Changelogs

Elements Extended Detection and Response (XDR)

  • Linux Agent LS64 – 2026-10-15 Update

    Read more

    FSBG version 1.0.938 is now available. FSBG is an internal component of Linux Security 64. This version includes the following changes:

    • Fixed an issue that occasionally caused on-access scanning to fail, resulting in errors in the system journal and alerts.
  • Linux Agent LS64 – 2026-10-14 Update

    Read more

    Linux Security 64 version 26.2.516 is now available. This release includes the following changes:

    • Fixed: Migration from Policy Manager to Elements no longer fails in environments that require an HTTP proxy.
    • New: The installer now supports the --installation-tags command-line option, which lets you assign device tags for use in the Elements portal during installation.
  • Linux Agent LS64 – 2026-10-12 Update

    Read more

    FSBG version 1.0.937 is now available. FSBG is an internal component of Linux Security 64. This version includes the following changes:

    • Fixed log rotation for the scanning service.
    • Fixed an issue where policy changes made in quick succession could be ignored.
    • Fixed a problem with activating the WithSecure Elements Agent for Linux on network-restricted endpoints which are not able to reach the public Internet without a proxy.
    • Miscellaneous bug fixes and stability improvements.
  • Agent for Mac – 2026-10-06 Update

    Read more

    WithSecure Elements Agent for Mac 26.4 (56192) became generally available on 6 October 2026.

    This release includes:

    New Features

    • New malware scanning platform with improved performance and detection capabilities.
    • New reputation service providing faster and more accurate reputation lookups.
    • New quarantine handling for detected threats.

    Bug Fixes

    • Fixed an issue where one of the agent’s components could occasionally enter a crash loop when processing certain malformed data.
    • Fixed a crash that could occur during software update shutdown.

    Installer can be downloaded from:

    https://download.withsecure.com/PSB/latest/ElementsAgentInstaller.mpkg

    WithSecure Elements Agent for Mac 26.4 (56192) supports the following macOS versions:

    • macOS 27 Golden Gate
    • macOS 26 Tahoe
    • macOS 15 Sequoia
    • macOS 14 Sonoma
  • Agent for Mac – 2026-09-24 Update

    Read more

    WithSecure Elements Agent for Mac 26.4 (56192) has been released to our early access customers. It replaces the previously released version 26.4 (56151). General availability will follow within the next couple of weeks.

    This release fixes an issue where first-time installations occasionally skipped initial database updates. The bug exists only in WithSecure Elements Agent for Mac 26.4 (56151).

    Installer can be downloaded from:

    https://download.withsecure.com/PSB/latest/ElementsAgentInstaller_56192.mpkg

    WithSecure Elements Agent for Mac 26.4 (56192) supports the following macOS versions:

    • macOS 27 Golden Gate
    • macOS 26 Tahoe
    • macOS 15 Sequoia
    • macOS 14 Sonoma
  • Agent for Windows and Server – 2026-09-24 Update

    Read more

    A new version of the endpoint clients is available and our Early access program participants will start seeing it starting on 24.09.2026. Full availability will begin within the next week and takes some days to reach all customers.

    This release makes the Elements Agent version 26.4 available (internal version 26.4.612).

    The endpoints automatically upgrade, without a reboot.

    This release introduces new features (with Profile Editor Update).

    Features:

    • The “Upload suspicious samples to WithSecure Security Cloud” setting is now a three-option choice instead of an on/off toggle.
      image.png
    • Windows system event 4726 “A user account was deleted” can now be enabled from the Security Configurations profile in the portal. Once selected, WithSecure Elements Agent monitors this event and forwards it to Security Events.
      image.png
    • Software Updater: When an update is blocked by a running application, the Blocking Processes dialog now offers a “Close applications and continue” option to force-close the blocking app(s).
      image.png
    • Encrypt and decrypt fixed drives options are enabled and available from portal.
      image.png
    • More reliable EDR sensor status reporting that stays in sync with the profile setting.
    • Improved Fsscan.exe compatibility with non-administrator accounts.
  • Agent for Mobile – 2026-09-21 Update

    Read more

    An update to the WithSecure Elements Mobile Protection app for Android (26.6.23772) will be completed 21 September 2026. It will be released as a phased rollout over the next seven days.

    It includes the following new features and improvements:

    • The browsing protection engine was updated
    • The privacy policy screen now opens the current WithSecure corporate privacy page

    It also includes the following bug fixes:

    • General stability and performance improvements to reduce crashes and cases where the app could stop responding
    • The end user license agreement, privacy policy and third party license screens no longer show a blank page when the page cannot be loaded, and the retry button now reloads it
    • Web Content Control is no longer left enabled when an administrator turns it off in the WithSecure Elements Endpoint Protection portal
    • Reputable sites are no longer blocked when the Banking content category is disabled
    • The scan result details no longer show a removed detection as still present
  • Collaboration Protection – 2026-09-15 Update

    Read more
    Exchange scanning moves to Microsoft Graph API

    Collaboration Protection has transitioned Exchange Online scanning from Exchange Web Services (EWS) to Microsoft Graph API, aligning with Microsoft’s platform modernization following EWS’s retirement. Email protection, the primary security workload, continues uninterrupted with no change to detection capabilities. As a result of this change, scanning of calendar events, contacts, tasks, notes, and sticky notes is no longer supported.



    https://community.withsecure.com/announcements-en/kb/articles/32991-collaboration-protection-transitioning-exchange-protection-to-microsoft-graph-api

    Quarantine cleanup correction

    We’ve corrected an issue where some expired quarantined items were not being cleaned up in line with the retention period defined in the policy. 

    Reminder

    To ensure continued support for inbox rules scanning via Graph API, customers who haven’t already done so must grant the updated Microsoft Graph API permissions via the notification banner in the Collaboration Protection Portal.



    https://community.withsecure.com/changelogs-en/kb/articles/32805-collaboration-protection-2026-01-20-update

  • Agent for Mac – 2026-09-10 Update

    Read more

    WithSecure Elements Agent for Mac 26.4 has been released to our early access customers. General availability will follow within the next couple of weeks.

    This release includes:

    New Features

    • New malware scanning platform with improved performance and detection capabilities.
    • New reputation service providing faster and more accurate reputation lookups.
    • New quarantine handling for detected threats.

    Bug Fixes

    • Fixed an issue where one of the agent’s components could occasionally enter a crash loop when processing certain malformed data.
    • Fixed a crash that could occur during software update shutdown.

    Installer can be downloaded from:

    https://download.withsecure.com/PSB/latest/ElementsAgentInstaller_56151.mpkg

    WithSecure Elements Agent for Mac 26.4 supports the following macOS versions:

    • macOS 26 Tahoe
    • macOS 15 Sequoia
    • macOS 14 Sonoma
  • Collaboration Protection – 2026-09-01 Update

    Read more

    As of today, Collaboration Protection no longer provides protection for non-email items in Exchange (such as calendar entries, contacts, or tasks). Email protection is not affected and continues to work as before.

    We are continuing the transition of customer tenants to the Microsoft Graph API. A portion of tenants have already been moved over, and this process is ongoing. We are closely monitoring the transition, making adjustments as needed, and investigating any issues that arise.

    For background on this transition, please see our earlier announcement:
    Collaboration Protection: Transitioning Exchange Protection to Microsoft Graph API

    Possible known issue

    We’ve identified a small number of cases where an email that was previously quarantined and released using EWS (Exchange Web Services) may appear to be quarantined again after a tenant moves to the Graph API, if item is modified. If an item is re-quarantined this way, an administrator should release the item again.

    We’re flagging this proactively since it can be confusing if you encounter it. There is no clear, consistent pattern yet for when this happens — it appears to stem from differences in how EWS and Graph API report certain email properties. We expect the number of cases to decrease over time, and we’ll continue monitoring closely in the meantime.