UPDATE 2026-10-15: This has now been released to production with version “2026-10-14_01“

We would like to inform you about a larger Virus Definition File (VDF) update than usual, scheduled for October 13, 2026.

What does this update mean?

As part of the regular maintenance cycle, the signature database is periodically reorganized — approximately twice a year. This update signifies that affected endpoints will download a larger, refreshed signature base of up to 130 MB, compared to the usual few KB to few MB size of standard updates.

Standard updates will resume immediately afterward, returning to their normal size.

Update Details

• Platform coverage: This update applies to all WithSecure Endpoint Protection products — across Windows, Mac, and Linux platforms that utilize the Capricorn engine.

Deployment

• The update will be delivered automatically through the regular VDF update mechanism.
• Updates containing this release will start with “WithSecure Capricorn Engine (2026-10-xx-xx)”.

We would like to inform you about an upcoming change to the TLS certificates used by the WithSecure GUTS2 Server (definition update backend), planned for May 19, 2026.

We are transitioning from DigiCert to Let’s Encrypt certificates. This update aligns our backend infrastructure with our existing services, where Let’s Encrypt is already in use, and helps us streamline certificate management while maintaining industry‑standard security practices.

What does this mean for you?

• No changes are expected for the majority of environments.
• The change will be transparent if your system trusts the ISRG Root X1 certificate (the root certificate used by Let’s Encrypt).

Common environments where no action is required:

• Windows systems with Windows Update enabled
• Environments where automatic root certificate updates are allowed (not restricted by GPO / MDM policies)
• Systems where ISRG Root X1 is not explicitly removed or blocked

When action may be needed:

• Systems with restricted certificate updates
• Environments with custom trust stores
• Devices where ISRG Root X1 is missing or not trusted

In such cases, please ensure that the ISRG Root X1 root certificate is present in your trust store.

WithSecure products currently require the following root certificates for TLS communication to WithSecure backends, therefore must be present on all machines, across all Operating Systems:

• Amazon Root CA 1 
• Amazon Root CA 2 
• Amazon Root CA 3 
• Amazon Root CA 4
• Starfield Class 2 Certification
• Starfield Services Root Certificate Authority – G2 
• DigiCert Global Root CA 
• ISRG Root X1
• ISRG Root X2

All of these are included in the default trust stores of modern, up-to-date operating systems and should not require manual installation in the majority of deployments.

UPDATE 2026-05-13: This has now been released to production with version “2026-05-13_01“

We will soon be releasing a major update for our Capricorn engine, used by our Endpoint Protection products. This is expected to be released on May 12th 2026. 

This will result in a larger download as an updated version of the virus definition files are distributed. 
 

 
Key improvements 

Optimized databases through consolidation of overlapping detections, resulting in: 

• Smaller footprint: Size on disk expected to decrease by ~160MB, decreasing by about half. 
• Faster updates and reduced initialization disk I/O due to reduced database size 

Update Details 

• Platform coverage: This update applies to all WithSecure Endpoint Protection products — across Windows, Mac, and Linux platforms that utilize the Capricorn engine. 
• Download size: All affected endpoints will now download a larger one-time update package of approximately 130-150 MB during the rollout. 

Deployment 

• The update will be delivered automatically. 
• No manual action or configuration is required. 
• The release time will be confirmed 24 hours in advance through our community channels. 
• Updates containing this release will start with “WithSecure Capricorn Engine (2026-05-xx-xx)”. 
• With this update, you can expect leaner, faster, and more efficient endpoint protection — without compromising security. 

We have now released a hotfix for the Windows and Linux versions of WithSecure Policy Manager 16.11.

This hotfix addresses a vulnerability on the Axios library used by Policy Manager Web Reporting.

WithSecure Policy Manager is not itself vulnerable, but we strongly advise our partners and customers to update to Hotfix 1 at their earliest opportunity.

The hotfix can be found at Policy Manager support pages, for both Windows and Linux.

For more information on the Axios vulnerability itself, please see https://community.withsecure.com/announcements-en/kb/articles/32898-cve-2026-40175-for-axios-javascript-library

This notice relates to an upcoming release of Ultralight core that is expected to go to GA production on Thursday the 16th of April 2026. 

During deployment, the update process may take slightly longer than usual, and in some cases the end-user might see a warning pop-up notification momentarily while the update is in progress. 

Third-party monitoring or compliance tools may also observe temporary warning messages or a brief change in compliance status during the update.  

This is expected while the update is in progress and should return to normal once the update is completed. 

If the pop-up remains visible or the update does not complete after a reasonable period, please contact your support channel for assistance. 

UPDATE – December 22, 2025:

The new platform is live and available as of December 22, 2025.

The old platform will be shut down on December 31, 2025.

What is changing?

By end of December 2025, we will retire the following sample submission channels:

• Current online submission form:https://www.withsecure.com/en/support/contact-support/submit-a-sample
• partner-samples @ file -samples.withsecure.com
• japan-samples @ file -samples.withsecure.com

All sample submissions will be handled through the new Sample Validation service in the WithSecure™ Elements Security Center.

About the change

Why this change?

The new platform provides:

• Stronger security and authenticated access
• Faster processing
• Full visibility and traceability of your requests

When will this change happen

• Planned rollout: End of December 2025
• After the official release, all sample submissions must be made via the Elements Security Center.
• Final release date will be communicated separately.
• The User Guide is now available.

What remains unchanged

• WithSecure Cloud Protection for Salesforce Analytics: You can continue Reporting of false positives and false negatives from Analytics.
• Report False Positive from Elements Security Events: You can continue Reporting of false positives.
• Report False Positive functionality implemented within the product (e.g., Browsing Protection, Quarantine) You can continue Reporting of false positives from any product that has the functionality.

Action Required

If you have a WithSecure™ Elements subscription

No immediate action is needed.Once released, you will find the Sample Submission option directly in your Elements Security Center under the company scope selector.

If you do NOT have a WithSecure™ Elements subscription

To continue submitting samples, you will need an WithSecure Elements account.

Note: This applies to existing customers using our other solutions ( On-Premises solutions (Business Suite, Atlant, Email and Server Security)

What will happen:

1. You need to submit a a request for access to the new platform in advance of needing to use it. You can already request this access using our Support team link: Submit request
2. WithSecure validates your customer information.
3. An Elements account will be created for you to access the Sample Validation service. You will receive the access URL along with your initial login credentials.

We have now released new versions of WithSecure Policy Manager, and WithSecure Policy Manager Proxy, for both Windows and Linux.

The installers for these new versions can be found on our Download Server.

Bug Fixes and Improvements

• Corrected issue where HTTP proxy settings were not applied when connecting to Corporate Registration Server.
• Fixed issue with exporting reports in Policy Manager Console.
• Improved Web Reporting stability by stopping the Chrome process from opening when report data is invalid.
• Fixed issue where Disallow user changes is not effective for Trusted sites/Disallowed sites table.

Other Changes

These releases also contain updated third party components

• Java: 17.0.17
• Netty: 4.1.125
• Solr: 9.9.0
• Spring Framework: 6.2.11
• Spring Security: 6.4.11

to address the following vulnerabilities:

• Java 17: CVE-2025-53066, CVE-2025-53057
• Spring: CVE-2025-41248, CVE-2025-41249
• Other third-party libraries: CVE-2025-55163, CVE-2025-58056, CVE-2025-58754, CVE-2025-7962

On September 30th 2028, we will be retiring the WithSecure Business Suite product.

Note: For customers in Japan, the product is retired on December 31st 2027.

After this date, the product, and any component of it, will become fully unsupported. All variants of the following on-premises products are included:

• WithSecure Policy Manager
• WithSecure Policy Manager Proxy
• WithSecure Client Security
• WithSecure Server Security
• WithSecure Linux Security

The replacement product is WithSecure Elements.

If you have any questions related to this End of Life announcement, please contact your WithSecure Sales Representative, or the  WithSecure partner you purchased the product from.

UPDATE 2025-09-16: The update is expected to be released on 17th September 2025, with version “WithSecure Capricorn Engine (2025-09-17_01). The total size of the update package will be ~63MB.

We will soon be releasing a major update for our Capricorn engine, used by our Endpoint Protection products. This is expected to be released on September 17th 2025.

Key Improvements

• Optimized database & extended machine learning → reducing pattern file sizes while maintaining the same high detection rate.
• Component size reduction of more than 40% → from 210 MB down to 126 MB total.
• Faster initialization & lower memory consumption → improving overall performance on endpoints.

Update Details

• Expected update delta size: ~79 MB.
• Platform coverage: This update applies to all WithSecure Endpoint Protection products that utilize the Capricorn engine — across Windows, Mac and Linux platforms.
• Download size: All affected endpoints will now download a larger one-time update package of approximately 79 MB during the rollout.

Deployment

• The update will be delivered automatically.
• No manual action or configuration is required.
• The release time will be confirmed 24 hours in advance through our community channels.
• Updates containing this release will start with “WithSecure Capricorn Engine (2025-09-xx-xx)”
• With this update, you can expect leaner, faster, and more efficient endpoint protection — without compromising security.

UPDATE 2025-06-02: Updated the Integrations section with recommendations on which names to use in custom integrations.

UPDATE 2025-05-17: We have resolved the earlier issues, and the new schedule for release is:

• 2025-05-26 to Production

The date in the article below have been updated to reflect the new schedule.

UPDATE 2025-05-07:

The Early-Access release for Ultralight Core intended to go out today 7th of May 2025 has been postponed due to further issues found during pre-release testing. We apologize for the delays related to this particular release, but are committed to make sure that we release content with highest possible quality. We will advise on the release schedule for the new update.

This is a notification that a minor update to our Windows agent will be issued on Wednesday 14th May 2025.

This update contains general maintenance improvements for WithSecure Ultralight, which provides the scanner framework, and introduces a new ‘wsulavprothoster‘ service, or ‘wsulavprothoster_mdr’ service in case of the Countercept Agent, executing ‘fsulprothoster.exe‘ process.

The update does not contain any other changes to process, or service names. All existing services and processes remain.

Please note that the Operating System should be Azure Code Signing (ACS) compliant to receive this update.

The update is planned for General Availability release on Monday 26th of May 2025.

Integrations

For partners and customers who have custom integrations in their endpoint devices to ensure that the EPP product is functioning correctly, we advise that these integrations are reviewed to ensure correct functionality. We do not anticipate any issues related to this change, but naturally we cannot check your custom integrations.

WithSecure recommend that partners and customers with custom integrations use the Service Name (visible in Task Manager’s Services tab) to detect the presence and operational status of the EPP product. Use of the Service Description is not recommended, as these may change over time (although are unlikely to do so)