Nmap Engine Upgrade for Vulnerability Management (InsightVM) and Nexpose

As part of our ongoing efforts to strengthen security and improve scan accuracy, we will be upgrading the integrated Nmap engine in both Vulnerability Management (InsightVM) and Nexpose as part of the upcoming August 18, 2025 product update.

Who is affected?

These changes will impact any assets hosting the Security Console or scan engines including:

Local Scan Engines (installed alongside the Security Console)
Distributed Scan Engines

You may be impacted if you run antivirus or firewall software on system where Vulnerability Management (InsightVM)/Nexpose is installed.

If you’re using Managed Consoles or Hosted Scan Engines, no action is required.

What to expect

During previous upgrades, some antivirus tools have mistakenly flagged updated Nmap binaries as threats. This can result in quarantine or deletion, causing scan disruptions. Similar behavior may occur again with the upcoming release.

Recommended actions

To help ensure uninterrupted scanning operations, complete these steps before August 18, 2025:

Review antivirus and firewall settings

Ensure your antivirus or firewall allow the following directories, including all subfolders:

Windows: C:\Program Files\Rapid7\
Linux: /opt/rapid7/

Set up exclusions for future updates

If not already configured, configure exclusions for the Nmap engine for antivirus scanning on all relevant systems. This is important to prevent interference during future updates and to ensure uninterrupted scanning operations. These exclusions should be applied to:

The InsightVM/Nexpose Security Console host machine
All distributed Scan Engine host machines deployed in your environment.

Refer to your antivirus documentation

For guidance on how to add exclusions or allowlist directories, consult your antivirus software’s documentation or support team.

Monitor your scans post-update

We recommend closely monitoring your scan jobs following the update. If you notice missing scans or encounter errors, check your antivirus logs to see if Nmap was blocked.

Additional resources

AV Requirements: InsightVM Quick Start Guide .
Local and Distributed Scan Engine overview: Local Scan Engine and Distributed Scan Engine .

If you have questions or need assistance, contact your Rapid7 Advisor.