November 2026 Release Notes

The Command Platform release notes include information about what’s new, which are updated monthly, and improvements and fixes, which are updated weekly.

ℹ️

Last updated: November 2, 2026

What’s New

Learn about new features across the Command Platform. These features were released over the past month and are available now:

Get to your favorite pages faster with pinned pages
Attack surface
- Hide false positives and accepted risks with exceptions
- Connect Bulk Export to Microsoft AI tools with MCP

Get to your favorite pages faster with pinned pages

Pin the pages you visit most often to open them from the Pinned section of the left navigation, without searching or expanding menus. Your pins are visible only to you and stay in place across sessions. Each of your first 10 pinned pages also has a keyboard shortcut.

With pinned pages, you can:

Pin up to 15 pages from any section of the left navigation.
Open any of your first 10 pinned pages with a keyboard shortcut: Alt + the number key on Windows or Option + the number key on Mac.
Unpin pages you no longer need.

Where:

Command Home > Pinned

Attack surface

Your attack surface is comprised of all of the potential entry points that attackers could exploit across your systems, applications, and networks. Developing knowledge of your attack surface is a key goal in improving your company’s security posture.

Hide false positives and accepted risks with exceptions
Connect Bulk Export to Microsoft AI tools with MCP

Hide false positives and accepted risks with exceptions

Exceptions let you hide vulnerabilities that are false positives, accepted risks, or covered by compensating controls. Excepted vulnerabilities no longer appear on the Vulnerabilities page, dashboards, or scan details, so your team can focus on the findings that matter most. Create a manual exception for specific vulnerabilities or a rule-based exception that applies to vulnerabilities matching custom conditions, then set an expiration date to keep exceptions current.

With this capability in Findings > Vulnerabilities, you can:

Create manual exceptions for one or more selected vulnerabilities.
Create rule-based exceptions that apply custom conditions and a custom scope.
Set an expiration date by selecting a specific date or a time frame.

Impacted Offerings:

Exposure Command
Application Security

Connect Bulk Export to Microsoft AI tools with MCP

The Bulk Export MCP now supports Microsoft environments, so your team can use Bulk Export data in Microsoft Teams and Agent365 without extra integration work. Documentation and deployment manifests guide you through running the MCP privately on Azure, secured with Microsoft Entra ID. The MCP is now available to all users and returns only the data each user has permission to see.

With this capability, you can:

Deploy the MCP privately and run it locally on Azure, secured with Microsoft Entra ID.
Export software, including browser extensions and vulnerability exceptions.
Give every user access to the MCP, with results limited to their own permissions.

Impacted Offerings:

Exposure Command
Vulnerability Management

Improvements and Fixes

Keep track of improvements and fixes to core technology.

Application Security (InsightAppSec) and AppSpider

No updates released at this time.

Top of page

Attack Surface Management (Surface Command)

No updates released at this time.

Top of page

Cloud Security (InsightCloudSec)

Version 26.11.3

Release availability for self-hosted users

Self-hosted users are able to download the latest version usually 4 business days after SaaS users are upgraded from the following locations:

Terraform deployments: Public S3 bucket . Modules can be updated with the terraform get -update command.
Amazon Elastic Container Repository (ECR) deployments: You can obtain the ECR build images for this version from the InsightCloudSec ECR Gallery

Version 26.11.3

Software release date: November 3, 2026 | Release notes published: November 2, 2026

New Insights

Distributed Table Without Deletion Protection Enabled (DynamoDB): Identifies Distributed Tables (DynamoDB) that do not have deletion protection enabled.
Cache Database Cluster Without Automatic Backups: Identifies Amazon MemoryDB clusters that do not have automatic backups enabled.
Cassandra Table Point-in-Time Recovery (PITR) Disabled (AWS): Identifies Amazon Keyspaces (for Apache Cassandra) tables that do not have Point-in-Time Recovery enabled. Mapped to CIS Controls v8.1.2 control 11.2 (Perform Automated Backups), NIST SP 800-53 Rev. 5 controls CP-9 and CP-10, and NIST CSF v2.0 control PR.DS-11.

Updated Insights

Cache Database Cluster Authentication Disabled: Renamed from Memcache Database Cluster Authentication Disabled. Identifies Amazon MemoryDB clusters that use the default open-access ACL, which allows unauthenticated access.

New Query Filters

Cache Database Cluster Automatic Backups: Identifies Cache Database Clusters based on their automatic backups state.

Harvester Updates

Amazon Keyspaces: Point-in-Time Recovery state is now harvested accurately for Amazon Keyspaces (Cassandra) tables by reading it from the correct API field (pointInTimeRecovery.status).

Improved

Azure Load Balancer Target Visibility: Azure ARM load balancers now report their individual backend targets in the Targets tab and in target-based queries. These are the specific instances or IP addresses behind each load balancer, shown with per-member health. Previously only an aggregate target count was shown with no target-level data. That count may now be lower for some load balancers, because it previously counted each pool membership instead of each distinct machine.

Fixed

Fixed an issue where removing the last IAM role or group membership from a Google Cloud user or group was not reflected after harvesting, causing stale Insight findings to persist.
Fixed saved filter, data collection, and application API issues:
- Updating a saved filter no longer removes global sharing or leaves it marked invalid.
- Viewers can make a global filter their default.
- Deleting a filter clears it as everyone’s default.
- Data collection detailed counts are no longer null.
Fixed several API endpoints for threat findings, compliance, metrics, Gatekeeper, plugins, and bots that ignored filters, returned wrong data, or failed with errors. Cloud metrics now return every CloudWatch datapoint, and statistics that were not requested come back as null instead of causing an error.
Fixed an issue where setting a region to “Don’t assess” in In-region Assessment Mapping (previously “None”) stalled automatic host assessments for the whole organization. The setting now skips hosts in that region only, and stuck assessments now time out so a stalled queue recovers on its own.
Fixed frequent timeouts in AzureArmIdentityDetailHarvester reducing harvest time and CPU use.
Fixed an issue in BotFactory where expanding the Assign Badge To Cloud Account or Delete Badge From Cloud Account action in the Actions panel caused an error, which prevented Bots using these actions from being saved. These actions now open normally and Bots that use them can be created and saved.

Top of page

Mimics Infrastructure as Code (IaC) Scanning Tool

No updates released at this time.

Top of page

SIEM (InsightIDR)

No updates released at this time.

Top of page

Vulnerability Management (InsightVM)

8.66.0

Version 8.66.0

Software release date: November 02, 2026 | Release notes published: November 02, 2026

Improved:

Oracle Database detection on Unix with symbolic link and out-of-place patching support: Detection of Oracle Database has been improved for Unix assets where the Oracle home is a symbolic link, a common result of out-of-place patching. Detection now follows the link to the actual Oracle home, so these databases are identified and assessed accurately without any change to your Oracle configuration.
New policy content: CIS Apple macOS 26 (Tahoe) Benchmark v1.1.0: Built-in policy content for macOS 26 Tahoe has been updated from v1.0.0 to v1.1.0. You can assess macOS Tahoe systems against the latest CIS hardening guidance.

Fixed:

CIS Apache Tomcat 10.1 Benchmark v1.1.0 rules reported as Not Applicable: On Linux systems such as Red Hat Enterprise Linux, rules were reported as Not Applicable even when Apache Tomcat 10.1 was installed and the scan authenticated successfully. This mainly affected manual installs that weren’t installed through the system package manager. The benchmark now detects Tomcat 10.1 whether it was installed through the package manager (RPM or DEB) or manually, so rules are assessed as expected.

Top of page

Cyber GRC

No updates released at this time.

Top of page

Nexpose

8.66.0

Nexpose Version 8.66.0

Software release date: November 02, 2026 | Release notes published: November 02, 2026

Improved:

Oracle Database detection on Unix with symbolic link and out-of-place patching support: Detection of Oracle Database has been improved for Unix assets where the Oracle home is a symbolic link, a common result of out-of-place patching. Detection now follows the link to the actual Oracle home, so these databases are identified and assessed accurately without any change to your Oracle configuration.
New policy content: CIS Apple macOS 26 (Tahoe) Benchmark v1.1.0: Built-in policy content for macOS 26 Tahoe has been updated from v1.0.0 to v1.1.0. You can assess macOS Tahoe systems against the latest CIS hardening guidance.

Fixed:

CIS Apache Tomcat 10.1 Benchmark v1.1.0 rules reported as Not Applicable: On Linux systems such as Red Hat Enterprise Linux, rules were reported as Not Applicable even when Apache Tomcat 10.1 was installed and the scan authenticated successfully. This mainly affected manual installs that weren’t installed through the system package manager. The benchmark now detects Tomcat 10.1 whether it was installed through the package manager (RPM or DEB) or manually, so rules are assessed as expected.

Top of page