October 2026 Release Notes

The Command Platform release notes include information about what’s new, which are updated monthly, and improvements and fixes, which are updated weekly.

ℹ️

Last updated: October 26, 2026

What’s New

Learn about new features across the Command Platform. These features were released over the past month and are available now:

Navigate the Command Platform with a faster, unified experience
SCIM Identity Provisioning
Risk
- Export bulk vulnerability data with any valid API key
- Empower cloud teams with expanded Remediation Hub access
Threat
- Curate your threat intelligence feed with Intelligence Watchlist
- Query malware faster with the new Malware Library

Navigate the Command Platform with a faster, unified experience

The Command Platform’s unified navigation and single platform application are now the default experience for eligible customers. All mainstream products — Vulnerability Management, SIEM, Cloud Security, Attack Surface Management, and Automation — load within a single application, reducing latency and friction when switching between products.

With this update, you can:

Move between products faster using the single platform application, which eliminates page reloads when switching contexts.
Use the redesigned collapsible vertical navigation, which takes up less screen space and displays only the products and capabilities you have access to.
Search for destinations across the platform, with support for legacy product names. For example, searching “IDR” returns SIEM-related results.
Access capabilities only available through Unified Navigation, including Consolidated User Settings, All Findings, All Vulnerabilities, and MDR Threat Hunts.

Impacted offering:

Command Platform

SCIM Identity Provisioning

The Command Platform now supports System for Cross-Domain Identity Management (SCIM), letting you automate account provisioning, updates, and deprovisioning directly from your identity provider (IdP). This eliminates manual account management and reduces the risk of unauthorized access from stale accounts.

With this update in Administration > Settings > SSO Settings, you can:

Automatically provision new employees with Command Platform access as soon as they’re added to your IdP.
Revoke access instantly when a user is removed from your IdP, closing the gap between offboarding and access removal.
Sync role and group changes automatically, keeping permissions aligned with each user’s current role without manual updates.

Impacted offering:

Command Platform

Risk

Export bulk vulnerability data with any valid API key
Empower cloud teams with expanded Remediation Hub access

Export bulk vulnerability data with any valid API key

The Vulnerability Management Bulk Export API no longer requires an organization-level or platform administrator API key. Any valid API key can now authenticate bulk export requests, and returned data is automatically scoped to the permissions of the key used.

With this change, you can:

Use non-admin API keys to call the Bulk Export API without elevated credentials.
Follow least-privilege practices by scoping exports to only the data your key is authorized to access.
Reduce credential sprawl by eliminating the need to provision or share high-privilege admin keys for automated exports.

Impacted offering:

Vulnerability Management

Empower cloud teams with expanded Remediation Hub access

Remediation Hub is now available to all Cloud Security users, and administrator privileges are no longer required. Users inherit their existing Cloud Security access controls, so they only see remediations, assets, and vulnerabilities tied to the resources they’re authorized to view.

With this update in Response & Remediation > Remediation Hub, you can:

Give cloud resource owners direct visibility into prioritized remediation actions without admin involvement.
Reduce bottlenecks by enabling the teams responsible for cloud resources to act on remediations themselves.
Improve collaboration between security and cloud operations teams through shared, role-appropriate remediation data.
Maintain existing access controls while accelerating remediation across your organization.

Impacted offering:

Cloud Security

Threat

Curate your threat intelligence feed with Intelligence Watchlist
Query malware faster with the new Malware Library

Curate your threat intelligence feed with Intelligence Watchlist

In Rapid7 Threat Intelligence, you can now personalize your threat intelligence feed using the new Intelligence Watchlist. By selecting the locations, industries, and threat actors most relevant to your organization, you can focus your intelligence on the threats that matter to your specific security environment.

When a campaign matches your watchlist selections, it receives an Impact score in your Campaigns list, helping you instantly identify and prioritize the threats most relevant to your organization.

With this update in Intelligence > Intelligence Watchlist, you can:

Select specific locations, industries, and threat actors to build a curated threat intelligence feed tailored to your organization.
Surface relevant campaigns with an Impact score directly in your Campaigns list for faster threat prioritization.
Add threat actors to your watchlist directly from the Threat Actors page.

Impacted offering:

Threat Intelligence

Query malware faster with the new Malware Library

Threat Intelligence now includes Malware Profiles as a dedicated content type alongside Campaigns and Threat Actors. The new Malware Library gives you a single place to research malware families curated by Rapid7 Labs, with full context on behaviors, aliases, targeting, and related actors, campaigns, and CVEs.

With this update in Intelligence > Malware Library, you can:

Search and filter 770+ Malware Profiles curated by Rapid7 Labs by type, platform, targeted country, and industry.
Review a family’s aliases, confirmed capabilities, targeted locations, and first and last seen dates in a single profile.
Follow associations from a malware profile to related Campaigns, Threat Actors, CVEs, and IOCs.
View associated malware directly on Campaign and Threat Actor pages, with full bidirectional navigation coming in a follow-on update.
Search logs for IOCs directly from a malware profile to pivot from intelligence context to your own environment in one click.

Impacted offering:

Threat Intelligence

Improvements and Fixes

Keep track of improvements and fixes to core technology.

Application Security (InsightAppSec) and AppSpider

No updates released at this time.

Attack Surface Management (Surface Command)

Version 1.0.947
Version 1.0.946
Version 1.0.945

Version 1.0.947

Software release date: October 21, 2026 | Release notes published: October 21, 2026

Improved:

Connector functions now start faster in busy regions, which shortens import feed runs.
The Add Seeds modal now lists the seeds that are excluded from discovery because they belong to shared infrastructure platforms, such as cloud providers and CDNs.
The Edit Saved Query page now has a delete icon next to Cancel, with the same confirmation as the Saved Queries list.
Vulnerabilities from NIST NVD now use the CVSS v4.0 base score when NVD provides one, and fall back to CVSS v3.1, v3.0, or v2.

Fixed:

EASM certificates now fill the Serial Number field when the data is available.
Renaming a saved query that other saved queries include now fails with an error that names those queries, instead of breaking them.
Restored query panels in the workspace no longer discard an unrun edit. The run prompt stays disabled until you run or discard the edit.
The External Attack Surface Overview dashboard description now names the External Attack Surface Insights (Rapid7) dashboard correctly.

Connectors

The following connectors were updated in the Extension Library since the previous release. Connector updates are published independently and may have been available before this release date.

New Connectors

Asset Panda: Asset Panda is a cloud-based IT Asset Management (ITAM) and asset tracking platform that helps organizations manage hardware, software, and physical inventory throughout their entire lifecycle. This connector imports Assets, People, Locations, Accounts, and Modules from the Asset Panda REST API into the Command Platform. Because Asset Panda is fully schema-flexible, the collections that map to each type and the custom fields that populate key properties are all configurable in Settings.
Sysdig Secure: Sysdig Secure is a cloud-native security platform that provides vulnerability and posture visibility across containers, Kubernetes, and cloud workloads. This connector imports Sysdig Secure assets and vulnerability findings into the Command Platform using your tenant Domain URL and API Token.
Veeam Data Platform: Veeam Backup and Replication is a backup and recovery platform that exposes a REST API for managing backup infrastructure. This connector imports backups, job configurations, inventory objects, managed servers, repositories, and restore points from Veeam Backup and Replication into Surface Command.

Updated Connectors

Infoblox NIOS DDI: Fixed the test connection failing with a 400 error on grids with many records, by requesting one record per endpoint.
KACE Systems Management Appliance:
- Fixed a JSONDecodeError when KACE SMA returns a web page instead of an API response. The connector now reports where the request was redirected.
- The connector now checks the One-Time Password (OTP) setting before it signs in, and explains what is wrong with the setting if it cannot be used.
- Added logging of the OTP setting details that help troubleshoot 2FA problems, without logging the secret.

Version 1.0.946

Software release date: October 14, 2026 | Release notes published: October 14, 2026

Improved:

Imports from connectors that page through large data sets, such as NIST NVD, FIRST EPSS, and Okta, no longer slow down as the run progresses.
The Add Seeds modal now lists the seed formatting rules, and its failure alert states that only ASCII domain names are supported.
The External Attack Surface dashboards are now named External Attack Surface Overview (Unified) and External Attack Surface Insights (Rapid7).

Fixed:

Dashboard widget data no longer fails to refresh when two refreshes of the same data run at the same time.
Exporting widget drill-down results to CSV no longer fails with a server error, and the CSV now matches the table columns.
The asset detail panel now shows the display names of referenced values, such as Server or Linux, instead of their type and ID.
Trend Bar widget previews no longer fail with the error “cannot convert undefined or null to object” when the results contain empty values.

Connectors

The following connectors were updated in the Extension Library since the previous release. Connector updates are published independently and may have been available before this release date.

Updated Connectors

FortiClient EMS: Fixed endpoint imports failing with KeyError ‘total’ when EMS Cloud omits the total count.
Nutanix Prism Central: Fixed a SchemaValidationError on NutanixPrismCentralImage when the type field is absent from the Nutanix API response.
Proxmox Virtual Environment: Normalized VM memory to a string to prevent schema validation errors when Proxmox returns it as an integer.

Version 1.0.945

Software release date: October 7, 2026 | Release notes published: October 7, 2026

Improved:

Connector cards now show an Update Available chip, and the Connectors page has a new Version filter with counts for each option.

Fixed:

Deleting a Domain, IP Address, or CIDR seed with one manual source and tags now shows Delete instead of Delete Manual Source.
Failed import feed executions now show the error that caused the failure instead of a blank status message.
Network services discovered by EASM now show a Service Name when the product version is unknown, and show their Application Protocol.

Connectors

The following connectors were updated in the Extension Library since the previous release. Connector updates are published independently and may have been available before this release date.

Updated Connectors

Microsoft SQL:
- Fixed a schema issue with the Test Connection result.
- Fixed an issue with functions running on Orchestrator.

Cloud Security (InsightCloudSec)

Version 26.10.27
Version 26.10.20
Version 26.10.6

Version 26.10.27

Software release date: October 27, 2026 | Release notes published: October 26, 2026

New Features

Lifecycle Management: Added a new Lifecycle Management page for domain administrators to track and manage deprecated Insights, Compliance Packs, and Query Filters. The page displays deprecation warnings, migration history, and tools to migrate resources from deprecated Insights to their replacements. Domain administrators can export migration history as CSV and view deprecation warnings directly in Query Filter panels and Insight detail views.

Improved

Added the Resource Tags picker to Compliance Scorecard cloud storage subscriptions, so selected tag keys appear as columns in scheduled exports. The picker stays enabled when there are no tag suggestions, so tag keys can still be typed in.
Added an Include all resource tags option to Compliance Scorecard email and cloud storage subscriptions. When enabled, the scheduled export includes an All Tags column containing each resource’s tags as JSON in their original case, reducing the need to maintain a list of tag keys. The option is off by default, and existing exports are unchanged.

Harvester Updates

Azure VMSS Public IPs: Instance-level public IPs, including AKS node IPs, are now harvested as separate resources with new IDs. Existing history, badges, and exemptions for these resources start fresh, so badges and exemptions may need to be reapplied for Azure VMSS Public IPs.

Fixed

Fixed an issue where unchanged Kubernetes pod containers were rewritten the first time they were harvested again.
Fixed an issue with the BotFactory create and edit API endpoints, which no longer fail or save wrong values when optional fields such as category or state are left out.
Fixed an issue where CloudFormation IaC scans skipped AWS::OpenSearchServerless::Collection resources, so Insights using the Resource Not Encrypted Or Encrypted With Cloud Managed Key Query Filter were reported as not applicable. Collections are now evaluated using the key from EncryptionConfig or their matching OpenSearch Serverless encryption policy, and collections using an AWS-owned key are now flagged.
Fixed an issue where Terraform scans flagged ElastiCache replication groups and clusters in a global datastore under the Cache Instance Encryption at Rest and in Transit Disabled Insight, even when in-transit encryption was enabled. The secondary replication group’s in-transit encryption setting is now taken from the primary replication group.
Fixed a false positive in Terraform IaC scans where S3 buckets were flagged for not enforcing secure transport when their bucket policy or other S3 configuration resources referenced the bucket through a local value.
Fixed an issue where access to a cloud account’s resources could be incorrectly allowed or denied for a short time after the account was moved to a different organization.
Fixed an issue where Resource Tag filters returned no results for assessed Kubernetes workloads whose labels were set on their pods.
Updated the Query Filters behind multiple Azure MFA Insights listed below to flag an Azure cloud account only when none of its Conditional Access policies require MFA. One compliant policy protects the tenant regardless of the account’s other, unrelated policies.
- Cloud Account without Multi-Factor Authentication Enabled for Microsoft Admin Portals
- Cloud Account without Multi-Factor Authentication enabled for Windows Azure Service Management API
- Cloud Account without a Conditional Access Policy for Multi-Factor Authentication required for Risky Sign-ins
- Cloud Account without Multi-Factor Authentication report Policies for All Users

Version 26.10.20

Software release date: October 20, 2026 | Release notes published: October 20, 2026

Harvester Updates

Amazon RDS: Now evaluates VPC Security Group configurations across Amazon RDS DB Instances and Clusters (including Aurora) using existing harvested data.

New Insights

Database Instance Without Security Group: Identifies database instances and clusters that do not have an attached security group configured.
Distributed Table Using Provider Default Encryption Key (DynamoDB): Identifies Distributed Tables (including DynamoDB) that use the provider default (AWS owned) key for encryption at rest instead of an AWS managed or customer managed KMS key.
Cache Instance Security Group Allows Ingress From the Public: Identifies cache instances with security groups that allow ingress from the public internet. Mapped to CIS Controls v8.1.2 safeguard 12.2, and to equivalent controls in CMMC Level 1 and 2, NIST SP 800-53 Rev. 5, NIST SP 800-171, and NIST CSF v2.0 Compliance Packs.
Cache Database Cluster Transit Encryption Disabled: Identifies Cache Database Clusters that do not have Transit Encryption enabled. Mapped to CIS AWS Database Services Benchmark control 6.2 and CIS Controls v8.1.2 safeguard 3.10.

Updated Insights

Database Instance Is Not Multi-AZ: Updated for improved accuracy on Microsoft Azure, which can lead to a difference in finding counts. See the Insight description for details.
Database Instance not Encrypted (RDS): Updated to align with style guide standards and support CIS Amazon Web Services Database Services Benchmark v2.0.0 (Control 2.2). Added new compliance mappings for NIST SP 800-53 Rev. 5, NIST SP 800-171 Rev. 2, and CMMC Level 2.
Aurora Database Instance Without Enforced TLS: Added to data-in-transit controls across NIST SP 800-53 Rev. 5 (AC-17(2), IA-5, IA-5(1), SC-8, SC-8(1)), NIST SP 800-171 Rev. 2 (3.1.13, 3.5.10, 3.13.8), NIST CSF v2.0 (PR.DS-02), and CMMC Level 2 (AC.L2-3.1.13, AC.L2-3.1.17, IA.L2-3.5.10, SC.L2-3.13.8, SC.L2-3.13.11, SC.L2-3.13.15) Compliance Packs. Corrected from the mislabeled CIS Controls v8.1.2 control 2.4 to the correct data-in-transit control 3.10 (Encrypt Sensitive Data in Transit).

New Query Filters

Database Instance Without Security Group: Identifies database instances based on whether they have an attached security group. By default, this Query Filter identifies database instances without a security group configured.

Updated Query Filters

Instance With Image Owned Outside Of Organization: No longer flags instances running AMIs shared from accounts that belong to your organization. Custom Insights using this Query Filter may show fewer findings. Public and Community AMIs remain out of scope and can be identified using the Instance Running Unknown Image Query Filter.

Fixed

Fixed an issue where the Azure load balancer harvester crashed on Application Gateways that use a custom SSL policy.
Fixed an issue where the Oracle Cloud database instance harvester crashed on instances with allowlisted IP network rules.
Fixed an issue where unchanged Google Cloud Vertex AI jobs were shown as modified on every harvest.
Fixed an issue where most unchanged Kubernetes objects were shown as modified on every harvest.
Fixed an issue where bot evaluations in a changeset failed after an earlier bot in the same run encountered an error. The job’s final save now completes normally.
Fixed an issue where Azure harvesting did not finish on self-hosted deployments that use a proxy. Requests to Microsoft Graph were not using proxy settings and now do, with no configuration changes needed.
Fixed an issue where MediaAnalysisJobHarvester returned an error in regions that do not have the end-of-life AWS Streaming Video and Bulk Image Analysis service enabled.

Version 26.10.6

Software release date: October 6, 2026 | Release notes published: October 5, 2026

No Release: Version 26.10.13

There will be no Cloud Security (InsightCloudSec) release on October 13, 2026. The next release will be version 26.10.20 on October 20, 2026.

New Features

Released Kubernetes Scanner v5.5.0 with memory improvements. Internal components and their versions are available in the chart value file.
- View data using the helm show values <chart name> | grep -E 'Name:|Version:' command.
- Update using the helm upgrade --install command referenced in the Kubernetes Scanner documentation.

Improved

Improved License page load time for installations with many cloud accounts.

Fixed

Fixed an issue where the Resource Creator attribution job could run concurrent instances in large environments, causing excessive database load and slowing Event-Driven Harvesting. Execution checks now prevent overlapping runs.
Fixed an issue where the AWS IAM delegation SNS webhook did not validate subscription-confirmation URLs before fetching them. URLs are now required to be HTTPS AWS SNS endpoints that resolve to a publicly routable address, redirects are no longer followed, and invalid URLs are rejected with a 400 error without being fetched. No configuration change is required and legitimate AWS SNS notifications are unaffected.
Fixed an issue where AWS:ServiceEventRuleHarvester failed with CLOUD_UNKNOWN_PROVIDER_ERROR when encountering EventBridge event buses encrypted with customer-managed KMS keys (CMK). Unreadable buses are now skipped without failing the harvest for other event buses in the same account.
Fixed an issue where removing the last Azure role assignment or group membership from a user, group, or role was not reflected after harvesting, causing stale Insight findings to persist.
Removed unnecessary license-expiry data from the table in Settings > System Administration > License > License Information.

Mimics Infrastructure as Code (IaC) Scanning Tool

2.3.1
2.3.0

Version 2.3.1

Software release date: October 13, 2026 | Release notes published: October 13, 2026

Important Notes:

This release changes the connection requirements for InsightCloudSec. You may need to update your base URL after upgrading.

HTTPS Required for the InsightCloudSec Base URL: The base URL must now use https. Plain http is only accepted for localhost, 127.0.0.0/8, and ::1. Mimics now rejects an invalid base URL before it starts a scan.
Minimum TLS Version: Connections to InsightCloudSec now require TLS 1.2 or later.

Improved:

Local Evaluation for AWS CloudFormation Query Filters: Mimics now evaluates the “Access List Is Default (Security Group)”, “Application Gateway Endpoint Configuration”, “Application Gateway Protocol”, “Database Cluster With/Without Publicly Available Database Instances”, “Email Service Identity Type”, “Encryption Key Customer Managed”, “Load Balancer With SSL Listener”, “MapReduce Cluster Without Properly Configured Security Config”, “Notification Subscription To Unapproved Email Domain”, “Resource Specific Policy With Negation Key”, “Resource Transit Encryption Enforcement”, “Serverless Function Not Limited To Private Network Resources”, “Serverless Function URL Configurations”, and “Volume Is Not Root Device” Query Filters locally. Findings from these Query Filters include remediation guidance. They are also produced when remote scanning is disabled or when you scan with a custom Insight pack.
Local Evaluation for Azure Terraform Query Filters: Mimics now evaluates the “Resource Lifecycle State” Query Filter locally for Azure Logic App workflows.
Insights Evaluated Through Query Filters: The “Serverless Function not Limited to Private Network Resources” and “Serverless Function URL Configuration Open to the World” Insights (CloudFormation) are now evaluated through their Query Filters, consistent with InsightCloudSec. The “Resource Specific Policy uses NotAction (AWS)” and “Resource Specific Policy uses NotPrincipal (AWS)” Insights now use the “Resource Specific Policy With Negation Key” Query Filter for supported resource types, so each resource is reported only once.
Exception Details in Scan Output: When show_exceptions is enabled, excepted findings now show the exception ID and its notes in command-line output. Findings excepted by an exception rule show the rule ID, for example Excepted by Exception Rule #42: Approved for public website hosting. If an exception has no notes, the output shows “No justification provided”.
Faster Remote Scans: Reduced the time Mimics takes to set up, run, and report remote IaC scans.
Connection Settings in Working-Directory Config Files: Mimics now ignores the base_url, no_verify, and ca_certificate settings, and shows a warning, when they come from a .mimics.yaml file found in the current working directory. Set these with command-line flags, MIMICS_* environment variables, --config-file, or $HOME/.mimics.yaml instead.

Fixed:

False Positive for S3 Buckets That Enforce HTTPS: Fixed a false positive in the “Storage Container Does Not Require Secure Transfer” Query Filter for CloudFormation. Buckets whose policy denies insecure transport with the s3:* action were reported, even though they were configured correctly.
Scan Failure for RDS Clusters With an Explicit Engine: Fixed an error in the “Database Instance/Cluster/Snapshot Engine” Query Filter for CloudFormation that stopped the local scan when a template had an AWS::RDS::DBCluster with an Engine other than aurora-mysql.
Package Upgrades: Upgraded packages for maintenance and security upgrades.

Version 2.3.0

Software release date: September 22, 2026 | Release notes published: October 6, 2026

Improved:

Local Evaluation for AWS CloudFormation Query Filters: Mimics now evaluates the “Backup Vault Allows Access From World”, “Data Analytics Workspace Is/Is Not Primary”, “Email Service Domain DKIM Enabled”, “MapReduce Cluster Without Logging”, “Notification Subscription Protocol”, and “Resource Specific Policy Principal Wildcard Search” Query Filters locally. Findings from these Query Filters now include remediation guidance, and are also produced when remote scanning is disabled or when scanning with a custom Insight pack. The “Data Analytics Workspace Unencrypted at Rest” Insight now uses the “Data Analytics Workspace Is/Is Not Primary” Query Filter, and its findings include updated recommendation text.
Local Evaluation for Terraform Query Filters: Mimics now evaluates the “API Accounting Is Not Encrypted With AWS Key” Query Filter for AWS, and the “Resource Name Regular Expression (Regex)” Query Filter for AWS and Azure, locally, with the same benefits. The “API Accounting is Not Encrypted With CMK (AWS)” Insight now uses the “API Accounting Is Not Encrypted With AWS Key” Query Filter, and its findings include updated recommendation text.

Fixed:

Primary Workgroup Excluded from Data Analytics Workspace Encryption Check: Fixed the “Data Analytics Workspace Unencrypted at Rest” Insight so the AWS-managed primary Athena workgroup is no longer reported when scanning CloudFormation templates, aligning IaC scan results with InsightCloudSec.
Package upgrades: Upgraded dependencies for maintenance reasons and security fixes.

SIEM (InsightIDR)

No updates released at this time.

Vulnerability Management (InsightVM)

8.65.1
8.65.0
8.64.0
8.63.0
8.62.0

Version 8.65.1

Software release date: October 25, 2026 | Release notes published: October 26, 2026

Improved:

Windows PHP detection in authenticated scans: Authenticated scans of Windows assets can now find PHP installed anywhere on disk, not only in the default install paths. Each PHP installation found is reported as its own vulnerability instance. This extends detection of the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). To use it, enable Windows File System Search in your scan template, and make sure your Security Console has content update 1.1.4096 or later.

Version 8.65.0

Software release date: October 24, 2026 | Release notes published: October 26, 2026

This release has been promoted early to allow subsequent release of 8.65.1.

Improved:

Improved the reliability of On-Demand Agent vulnerability scan result integration, ensuring scan data is processed consistently and without interruption, including after Security Console restarts. This enhancement supports more reliable availability of vulnerability results without changes to existing scanning workflows.
Enhanced session security by ensuring all active user sessions are immediately invalidated following a password change, strengthening account protection.
Added built-in policy support for:
- CIS IBM DB2 11 Benchmark v1.2.0, including updated DB2 JDBC driver support.
- CIS Ubuntu 26.04 Benchmark v1.0.0.
Strengthened the overall security posture of the Security Console by upgrading the bundled jsoup library to version 1.23.2.
Enhanced security through stronger input handling in asset search filters and report queries, improving the robustness of these operations.

Fixed:

Resolved an issue where user sessions could unexpectedly expire when navigating from the Rapid7 Command Platform to the Security Console, providing a more seamless experience.
Fixed an issue causing incorrect noncompliance results for kernel module checks 1.1.1.1–1.1.1.5 in the CIS Debian Linux 13 Benchmark v1.0.0, improving policy assessment accuracy.

Version 8.64.0

Software release date: October 19, 2026 | Release notes published: October 19, 2026

Improved:

New policy content: CIS Ubuntu 26.04 Benchmark v1.0.0: Built-in policy content for CIS Ubuntu 26.04 v1.0.0 is now available. You can assess Ubuntu 26.04 systems against the latest CIS hardening guidance.
Stronger handling of Exchange data during ActiveSync discovery: Mailbox information returned by Exchange servers is now validated and handled safely during ActiveSync mobile device discovery.
Stronger access controls for site alerts: Alert settings are now visible only to users with access to the site the alert belongs to.
Bulk Export API accepts all API keys: Exports now honor the access level of the key used to call the API, rather than requiring an organization-level or platform administrator key.

Fixed:

Reverse-paired scan engines going offline after a console restart in FIPS mode: Reverse-paired scan engines (engine-to-console pairing) could stay offline after each Security Console restart when the console ran in FIPS mode. They were rejected until they were paired again. Previously paired engines now reconnect automatically after a restart, with no new shared secret and no engine update. Engines that have never been paired are still rejected.

Version 8.63.0

Software release date: October 12, 2026 | Release notes published: October 12, 2026

Improved:

Credential scan auditing. Credential audit records for SSH key credentials now show the username used, so you can see which account authenticated to each asset.
Scan Assistant 1.9.0: Scan Assistant has been updated to version 1.9.0, which includes an upgrade to its underlying Go runtime to keep the component current and secure.
Reports configured to “Run a recurring report after every scan” no longer regenerate on each Insight Agent data integration with on-demand agent assessment enabled. If you need a regular report that includes agent data, use a scheduled report. This will prevent unnecessary disk usage and console performance degradation.
Java Runtime Environment (JRE) detection on Windows: Fingerprinting now captures the full patched version of JRE installations, such as 25.0.4.1 instead of 25.0.4. This reduces false positive findings on assets running patched builds.
Juniper Junos OS vulnerability checks: Version comparison now works across different Junos release streams. This prevents the potential for checks from being skipped on assets that are actually vulnerable.

Fixed:

Scan start failures with engine-to-console pairing: Scans on reverse-paired scan engines could intermittently fail when scans started simultaneously, with an “engine offline or unavailable” error. The console now detects the stale connection and retries automatically, so these scans start reliably.
Policy assessments for some CIS Windows benchmarks, including CIS Microsoft Windows 11 Enterprise (Level 1) and CIS Microsoft Intune for Windows 11 v4.0.0, reported more rules than the selected benchmark profile contains. Some of those extra rules also appeared as “Not Checked”. Assessments now report rule counts that match the benchmark, so compliance results can be reconciled directly with CIS.
Addressed an issue where targets with a low-confidence OS fingerprint, CIS Windows rules were reported as “Error” instead of “Not Applicable”. They now report “Not Applicable” correctly.

Version 8.62.0

Software release date: October 5, 2026 | Release notes published: October 5, 2026

Improved:

NTLM Authentication — Scan Engine Hostname Now Included in Authentication Requests. The scan engine now correctly identifies itself by hostname when authenticating using NTLM over SMB and HTTP, ensuring scan activity is accurately attributed in security audit logs and Microsoft Defender for Identity (MDI) and eliminating “UNKNOWN” source entries that could cause confusion during security monitoring.
PostgreSQL Version 15.18 now available. Upgrade the console’s internal database to PostgreSQL 15.18, incorporating the stability and security improvements included in this version.
- Note: If you have not previously performed a minor PostgreSQL upgrade, this update is applied automatically when you upgrade to 8.62.0 or restart the console. If you have run a manual minor upgrade in the past, a Global Administrator must apply it manually in Administration > Maintenance > Run Manual Maintenance > Update PostgreSQL. The console will briefly enter maintenance mode during the update — wait for it to complete before refreshing and signing back in.
Oracle JRE — Patched Version Now Correctly Identified on Windows. The full version string for Oracle JRE on Windows is now captured accurately, including the patch segment (for example, 25.0.4.1 rather than 25.0.4), eliminating false positive vulnerability findings for assets running patched JRE builds.
Oracle HTTP Server — Detection Support Added. Authenticated fingerprinting is now supported for Oracle HTTP Server on both Windows and Linux, enabling accurate software inventory and vulnerability assessment for this product.
New CIS Policy Content: CIS Microsoft SQL Server 2025 Benchmark v1.0.0. Built-in policy content for the CIS Microsoft SQL Server 2025 Benchmark v1.0.0 is now available, enabling compliance assessments against the latest CIS hardening guidance for SQL Server 2025.

Fixed:

Resolved Spurious Encryption Warnings for Reverse-Paired Scan Engines. Scan engines configured with Engine-to-Console pairing were generating repeated “Connection to scan engine not encrypted” warnings in the Security Console log, causing unnecessary concern despite the connection being secure — this has been corrected.
Vulnerability Exceptions on Dynamic Asset Groups Causing Scan Instability. An issue where vulnerability exceptions scoped to dynamic asset groups using risk or vulnerability score-based filters could create a self-reinforcing cycle — causing assets to repeatedly enter and exit the group during scans — has been corrected. CVSSv3 score criteria are now restricted when creating exceptions of this type, ensuring consistent, stable scan results.
Check Point GAiA — False Positive Vulnerability Findings for Modern Jumbo Hotfix Packages. Vulnerability scans against modern Check Point GAiA R81.20 environments were generating false positive findings because the fingerprinter did not recognise current Jumbo Hotfix package naming formats, causing the highest installed version to be incorrectly calculated — detection has been updated to accurately identify all current package formats.

Nexpose

8.65.1
8.65.0
8.64.0
8.63.0
8.62.0

Nexpose Version 8.65.1

Software release date: October 25, 2026 | Release notes published: October 26, 2026

Improved:

Windows PHP detection in authenticated scans: Authenticated scans of Windows assets can now find PHP installed anywhere on disk, not only in the default install paths. Each PHP installation found is reported as its own vulnerability instance. This extends detection of the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). To use it, enable Windows File System Search in your scan template, and make sure your Security Console has content update 1.1.4096 or later.

Nexpose Version 8.65.0

Software release date: October 24, 2026 | Release notes published: October 26, 2026

This release has been promoted early to allow subsequent release of 8.65.1.

Improved:

Enhanced session security by ensuring all active user sessions are immediately invalidated following a password change, strengthening account protection.
Added built-in policy support for:
- CIS IBM DB2 11 Benchmark v1.2.0, including updated DB2 JDBC driver support.
- CIS Ubuntu 26.04 Benchmark v1.0.0.
Strengthened the overall security posture of the Security Console by upgrading the bundled jsoup library to version 1.23.2.
Enhanced security through stronger input handling in asset search filters and report queries, improving the robustness of these operations.

Fixed:

Resolved an issue where user sessions could unexpectedly expire when navigating from the Rapid7 Command Platform to the Security Console, providing a more seamless experience.
Fixed an issue causing incorrect noncompliance results for kernel module checks 1.1.1.1–1.1.1.5 in the CIS Debian Linux 13 Benchmark v1.0.0, improving policy assessment accuracy.

Nexpose Version 8.64.0

Software release date: October 19, 2026 | Release notes published: October 19, 2026

Improved:

New policy content: CIS Ubuntu 26.04 Benchmark v1.0.0: Built-in policy content for CIS Ubuntu 26.04 v1.0.0 is now available. You can assess Ubuntu 26.04 systems against the latest CIS hardening guidance.
Stronger handling of Exchange data during ActiveSync discovery: Mailbox information returned by Exchange servers is now validated and handled safely during ActiveSync mobile device discovery.
Stronger access controls for site alerts: Alert settings are now visible only to users with access to the site the alert belongs to.

Fixed:

Reverse-paired scan engines going offline after a console restart in FIPS mode: Reverse-paired scan engines (engine-to-console pairing) could stay offline after each Security Console restart when the console ran in FIPS mode. They were rejected until they were paired again. Previously paired engines now reconnect automatically after a restart, with no new shared secret and no engine update. Engines that have never been paired are still rejected.

Nexpose Version 8.63.0

Software release date: October 12, 2026 | Release notes published: October 12, 2026

Improved:

Credential scan auditing. Credential audit records for SSH key credentials now show the username used, so you can see which account authenticated to each asset.
Scan Assistant 1.9.0: Scan Assistant has been updated to version 1.9.0, which includes an upgrade to its underlying Go runtime to keep the component current and secure.
Java Runtime Environment (JRE) detection on Windows: Fingerprinting now captures the full patched version of JRE installations, such as 25.0.4.1 instead of 25.0.4. This reduces false positive findings on assets running patched builds.
Juniper Junos OS vulnerability checks: Version comparison now works across different Junos release streams. This prevents the potential for checks from being skipped on assets that are actually vulnerable.

Fixed:

Scan start failures with engine-to-console pairing: Scans on reverse-paired scan engines could intermittently fail when scans started simultaneously, with an “engine offline or unavailable” error. The console now detects the stale connection and retries automatically, so these scans start reliably.
Policy assessments for some CIS Windows benchmarks, including CIS Microsoft Windows 11 Enterprise (Level 1) and CIS Microsoft Intune for Windows 11 v4.0.0, reported more rules than the selected benchmark profile contains. Some of those extra rules also appeared as “Not Checked”. Assessments now report rule counts that match the benchmark, so compliance results can be reconciled directly with CIS.
Addressed an issue where targets with a low-confidence OS fingerprint, CIS Windows rules were reported as “Error” instead of “Not Applicable”. They now report “Not Applicable” correctly.

Nexpose Version 8.62.0

Software release date: October 5, 2026 | Release notes published: October 5, 2026

Improved:

NTLM Authentication — Scan Engine Hostname Now Included in Authentication Requests. The scan engine now correctly identifies itself by hostname when authenticating using NTLM over SMB and HTTP, ensuring scan activity is accurately attributed in security audit logs and Microsoft Defender for Identity (MDI) and eliminating “UNKNOWN” source entries that could cause confusion during security monitoring.
PostgreSQL Version 15.18 now available. Upgrade the console’s internal database to PostgreSQL 15.18, incorporating the stability and security improvements included in this version.
- Note: If you have not previously performed a minor PostgreSQL upgrade, this update is applied automatically when you upgrade to 8.62.0 or restart the console. If you have run a manual minor upgrade in the past, a Global Administrator must apply it manually in Administration > Maintenance > Run Manual Maintenance > Update PostgreSQL. The console will briefly enter maintenance mode during the update — wait for it to complete before refreshing and signing back in.
Oracle JRE — Patched Version Now Correctly Identified on Windows. The full version string for Oracle JRE on Windows is now captured accurately, including the patch segment (for example, 25.0.4.1 rather than 25.0.4), eliminating false positive vulnerability findings for assets running patched JRE builds.
Oracle HTTP Server — Detection Support Added. Authenticated fingerprinting is now supported for Oracle HTTP Server on both Windows and Linux, enabling accurate software inventory and vulnerability assessment for this product.
New CIS Policy Content: CIS Microsoft SQL Server 2025 Benchmark v1.0.0. Built-in policy content for the CIS Microsoft SQL Server 2025 Benchmark v1.0.0 is now available, enabling compliance assessments against the latest CIS hardening guidance for SQL Server 2025.

Fixed:

Resolved Spurious Encryption Warnings for Reverse-Paired Scan Engines. Scan engines configured with Engine-to-Console pairing were generating repeated Connection to scan engine not encrypted warnings in the Security Console log, causing unnecessary concern despite the connection being secure — this has been corrected.
Vulnerability Exceptions on Dynamic Asset Groups Causing Scan Instability. An issue where vulnerability exceptions scoped to dynamic asset groups using risk or vulnerability score-based filters could create a self-reinforcing cycle — causing assets to repeatedly enter and exit the group during scans — has been corrected. CVSSv3 score criteria are now restricted when creating exceptions of this type, ensuring consistent, stable scan results.
Check Point GAiA — False Positive Vulnerability Findings for Modern Jumbo Hotfix Packages. Vulnerability scans against modern Check Point GAiA R81.20 environments were generating false positive findings because the fingerprinter did not recognise current Jumbo Hotfix package naming formats, causing the highest installed version to be incorrectly calculated — detection has been updated to accurately identify all current package formats.

Cyber GRC

No updates released at this time.

Digital Risk Protection (Threat Command)

No updates released at this time.

Rapid7 Agent (Insight Agent)

Hotfix Version 4.1.3.49

Hotfix Version 4.1.3.49

Software release date: October 8, 2026 | Release notes published: October 8, 2026

Improved:

Increased scan timeout of the Windows filesystem walk tool (fswalk) from 15 minutes to 30 minutes to reduce failures on assets with larger filesystems. The previous September 24, 2026 release of the Rapid7 Agent initially increased the timeout from 10 minutes to 15 minutes.

Fixed:

Upgraded the cryptography Python library from version 49.0.0 to 50.0.0 on all supported operating systems to address CVE-2026-69247 .

Next-Generation Antivirus

No updates released at this time.

Ransomware Prevention

No updates released at this time.

Velociraptor

No updates released at this time.

Automation (InsightConnect)

No updates released at this time.

Rapid7 Network Sensor (Network Traffic Analysis)

No updates released at this time.