Clearer identity findings and recommendations for breach exposure

We’ve renamed and updated the Identity findings and recommendations that deal with credential breaches so they’re easier to understand and act on. The names now describe exactly what each finding or recommendation covers, and for each one we’ve refreshed the supporting content – descriptions, risk explanations, details, immediate actions, and proactive actions — so the guidance is clearer and more actionable.

Here’s what’s changed:

“User has old password” is now “Account exposed in breach after last password change”

The new name makes the finding’s purpose clear: it flags accounts whose credentials were exposed in a known breach and haven’t been changed since.

“Remind your users to change their password” is now “Reset passwords exposed in breaches”

The new name reflects the specific action that reduces risk — resetting passwords that have been exposed in breaches.

“Remediate identity breach of multiple users” is now “Review identities with breaches”

The recommendation now includes clear guidance for addressing Identity breach findings. Since these findings belong to a unique category that can’t be resolved through standard means, they call for a different approach.

Version 4.38.4 released July 21st, 2026

• Replaced the VM Risk Score with Exposure Risk across Summary Reports and dashboard widgets, providing a single, unified risk metric. The legacy VM Risk Score will be removed in a future release.
• Resolved an issue where Critical-severity vulnerabilities could still appear in Summary Reports when the Critical severity level was excluded from the report filter and High severity was included.
• Resolved an issue where results from certain scans did not appear in the portal after the scan completed.

SystemScan 111319, released July 20, 2026

New features and improvements:

[RADAR-35381] – Capability to detect vulnerabilities in Apache Accumulo in authenticated scanning

Pre-zero-day exposure detection and mitigation actions from Recommendations

We’re extending Exposure Management (XM) with two capabilities that bring XM and Extended Detection and Response (XDR) closer together — helping you catch risk earlier and act on it faster, without leaving the Recommendation view.

Pre-zero-day exposure detection

For customers running both XM and XDR, XM can now surface exposure risks that traditional vulnerability scanning misses entirely: privilege-escalation vulnerabilities spotted in real time from endpoint detection data, before a CVE even exists. You’ll see a new finding and recommendation in your Exposure dashboard describing the risk and the recommended action, including guidance on next steps such as reinstalling or patching affected software.

Take mitigation action straight from a Recommendation

For customers running both XM and XDR, the Recommendation view now offers response actions matched to the type of asset affected — so you can act immediately instead of switching tools.

Depending on the type of fix the recommendation requires, you’ll be able to isolate a device or update file permissions. Later on, recommendations related to Identities will offer the option to reset a password, block user access, or end a user’s active session.. 

Select the affected assets in the Recommendation view and trigger the action directly — no need to pivot to a separate XDR console.

Web Scan  and OWASP Top Ten 2025

Our Vulnerability Management Web Scan engine has been updated to detect and classify findings according to the latest OWASP Top Ten (2025) categories, alongside continued coverage of the 2017 and 2021 lists. Findings from Web Scan contain tags for OWASP categories. 

SystemScan 110853, released July 9, 2026

New features and improvements:

[RADAR-35232] – Capability to detect vulnerabilities in AsyncHttpClient in authenticated scanning

SystemScan 110677, released July 6, 2026

New features and improvements:

[RADAR-35231] – Capability to detect vulnerabilities in Mchange Commons Java in authenticated scanning
[RADAR-35214] – Capability to detect vulnerabilities in Apache HttpComponents Core in authenticated scanning

Version 4.38.3 released July 1st, 2026

• Added tags and references to web scan vulnerability findings, so you can now see the associated tags and reference links for each web scan finding instead of “No tags” / “No references available”.
• Improved the reliability of web scan reporting, so scans that previously failed to be processed are now handled correctly instead of being silently discarded.
• Resolved an issue where a web scan could remain stuck in progress (for example at 95%) when a stop request and the scan’s natural completion happened at the same time. Such scans now complete correctly.
• Resolved an issue where certain web scans could get stuck and never finish, requiring manual intervention.
• Resolved an issue where editing a scan group to turn off Web Scan failed with a “Failed to update network scan group” error.
• Resolved an issue where outdated assets could reappear in Vulnerability Management after being removed.

Note: The web scan changes in this release (findings tags and references, reporting reliability, and the stuck-scan fixes) require your scan engine to be updated to the latest version. In particular, tags on web scan findings will begin to populate only after the scan engine has been updated.

SystemScan 110441, released June 30, 2026

New features and improvements:

[RADAR-35044] – Capability to detect vulnerabilities in MySQL Router in authenticated scanning for Windows
[RADAR-35030] – Capability to detect vulnerabilities in Canon EOS Network Setting Tool in authenticated scanning for Windows

SystemScan 110397, released June 29, 2026

New features and improvements:

[RADAR-35073] – Capability to detect vulnerabilities in Devolutions UniGetUI in authenticated scanning for Windows
[RADAR-35043] – Capability to detect vulnerabilities in Zen Browser in authenticated scanning for Windows
[RADAR-35035] – Capability to detect vulnerabilities in HP One Agent in authenticated scanning for Windows
[RADAR-34950] – Capability to detect vulnerabilities in Spring Integration in authenticated scanning
[RADAR-34949] – Capability to detect vulnerabilities in Spring for GraphQL in authenticated scanning
[RADAR-34940] – Capability to detect vulnerabilities in AWS CDK Library in authenticated scanning
[RADAR-34928] – Capability to detect vulnerabilities in Spring Data KeyValue in authenticated scanning
[RADAR-34927] – Capability to detect vulnerabilities in Spring Data R2DBC in authenticated scanning
[RADAR-34926] – Capability to detect vulnerabilities in Spring Data JDBC in authenticated scanning
[RADAR-34925] – Capability to detect vulnerabilities in Spring Data Relational in authenticated scanning
[RADAR-34924] – Capability to detect vulnerabilities in Spring for Apache Pulsar in authenticated scanning
[RADAR-34923] – Capability to detect vulnerabilities in Spring Data REST in authenticated scanning
[RADAR-34922] – Capability to detect vulnerabilities in Spring Data MongoDB in authenticated scanning
[RADAR-34921] – Capability to detect vulnerabilities in Spring AMQP in authenticated scanning
[RADAR-34919] – Capability to detect vulnerabilities in Spring Web Flow in authenticated scanning

Version 4.38.2 released June 23rd, 2026

• Resolved an issue where the /api/latest/VulnerabilityScans/add/batch endpoint returned only the last result when submitting multiple scans in a single request. It now returns a separate result for each scan. The integration endpoint retains its current behavior until August 1, 2026, after which it will be updated to match.
• Resolved an issue where downloading a scan report in .docx format failed.
• Resolved an issue where some users received access errors when selecting assets while creating a report.