Introduction

This document serves as a Root Cause Analysis for the Alma service interruption experienced by Clarivate customers February 24, 2026-Febuary 25, and February 27 2026.
The goal of this document is to share our findings regarding the event, specify the root cause analysis, outline actions to be taken to solve the downtime event, as well as preventive measures Clarivate is taking to avoid similar cases in future.

Effected Products

Higher-Ed Platform NA04, NA05, NA06, NA07, NA0

Event Timeline

Service interruption was experienced by Ex Libris customers served by the HEP NA04, NA05, NA06, NA07, NA08 instances during the following hours, Seattle time:

February 24, 2026, from 5:55 PM until 7:35 PM.

February 25, 2026, from 11:24 AM until 12:37 PM.

February 25, 2026, from 4:45 PM until 7:39 PM.

February 27, 2026, from 6:28 PM until 6:44 PM.

During the event, customers experienced intermittent performance and access issues.

Root Cause Analysis

While our initial automated alerting indicated a potential Internet Service Provider (ISP) disruption, the underlying fault spanned multiple infrastructure layers. Because these initial symptoms masked the true issue, it regrettably led to three separate service interruptions before the actual root cause was identified through escalating the investigation across multiple specialized teams to resolve these conflicting initial root cause, our engineering team subsequently determined that the true cause of the interruption was an unexpected CPU load spike on our core firewall infrastructure.

This severe resource exhaustion forced all of our secure VPN tunnels to disconnect, which successfully isolated the issue but halted critical traffic flowing into and out of our Data Center. To stabilize the environment and restore your connectivity once the exact hardware was identified, our engineers immediately applied targeted system adjustments to alleviate the processing load. We are currently analyzing the underlying network logs to understand the exact origin of this load, including a thorough evaluation to determine if it was triggered by an anomalous external traffic event.

Technical Action Items and Preventive Measures 

Clarivate has taken the following action and preventive measures to avoid such an occurrence in the future:

• We are actively partnering with our network hardware vendor's support engineering team to conduct a deep-dive investigation. This includes a full forensic review of the inbound traffic to definitively identify the trigger of the CPU spike and rule out malicious intent.

•  We have applied targeted configuration updates to our core firewalls to optimize traffic processing and enforce stricter resource allocation. These enhancements are designed to better distribute the processing load and safeguard against similar resource exhaustion while the formal investigation concludes. Analyzing the impact of ISP instability on our load balancing layer to improve how our systems automatically respond to external network fluctuations.

Customer Communication

ExLibris is committed to providing customers with prompt and ongoing updates during Cloud events. Ongoing and prompt updates on service interruptions appear in the system status portal at this address: http://status.exlibrisgroup.com/

These updates are automatically sent as emails to registered customers.