Version 4.38.5 released July 29th, 2026

• Resolved an issue where the network scans list displayed rows in incorrect order when sorting by target name or vulnerability counts.
• Resolved an issue where vulnerability report filter settings (selected categories and options) were not correctly loaded when modifying an existing report configuration, which could result in saved settings being overwritten with defaults.
• Resolved an issue where a summary report with an invalid locale value could prevent the entire Email Notification and Report page from loading.

Version 4.38.4 released July 21st, 2026

• Replaced the VM Risk Score with Exposure Risk across Summary Reports and dashboard widgets, providing a single, unified risk metric. The legacy VM Risk Score will be removed in a future release.
• Resolved an issue where Critical-severity vulnerabilities could still appear in Summary Reports when the Critical severity level was excluded from the report filter and High severity was included.
• Resolved an issue where results from certain scans did not appear in the portal after the scan completed.

Version 4.38.3 released July 1st, 2026

• Added tags and references to web scan vulnerability findings, so you can now see the associated tags and reference links for each web scan finding instead of “No tags” / “No references available”.
• Improved the reliability of web scan reporting, so scans that previously failed to be processed are now handled correctly instead of being silently discarded.
• Resolved an issue where a web scan could remain stuck in progress (for example at 95%) when a stop request and the scan’s natural completion happened at the same time. Such scans now complete correctly.
• Resolved an issue where certain web scans could get stuck and never finish, requiring manual intervention.
• Resolved an issue where editing a scan group to turn off Web Scan failed with a “Failed to update network scan group” error.
• Resolved an issue where outdated assets could reappear in Vulnerability Management after being removed.

Note: The web scan changes in this release (findings tags and references, reporting reliability, and the stuck-scan fixes) require your scan engine to be updated to the latest version. In particular, tags on web scan findings will begin to populate only after the scan engine has been updated.

Version 4.38.2 released June 23rd, 2026

• Resolved an issue where the /api/latest/VulnerabilityScans/add/batch endpoint returned only the last result when submitting multiple scans in a single request. It now returns a separate result for each scan. The integration endpoint retains its current behavior until August 1, 2026, after which it will be updated to match.
• Resolved an issue where downloading a scan report in .docx format failed.
• Resolved an issue where some users received access errors when selecting assets while creating a report.

Version 4.38.1 released June 12th, 2026

• Added OWASP vulnerability tags to web scan plugins.
• Resolved an issue where the discovery scan report did not display all data for large reports.
• Resolved an issue where scan groups did not fully collapse properly.
• Resolved an issue that occurred when accessing the network scans list page.
• Resolved an issue that caused invalid vulnerability counts in emails after finishing a scan.
• Overall performance and security improvements.

Version 4.38.0 released May 26th, 2026

• Resolved multiple issues in summary reports: fixed Japanese language rendering, added missing reference links (CVE identifiers), and updated product branding to WithSecure Elements Exposure Management.
• Resolved an issue where new users were not created in the system when assigned to an organization.
• Resolved an issue where navigating to a deleted or blocked unmanaged device would result in a 404 error. The device can now be viewed in an inactive state with available management options.
• Resolved an issue where removed unmanaged devices were still visible in multiple Exposure views.
• Resolved an issue where navigating from a scan definition to an unmanaged device could result in a 404 error if the device had been removed or blocked. The user is now redirected to the “Manage removed devices” view.
• Improved the error message displayed when the Scan Node Agent licence has expired.
• Overall performance improvements.

Version 4.37.9 released May 14th, 2026

• Added support for SSH authentication when configuring System Scans targeting Windows devices. Previously, SSH was only available for Linux and network targets; Windows targets were limited to WinRM. With this change, users can now configure Windows-over-SSH scans, including Windows-specific options such as Windows Server Update Services (WSUS) and Windows Update settings, alongside the standard SSH options available for Linux.
  Note: This capability is currently available via API only. UI support in the System Scan wizard is coming in a future release.
• Resolved an issue where vulnerability counts on the Computers and Unmanaged Devices lists could display incorrect values.

Version 4.37.8 released May 8th, 2026

• Resolved an issue where the scanning mode (Passive or Active) was missing from the Network Scans list. The scanning mode is now displayed correctly for each target.
• Resolved an issue where removed unmanaged devices were still visible in legacy views and in the Summary Report wizard. Removed devices are now hidden consistently across all views.
• Resolved an issue where vulnerability counters were not recalculated after related scans had been deleted. Counters now reflect the current state correctly.
• Resolved an issue where Network Scan reports could not be opened in a new browser tab via right-click. Reports can now be opened in a new tab as expected.
• Resolved an issue where manually removing a subset of hosts from a Network Scan Group could trigger unintended removal of additional hosts in the same group. Only the selected hosts are now removed.
• Overall performance and stability improvements.

Version 4.37.7 released April 20th, 2026

• When the user’s name or surname is empty, the email address is displayed in multiple views.
• Resolved an issue preventing the removal of the last encryption key from the list.
• Resolved an issue where users without complete name information were displayed incorrectly. The email address is now shown when first name or last name is missing.
• Resolved an issue affecting the display of historical Web Scan reports. The report now renders correctly.
• Resolved an issue where users created in VM from ASC notifications were not properly reflected in FACS. User synchronization between systems has been fixed.
• Overall security improvements.

Version 4.37.6 released April 10th, 2026

• Improved Network scan tag filtering by allowing search by tag name.
• Resolved an issue on Network scans page, preventing opening device link in a new window.
• Resolved an issue where changing an Agent scan schedule could unintentionally re‑enable VM scanning that had been explicitly disabled by the user.
• Resolved an issue where new scan reports could cause findings to appear for devices that were already removed but still visible in Removed devices view.