2026.10¶

Features & Enhancements¶

WebApp Pentest¶

• An expanded set of specialist AI agents now explores, exploits, and verifies web application risks, including broken access control and major injection vulnerabilities. Findings include evidence that you can review. Safety controls continue to govern agent actions.
• Test results against production environments now list routes not tested based on safety concerns. Under Summary > Next Steps > Risk Assessment, you can review the risks and authorize these routes for a later run. A new Safety Overrides section in the app's configuration provides a second chance to remove the routes.
• WebApp tests now report low-severity, non-exploitable security hygiene findings alongside confirmed weaknesses.
• Expanded target-app login techniques now cover SSL VPNs, identity-gated portals, and HTTP Basic and Digest credentials. NodeZero can now maintain authenticated sessions through across longer tests, and now reports when MFA (multi-factor authentication) conditions prevent logins.
• Stored credentials now carry over from authenticated crawling into authenticated fuzzing.
• The Real-Time View (RTV) activity feed now shows requests made by WebApp agents. WebApp results can also feed into Perspectives and Insights, and Insecure Direct Object Reference (IDOR) and Broken Object Level Authorization (BOLA) proofs now appear in PDF reports.
• WebApp crawling and testing are safer and more reliable: Crawlers now reach more application views, respect scope when submitting forms and other non-GET requests, avoid duplicate testing across hostnames, and reduce false positives in path-traversal and XSS (cross-site scripting) checks.

Rapid Response¶

• You can now mute an at-risk advisory. Muted advisories are hidden from the home page. New advisories appear, by default, at the top of the table.
• Rapid Response filters now require all selected tags to match.
• The Rapid Response detail table now includes weakness IDs.

Attack Surface and Vulnerability Coverage¶

• Several tests now provide a Nuclei Scan Intensity (throttling) option to protect fragile assets.
• Several tests now provide a Scope > Exclude TCP Ports option.
• External Asset Discovery (EAD) now reconstructs exposed Git repositories and scans them for sensitive information.
• EAD now captures service banners on non-standard ports, and can identify HTTP services on ports that return an error to HTTPS checks.
• EAD now groups less-used launch options under Advanced, and enables you to limit discovery scope by disabling subdomain-permutation discovery.
• NodeZero can now discover and exploit SQL Server trusted links.

Pentest Scheduling and Configuration¶

• Pentest lists now refresh while tests are queued or running.
• Azure pentests now respect the configured minimum runtime and policies assigned at the tenant or management-group level. Coverage now includes the contents of blobs and file shares in Azure storage accounts.
• Pentests are less likely to disrupt network printers, with additional printer ports excluded from scanning.
• SSO (Single Sign-On) onboarding now works for tenant-isolated client accounts.
• AWS Tripwires are now available in the Federal environment.

Reporting and Vulnerability Management¶

• Engagement Report now support filtering, sorting, and pagination, show a To Do ticket count, and resize charts to fit the page.
• Vulnerability Management Hub now shows WebApp hosts and affected entities, with sorting and an explanation for the Affected Entity column.

Integrations¶

• Integration Router workflows now enable you to choose which entity types to send. Newly supported entity types are no longer added automatically.
• Read-only accounts can now view Jira integration settings.

Host Inventory¶

• Within test results, the Hosts view now includes Process Lists, Installed Programs, and Network Connections tabs.

New Attack Content¶

• Citrix NetScaler ADC and Gateway – CVE-2026-88772. Added coverage for a memory overflow vulnerability that can enable remote code execution or denial of service when DTLS (Datagram Transport Layer Security) is enabled.
• Zammad – CVE-2026-102489. Added coverage for a vulnerability that can enable attackers to compromise Zammad instances.
• Atlassian Data Center – CVE-2026-21589. Added coverage for an arbitrary file access vulnerability.
• Dell OpenManage Server Administrator – CVE-2026-81475. Added coverage for an unauthenticated remote code execution vulnerability.
• AhsayCBS – CVE-2026-105133, CVE-2026-105134. Added coverage for an authentication bypass and Replication Receiver remote code execution vulnerabilities.
• Ivanti Connect Secure – CVE-2026-104935. Added coverage for an authentication bypass vulnerability.
• XWiki Platform – CVE-2026-33137. Added coverage for an unauthenticated remote code execution vulnerability through eXtensible ARchive (XAR) import.
• BeyondTrust Remote Support – CVE-2026-102764. Added coverage for unauthorized file operations.
• Plex Media Server – CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656. Added coverage for SSRF (server-side request forgery) and remote code execution vulnerabilities.
• PHP2Shell – CVE-2026-109618, CVE-2026-109619. Added coverage for vulnerabilities and additional mitigation content.
• AVTECH IP Cameras – CVE-2024-7029. Added coverage for a command injection vulnerability.

Platform Performance & Stability¶

• Session refreshes and agent waits are bounded, to reduce stalls during long tests.

Bug Fixes¶

• Improved links' contrast within PDF reports.
• Fixed Active Directory Agents so they can be updated while in an error state. This enables some updates to clear the errors.
• Fixed asset counts inflated by Fortinet firewalls responding for entire IP blocks.
• Fixed Azure Cloud Connections to handle account display names containing hidden characters, and to handle passwords containing spaces.
• Fixed Perspective builds that failed when a deleted scope was re-created with the same name.
• Fixed Tripwires charts to show an appropriate empty state when no tripwires have been deployed.
• Corrected links in Rapid Response email notifications.