer-hosted environments
No updates.
Others
No updates.
No updates.