August 2026 Release Notes

The Command Platform release notes include information about what’s new, which are updated monthly, and improvements and fixes, which are updated weekly.

What’s New

Learn about new features across the Command Platform. These features were released over the past month and are available now:

• Risk: Cloud Security (InsightCloudSec), Exposure Command
• Threat: SIEM (InsightIDR), Command Platform

Risk

Risk is the potential for loss or damage to your assets, operations, or reputation, due to vulnerabilities being exploited by a bad actor. Security teams must assess the risk level by evaluating the likelihood of a threat occurring and the impact that it would have if realized.

• Simplify compliance mapping with custom rules and a unified workflow
• Investigate runtime alerts faster with AI-generated root cause analysis

Simplify compliance mapping with custom rules and a unified workflow

In Cloud Security (InsightCloudSec) and Exposure Command, a new Map to Compliance Pack action in the Insights Library consolidates pack membership and compliance rule mapping into a single step, replacing the separate Edit Metadata and Add to Custom Pack actions. Custom packs now support user-defined compliance rules, for example, Custom Control 1.3 or Internal Policy 2.1, and can inherit read-only rules from base packs for scalable, consistent governance.

With these updates in Controls & Compliance > Insights, you can:

• Map individual or bulk-selected Insights to a compliance pack and its rules in one step using the Map to Compliance Pack row or bulk action.
• Define, rename, and delete custom compliance rules from the Compliance Rules tab on a custom pack’s detail page, without losing existing Insight mappings.
• Inherit rules from base packs and filter compliance rules by source.
• Automate compliance rule and mapping management programmatically using new API endpoints.

Top of page

Investigate runtime alerts faster with AI-generated root cause analysis

When you review a runtime alert in Cloud Security (InsightCloudSec) and Exposure Command, an AI correlation engine can now assemble the pre-existing posture context that explains why it happened. The AI automatically filters out posture, identity, and vulnerability findings unlikely to be relevant to the runtime event, removing noise and leaving only the signals that support your investigation — no manual tool pivoting required. Relevant findings across vulnerabilities, IAM, public exposure, and compliance controls are then ranked, correlated, and surfaced as a Root Cause Analysis tab in the detection findings details view.

With AI-powered root cause analysis in Findings > Detection Findings, you can:

• View a plain-language AI-generated summary explaining how the workload was likely compromised and the chain of posture gaps that contributed.
• Review a prevention timeline showing how long the oldest contributing posture gap existed before the alert fired.
• Prioritize investigation using a ranked list of contributing factors with causal confidence scores.
• Review an overview of the affected asset as it existed at the time of the alert, providing context for how the incident occurred.

Top of page

Threat

A threat is any potential event or action that could exploit vulnerabilities in a system, causing harm to assets, data, or operations. Threats can originate from various sources, including malicious actors, natural disasters, or unintentional human errors.

• Get a quick overview of your environment with the AI Summary Card
• Search events using event time (phased rollout)
• Improved AI-powered query generation

Get a quick overview of your environment with the AI Summary Card

In SIEM (InsightIDR) and the Command Platform, the Detection & Response Dashboard now includes an AI Summary Card for MDR customers. The card provides an AI-generated summary of the most significant detections, trends, and changes in your environment since your last dashboard visit, helping you understand what’s changed without reviewing every widget.

With this enhancement to the Detection & Response Dashboard from Command Home, you can:

• Review the most significant activity in your environment with a synthesized headline.
• Quickly understand key detections and trends through 3 AI-generated insights based on live dashboard data.
• Verify each insight using links to the source dashboard widgets for greater transparency.
• Spend less time reviewing dashboard data and more time investigating the activity that matters most.

Top of page

Search events using event time (phased rollout)

In SIEM (InsightIDR), we’re beginning a phased rollout of default event time support in Log Search. You can now search events based on when the activity occurred according to the source data, not just when the event was ingested into SIEM (InsightIDR). This makes it easier to reconstruct timelines and understand the sequence of events during an investigation. If an event time isn’t provided by the log source, Log Search continues to use the ingestion time.

With this capability in Log Search, you can:

• Search for events based on when they occurred instead of when they were ingested.
• Investigate delayed or historical log data, including logs uploaded after an incident or received from cloud and SaaS integrations with ingestion delays.
• Build more accurate timelines by searching activity in the order it occurred.

Top of page

Improved AI-powered query generation

In SIEM (InsightIDR), we’ve enhanced AI-powered query generation in Log Search to better interpret natural language prompts and reduce the manual effort required to build searches.

AI-powered query generation can now:

• Automatically interpret natural language time expressions — such as “yesterday” or “last 24 hours” — and apply the appropriate time range to the search.
• Suggest relevant log sources and event source types based on the intent of your prompt.
• Provide a more detailed AI Query Explanation that includes the selected time range and log sources, making it easier to understand how your prompt was translated into a search query.

These improvements help you create more accurate searches faster while providing greater transparency into how AI interprets your requests.

Top of page

Improvements and Fixes

Keep track of improvements and fixes to core technology.

Application Security (InsightAppSec) and AppSpider

Version 7.5.028

Software release date: July 31, 2026 | Release notes published: July 31, 2026

New Features:

• Out-of-Band Host Header Injection (DNS Redirect) - Added a dedicated OOB attack module to detect DNS Redirect vulnerabilities by injecting callback domains into Host, X-Forwarded-Host, X-Host, X-Forwarded-Server, and RFC 7239 Forwarded headers. Features raw socket delivery to bypass WinInet constraints and direct Host header replacement. Findings based on DNS-only evidence are assigned Medium confidence.
• AI Vulnerability Validator:
  • SQL Injection - Integrated automated LLM verification using AWS Bedrock to automatically assess and validate SQL Injection findings, filtering out false positives and reducing manual triage effort.
  • Remote File Inclusion - Added AWS Bedrock AI validation to the Remote File Inclusion module to confirm successful exploitation prior to reporting, eliminating false positives from unexploited payload reflections.
• Windows Implicit Authentication Support - Added NTLM, Kerberos, and Negotiate authentication support for Chromium-based scans accessing internal target hosts using default Windows credentials.

Improved:

• Application Security Scan Engine

  • Session Fixation Module - Remediated false positives involving claims-based ASP.NET Core cookies, corrected a bug where cookie value modification was not properly tested, and enhanced finding reporting to explicitly isolate vulnerable cookies when multiple exist in a single request.
  • Dynamic Memory Management - Implemented dynamic memory caching controls within the Scan Engine to optimize resource allocation and prevent scan failures caused by insufficient memory.
  • Header Sanitization - Injected HTTP request headers are now automatically sanitized to strip leading and trailing whitespace characters.
  • Binary Content-Type Blocking - Fixed wildcard matching for binary content-types without file extensions to ensure they are consistently blocked during scans.
  • LLM Shadow DOM Analysis - Upgraded response extraction routines to capture Shadow DOM content during LLM security evaluations.
  • Runtime Maintenance - Upgraded the installed .NET runtime dependency from version 8.0.19 to 8.0.29 with subcomponent verification checks.
  • Attack Data Defs - Updated analyze profiles to include detection for recent Drupal platform releases.

• R7 Crawler

  • Service Worker Coverage - Enhanced loggedInHeaderRegex evaluation logic to inspect service worker network traffic.
  • Storage State Conversion - Improved conversion and persistence mechanisms for localStorage, sessionStorage, and indexedDB browser state values.
  • Cookie Error Handling - Invalid cookies encountered during crawling are now flagged in R7Crawler logs and safely ignored rather than triggering execution errors.

Fixed:

• R7 Crawler
  • Client Certificate Authentication - Fixed an issue where PFX client certificates were not consistently applied during login macro execution sequences.

Top of page

Attack Surface Management (Surface Command)

• Version 1.0.937
• Version 1.0.933

Version 1.0.937

Software release date: August 19, 2026 | Release notes published: August 19, 2026

Improved:

• Built-in correlation rule names and descriptions now provide greater clarity regarding their impact on asset correlation.

Connectors

The following connectors were updated in the Extension Library  since the previous release. Connector updates are published independently and may have been available before this release date.

New Connectors

• Nagios XI: Nagios XI is an enterprise IT infrastructure monitoring platform that provides visibility into the status of hosts, services, and network devices across an environment. This connector synchronizes host and host group details from Nagios XI into the Rapid7 Platform.

Updated Connectors

• Microsoft Defender: Fixed an issue where logon-user enrichment failed the entire feed when a machine lookup returned a 404 response. Missing machine records no longer interrupt feed processing.
• SUSE Manager: Fixed a schema validation error for handling date time.

Version 1.0.933

Software release date: August 11, 2026 | Release notes published: August 12, 2026

Improved:

• Breadcrumb positioning on Reference List and Edit Saved Query pages is now consistent with other parts of Rapid7 platform.
• The Hyper-V Media Access Control (MAC) address prefix 00:15:5d is no longer used for correlation, preventing false-positive asset merging.

Fixed:

• Bulk updates for asset testing statuses now process reliably across large batches (Vector Command only).

Connectors

The following connectors were updated in the Extension Library  since the previous release. Connector updates are published independently and may have been available before this release date.

New Connectors

• ControlUp DEX: ControlUp is a Digital Employee Experience (DEX) platform that provides real-time monitoring, management, and remediation of endpoint devices. It collects telemetry from managed devices including health scores, hardware details, operating system information, and connectivity status. This connector imports device inventory and platform user data from ControlUp for Desktops into Rapid7 Surface Command, enabling unified visibility of endpoint health and management posture.
• CyCognito: CyCognito is an external attack surface management (EASM) platform that continuously discovers, tests, and prioritizes security risks across your organization’s internet-exposed assets. This connector imports IP addresses, domains, certificates, web applications, IP ranges, and security issues from the CyCognito API into Surface Command.

Updated Connectors

• AWS EC2:
  • Added new AwsCustomerOwnedIp type.
  • Resolved a SchemaValidationError for customer-owned IPs.
• Asimily Risk Management: Added a source request header.
• Check Point Harmony Endpoint: Added support for asynchronous job responses by polling GET /v1/jobs/{jobId} until the job completes.
• Halcyon: Fixed a data issue with HalcyonDeploymentGroup.
• IGEL UMS:
  • Set asset_class to Workstation for IgelUmsDevice.
  • Mark id as required in the YAML type schemas.
• PDQ Deploy and Inventory: Enabled SMB message signing and SMB3 encryption negotiation when connecting to the PDQ Inventory server.
• ServiceNow: Improved import-feed performance.
• Snowflake: Updated snowflake-connector-python to 4.7.1 to resolve CVE-2026-15925.
• Snyk: Migrated to the new import-feed mechanism.
• VMware vCenter: Hid vCenterTagAssociation from the graph view.

Top of page

Cloud Security (InsightCloudSec)

• Version 26.8.18
• Version 26.8.11

Version 26.8.18

Software release date: August 18, 2026 | Release notes published: August 17, 2026

Fixed

• Fixed CloudFormation handling of list properties so Fn::If branches evaluating to AWS::NoValue are omitted, preventing tag conversion failures that previously caused affected resource types to be dropped.
• Fixed an issue where the OCI ServiceUserHarvester could exhaust a tenancy’s global IAM API rate limit, causing harvest jobs to stall and repeatedly fail across regions. IAM group memberships are now fetched per group instead of per user resulting in fewer API calls, and throttled requests are retried with exponential backoff that honors Oracle’s Retry-After header. Harvests now complete reliably without overrunning IAM rate limits.
• Fixed an issue where updating authentication credentials on an OCI account (for example, rotating an API signing key) applied the change to the top-level tenancy only. Compartment harvesting continued using the original credentials and would fail until the account was deleted and re-added. Authentication changes now propagate automatically to all compartments on the next harvest cycle, with no manual per-compartment update or account re-onboarding required.
• Fixed the Serverless Function Invalid Diagnostic Logging Configuration (Azure) Insight. This Insight no longer falsely flags serverless functions whose parent Function App has valid FunctionAppLogs diagnostic settings configured.
• Fixed an issue where clearing disabled_regions on a harvesting strategy failed to refresh the in-memory strategy object, keeping harvesting permanently disabled for affected AWS regions across assigned accounts.

Updated Insights

• Updated Distributed Table without Network Access Restrictions for CIS benchmark control 3.1 and mapped to CIS Controls v8.1.2 safeguard 12.2. Added to equivalent controls in Azure Security Benchmark v3, NIST SP 800-53 Rev. 5, NIST SP 800-171, and CMMC Level 1 and 2 packs.
• Updated Distributed Table Not Using Private Endpoints for CIS benchmark control 3.2 and mapped to CIS Controls v8.1.2 safeguard 12.2. Added to equivalent controls in CMMC Level 1 and 2, NIST 800-53 Rev 5, NIST 800-171, NIST CSF 2.0, and Azure Security Benchmark v3 compliance packs.

Version 26.8.11

Software release date: August 11, 2026 | Release notes published: August 11, 2026

Improved

• Enhanced Azure Cache for Redis compliance coverage by mapping existing TLS 1.2 insights to additional NIST, CMMC, NIST CSF, and Microsoft Cloud Security Benchmark controls.
• Enhanced the Cache Instance Exposed to the Public (Azure) Insight to align with CIS Azure Database Services Benchmark v2.0.0 Control 2.6, and expanded compliance mappings across NIST SP 800-53 Rev. 5, Microsoft Cloud Security Benchmark, and CMMC frameworks.
• Enhanced the Cache Instance Not Using a System Assigned Managed Identity Insight to align with NIST SP 800-53 Rev. 5 and Microsoft Cloud Security Benchmark compliance mappings, and enhanced the bot notification workflow with the required 5-step remediation guidance.
• Updated CIS benchmark mappings for the Azure Cache for Redis Microsoft Entra Authentication Insight with corrected CIS v8.1.2 control alignment and added equivalent mappings across NIST 800-53, NIST CSF, and Microsoft Cloud Security Benchmark frameworks.
• Faster load times for the Cloud Security Insights Library, now paginated by default with a toggle to revert to the classic view.
• Updated Mimics version from 2.1.0 to 2.2.0.
• Introduced security enhancements to the product.

New Resources

• Added support for harvesting Managed Identity configurations (system-assigned and user-assigned) and linked services credential storage method for Azure Data Factory resources.

New Compliance Packs

• Added the CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 compliance pack for Kubernetes EKS clusters.
• Added the CIS Google Kubernetes Engine (GKE) Benchmark v1.9.0 compliance pack for GKE clusters.
• Added the CIS Red Hat OpenShift Container Platform Benchmark v1.9.0 compliance pack for OpenShift clusters.
• Added the CIS AWS Compute Services Benchmark v1.1.0 compliance pack covering EC2, EBS, ECS, Lambda, Lightsail, Elastic Beanstalk, Fargate, Batch, App Runner, and SimSpace Weaver services. The pack includes 47 Insights mapped to CIS benchmark controls for AWS, AWS GovCloud, and AWS China regions.

New Insights

• Data Factory without Customer Managed Key Encryption: Identifies Data Factories that are not encrypted at rest using Customer Managed Keys.
• Data Factory without Managed Identity: Identifies Data Factories that do not have a Managed Identity configured.
• Data Factory Linked Services Not Using Key Vault for Credentials: Identifies Data Factories where linked services store credentials inline rather than in Azure Key Vault.
• PostgreSQL Database Instance without Customer Managed Key Encryption: Identifies PostgreSQL Database Instances that are not configured to use Customer Managed Keys for encryption.
• Aurora Database Cluster Encryption at Rest Disabled: Identifies Aurora Database Clusters that do not have encryption at rest enabled.
• DocumentDB Database Cluster Encryption at Rest Disabled: Identifies DocumentDB Database Clusters that do not have encryption at rest enabled.
• Cache Instance SSL Access Not Enforced: Identifies Azure Cache for Redis instances that do not enforce SSL-only access, aligned with CIS Azure Database Services Benchmark Control 2.2.

New Query Filters

• Data Factory with/without Managed Identity: Identifies Data Factories based on whether they have a Managed Identity configured. By default identifies Data Factories without a Managed Identity configured.
• Data Factory Linked Services Use Key Vault: Identifies Data Factories based on whether linked services store credentials in Azure Key Vault. By default identifies Data Factories where linked services store credentials inline rather than in Azure Key Vault.

Fixed

• Disabling a resource type on a cloud account now schedules its already-harvested resources for deletion (which are recoverable by re-enabling harvesting), preventing stale data and false positives.
• Fixed duplicate resource_id and image_id columns in the vulnerability report CSV export.
• Replaced the Cloud Account without Cloud Guard Enabled in Root Compartment (Oracle) Insight in the AWS Foundational Security Best Practices pack with the correct AWS Insight (Cloud Region without Guard Duty Enabled).
• Fixed an issue where large payloads caused the Azure TemplateSpecHarvester to fail.
• Fixed incorrect behavior in the Resource Web Application Firewall Rule Name Regular Expression Search query filter.
• Fixed false positive in IaC scans via the API where the Cache Instance Transit Encryption Disabled Insight incorrectly reported a failure even when TransitEncryptionEnabled was set to true in the template.
• Fixed an issue with the ingestion of the EndpointManagement field from the AWS MWAA.
• Fixed an issue where a missing member email may cause the GCP DomainGroupHarvester to fail.
• Fixed an issue where Azure Conditional Access Policies whose names contain colons (e.g. “Microsoft-managed: Multifactor authentication for admins”) could not be viewed in the UI and clicking them returned a 404 error. Policy names are now URL-encoded in resource IDs, resolving the 404 error. Existing policies are fixed automatically on the next harvest cycle.
• Fixed an issue in the Exceptions page where bulk edit can fail if no end date is selected.
• Fixed an issue where after deleting Kubernetes clusters, Kubernetes Control Plane stayed in the database.
• Fixed an issue where Insights added to a compliance pack using the “Map to Compliance Rule” action were not reflected in IaC scan results until a background sync ran. IaC scans now pick up these changes immediately.
• Fixed a scoping issue where users scoped to selected cloud accounts did not see cloud accounts on the Kubernetes Clusters page.
• Fixed an issue where the Serverless Function Invalid Diagnostic Logging Configuration (Azure) Insight falsely flagged serverless functions whose parent Function App had valid FunctionAppLogs diagnostic settings configured.

Top of page

Mimics Infrastructure as Code (IaC) Scanning Tool

• 2.2.0

Version 2.2.0

Software release date: August 4, 2026 | Release notes published: August 3, 2026

Improved:

• New AWS CloudFormation Query Filters for Port and Protocol Detection: Added CloudFormation support for the “Instance Exposing Specific Port/Protocals” and “Instance Exposing All Ports” Query Filters to help identify network exposure risks in AWS infrastructure.

Fixed:

• Security Dependency Updates: Updated various dependencies to address CVE security vulnerabilities.
• IMDSv1 Insight Naming Consistency: Resolved a naming inconsistency in the “Instance Allows Use Of Vulnerable IMDSv1 Protocol” Insight output for improved clarity and consistency.
• IMDSv2 Enforcement Detection for AWS EC2 Instances: Fixed a false positive where the IaC scanner incorrectly flagged AWS EC2 instances for the “Instance Allows use of Vulnerable IMDSv1 Protocol” Insight. The scanner now correctly recognizes IMDSv2 enforcement (http_tokens = "required") when applied directly to the instance resource, rather than only checking within launch templates.
• Azure Storage Secure Transfer Requirement Detection: Fixed false positives for the “Storage Container Does Not Require Secure Transfer” Insight when scanning Terraform configurations.
• Exception Rule Processing for Direct Insights: Fixed a bug where Insights that were directly defined were being ignored by exception rules, ensuring that exceptions are now applied correctly across all Insight types.
• ElastiCache Encryption Detection for Global Replication: Fixed IaC scan detection for the “Cache Instance not enforcing encryption at rest” Insight. Secondary clusters now correctly inherit encryption configuration from their global replication group.
• SQS Encryption Detection with KMS Keys: Updated the “Message Queue Encryption At Rest Disabled” Query Filter to correctly handle SQS queues encrypted with KMS keys.

Top of page

SIEM (InsightIDR)

No updates released at this time.

Top of page

Vulnerability Management (InsightVM)

• 8.56.0
• 8.55.0
• 8.54.0

Version 8.56.0

Software release date: August 24, 2026 | Release notes published: August 21, 2026

Improved:

• The Java runtime (Azul Zulu JDK 17) bundled with the InsightVM console and scan engine has been updated from version 17.0.18 to 17.0.20 improving the overall security posture of the Security Console.

Fixed:

• Fixed an issue where some customers experienced report generation failures when running reports that include a Baseline Comparison section (for example, Executive Overview, Audit Report). This occurred when certain internal vulnerability identifiers exceeded an expected length limit, causing the report to fail. Baseline Comparison reports now generate successfully regardless of vulnerability identifier length.
• Fixed an issue on the Filtered Asset Search page where typing a filter value and clicking Search without first leaving the input field could send an empty filter and return unfiltered, all-asset results. The filter is now always applied correctly.
• Fixed an issue where users navigating from the Insight Platform (or Exposure Analytics) to the Security Console were sometimes unexpectedly redirected to the login page, especially if they had previously visited the console directly. This occurred because leftover session data was being incorrectly interpreted as invalid. Users now are correctly taken directly to the Security Console without being logged out.

Version 8.55.0

Software release date: August 17, 2026 | Release notes published: August 17, 2026

Improved:

• Added authenticated fingerprinting for Oracle Database, enabling identification of the installed Oracle Database version and associated patches for more accurate vulnerability assessment.
• Improved the Security Console scheduler to provide more reliable handling of scheduled tasks, including jobs responsible for integrating data into the Console.

Fixed:

• Resolved a false positive for ‘Obsolete version of Microsoft MSXML 4’ on 64-bit Windows assets where MSXML 4 was installed but not represented in the software inventory.
• Fixed an issue where scan result files and directories were not removed from Windows Scan Engines after scan completion, preventing unnecessary accumulation of residual scan data.
• Resolved an issue where CSV Export reports could display incomplete or inconsistent Site Names for assets associated with multiple sites.

Version 8.54.0

Software release date: August 10, 2026 | Release notes published: August 6, 2026

Improved:

• Resolved a false positive in the Oracle WebLogic default password check, which previously reported that the default administrator password was in use based on page content that appears both before and after authentication, meaning assets were flagged despite the default password being changed. The check now reports a finding only when the default password is genuinely still in use.
• Resolved false positives on Microsoft 365 Apps assets where the update channel is managed centrally through Cloud Update or Group Policy. Previously the update channel was determined from the legacy ClickToRun registry values only, which can report a stale channel. Affected assets were then assessed against the wrong channel’s version thresholds and reported as vulnerable even when fully up to date. Microsoft 365 Apps assets are now assessed against their correct, effective update channel.
• Restored report download compatibility for third-party integrations using API v3. A stricter request validation introduced in version 8.48.0 caused the report download endpoint to return an HTTP 406 error to any client that did not send a matching Accept header. This prevented reports from being retrieved by integrations including the Rapid7 Nexpose Technology Add-On for Splunk. The stricter validation has been reverted, and affected integrations can download reports successfully again with no configuration changes required.

Fixed:

• Resolved a false positive where Linux assets running IBM MQ were incorrectly identified as standalone IBM WebSphere Application Server (WAS) Liberty installations. Because IBM MQ ships with an embedded Liberty runtime, affected assets were reported against IBM WAS vulnerabilities that did not apply to them. Scanning now distinguishes IBM MQ’s embedded runtime from genuine WebSphere Liberty installations, removing these false positives while continuing to fingerprint legitimate Liberty installs.
• Resolved an issue where On-Demand Agent scans could return a failure result even though the Rapid7 Agent was online and the scan itself completed successfully. If an asset had previously been deleted and re-created, the Security Console retained more than one record linking the Rapid7 Agent to an asset, and the scan results could not be ingested as a result. The Security Console now reads only the current agent-to-asset mapping, so On-Demand scan results are ingested and displayed reliably.
• Resolved an issue where selecting the Rapid7 icon in the top-left of the Security Console returned the error “User validation failed: user is null or SSO is not enabled” instead of opening the Rapid7 Command Platform. The icon now navigates directly to the Command Platform for all users.

Top of page

Nexpose

• 8.56.0
• 8.55.0
• 8.54.0

Version 8.56.0

Software release date: August 24, 2026 | Release notes published: August 21, 2026

Improved:

• The Java runtime (Azul Zulu JDK 17) bundled with the InsightVM console and scan engine has been updated from version 17.0.18 to 17.0.20 improving the overall security posture of the Security Console.

Fixed:

• Fixed an issue where some customers experienced report generation failures when running reports that include a Baseline Comparison section (for example, Executive Overview, Audit Report). This occurred when certain internal vulnerability identifiers exceeded an expected length limit, causing the report to fail. Baseline Comparison reports now generate successfully regardless of vulnerability identifier length.
• Fixed an issue on the Filtered Asset Search page where typing a filter value and clicking Search without first leaving the input field could send an empty filter and return unfiltered, all-asset results. The filter is now always applied correctly.

Version 8.55.0

Software release date: August 17, 2026 | Release notes published: August 17, 2026

Improved:

• Added authenticated fingerprinting for Oracle Database, enabling identification of the installed Oracle Database version and associated patches for more accurate vulnerability assessment.
• Improved the Security Console scheduler to provide more reliable handling of scheduled tasks, including jobs responsible for integrating data into the Console.

Fixed:

• Resolved a false positive for ‘Obsolete version of Microsoft MSXML 4’ on 64-bit Windows assets where MSXML 4 was installed but not represented in the software inventory.
• Fixed an issue where scan result files and directories were not removed from Windows Scan Engines after scan completion, preventing unnecessary accumulation of residual scan data.
• Resolved an issue where CSV Export reports could display incomplete or inconsistent Site Names for assets associated with multiple sites.

Version 8.54.0

Software release date: August 10, 2026 | Release notes published: August 6, 2026

Improved:

• Resolved a false positive in the Oracle WebLogic default password check, which previously reported that the default administrator password was in use based on page content that appears both before and after authentication, meaning assets were flagged despite the default password being changed. The check now reports a finding only when the default password is genuinely still in use.
• Resolved false positives on Microsoft 365 Apps assets where the update channel is managed centrally through Cloud Update or Group Policy. Previously the update channel was determined from the legacy ClickToRun registry values only, which can report a stale channel. Affected assets were then assessed against the wrong channel’s version thresholds and reported as vulnerable even when fully up to date. Microsoft 365 Apps assets are now assessed against their correct, effective update channel.
• Restored report download compatibility for third-party integrations using API v3. A stricter request validation introduced in version 8.48.0 caused the report download endpoint to return an HTTP 406 error to any client that did not send a matching Accept header. This prevented reports from being retrieved by integrations including the Rapid7 Nexpose Technology Add-On for Splunk. The stricter validation has been reverted, and affected integrations can download reports successfully again with no configuration changes required.

Fixed:

• Resolved a false positive where Linux assets running IBM MQ were incorrectly identified as standalone IBM WebSphere Application Server (WAS) Liberty installations. Because IBM MQ ships with an embedded Liberty runtime, affected assets were reported against IBM WAS vulnerabilities that did not apply to them. Scanning now distinguishes IBM MQ’s embedded runtime from genuine WebSphere Liberty installations, removing these false positives while continuing to fingerprint legitimate Liberty installs.
• Resolved an issue where On-Demand Agent scans could return a failure result even though the Rapid7 Agent was online and the scan itself completed successfully. If an asset had previously been deleted and re-created, the Security Console retained more than one record linking the Rapid7 Agent to an asset, and the scan results could not be ingested as a result. The Security Console now reads only the current agent-to-asset mapping, so On-Demand scan results are ingested and displayed reliably.
• Resolved an issue where selecting the Rapid7 icon in the top-left of the Security Console returned the error “User validation failed: user is null or SSO is not enabled” instead of opening the Rapid7 Command Platform. The icon now navigates directly to the Command Platform for all users.

Top of page

Digital Risk Protection (Threat Command)

No updates released at this time.

Top of page

Rapid7 Agent (Insight Agent)

No updates released at this time.

Top of page

Next-Generation Antivirus

No updates released at this time.

Top of page

Ransomware Prevention

No updates released at this time.

Top of page

Velociraptor

No updates released at this time.

Automation (InsightConnect)

No updates released at this time.

Top of page

Insight Network Sensor (Network Traffic Analysis)

No updates released at this time.

Top of page