Trust Protection Foundation upgrade options

CyberArk Trust Protection Foundation supports several upgrade options, allowing for high availability but slower upgrades, or faster upgrades with service interruption. Please consider the following items as you upgrade:

  • CyberArk provides product support for two years (24 months) of Trust Protection Foundation versions. CyberArk also provides upgrade support from any supported version to the current version.

  • You must be on a supported origin version (or any supported patch) before you upgrade to 25.3.

  • You do not need to uninstall Trust Protection Foundation prior to upgrading. You can install new versions over older versions.

  • You can download the currently-supported versions of Trust Protection Foundation by going to https://community.cyberark.com/marketplace.

  • There are three different upgrade strategies. See About rolling upgrades to help you select the correct strategy for your organization.

    • Offline upgrade

    • In-place rolling upgrade

    • Replace rolling upgrade

  • Be sure to check out the Important Upgrade Considerations section in your version-specific documentation for the intermediate version before upgrading.

Upgrading from an unsupported version of Trust Protection Foundation

If you are running an unsupported version of Trust Protection Foundation (which is any version including 22.4 or older), you cannot directly upgrade to the current version. You must follow a recommended upgrade path that involves two steps:

  1. First, upgrade to at least the minimum supported version. For example, if your origin version is 22.4.x, you need to upgrade to at least version 23.3.x (the minimum supported version).

  2. Once your entire cluster has been upgraded to the supported version 23.3.x, you can then migrate the entire cluster to the current version 25.3.x.

    In summary, the upgrade path would be: 22.4 -> 23.3 -> 25.3.

The following table lists the patch versions that have been tested for compatibility with the 25.3 release.

Upgrade version compatibility
Origin version
23.1.x
23.3.x
23.3.x
24.3.x
25.1.x

TIP  You may have noticed that the instructions said you needed to be on the oldest supported version, 23.3, but the upgrade table says you can upgrade from version 23.1.

If you are currently on version 23.1 you can directly upgrade to version 25.3, as version 23.1 was supported until 25.3 was released.

However, if you are starting from a version older than 23.1, you will want to upgrade to 23.3 (or later) so if you encounter any issues during the upgrade, you can get assistance from CyberArk Customer Support.

Server Agent upgrade options

Server Agent 25.3 supports upgrades with the full installation package on all OS platforms. Before you upgrade, please consider the following:

  • Agent Upgrade Work is bit-specific. Agent Upgrade Work cannot update a 32-bit Server Agent to the 64-bit version. You must use the full installer to upgrade from 32-bit to 64-bit.

  • Agent Upgrade Work will not send versions that are not listed in the table below. In cases where the work isn't sent, then multi-stage upgrades via an intermediate version may be available. Performing an upgrade via full platform-specific installer is always an option.

Server Agent 25.3 supported upgrade paths for Trust Protection Foundation Update package:

Current version Operating system Final version
22.2.x, 22.3.x, 22.4.x All, including Linux, Solarix, AIX 25.3
23.1.x, 23.3.x All, including Linux, Solarix, AIX 25.3