{"id":7149,"date":"2025-04-15T10:48:09","date_gmt":"2025-04-15T07:48:09","guid":{"rendered":"https:\/\/support.withsecure.com\/?post_type=announcement&#038;p=7149"},"modified":"2026-10-19T13:09:38","modified_gmt":"2026-10-19T10:09:38","slug":"whats-new-in-elements-march-2025","status":"publish","type":"announcement","link":"https:\/\/support.withsecure.com\/en\/announcements\/whats-new-in-elements-march-2025\/","title":{"rendered":"What&#8217;s New in Elements &#8211; March 2025"},"content":{"rendered":"<h2 data-id=\"extended-detection-and-response\"><strong>Extended Detection and Response<\/strong><\/h2>\n<h3 data-id=\"endpoint-protection\"><strong>Endpoint Protection<\/strong><\/h3>\n<h4 data-id=\"elements-agent-for-mobile-update-for-ios\"><strong>Elements Agent for Mobile update for iOS<\/strong><\/h4>\n<p>We\u2019ve updated the WithSecure Elements Mobile Protection app for iOS (version 25.5.11428) as of April 1, 2025. <\/p>\n<p>It includes the following new features and improvements:<\/p>\n<ul>\n<li>The app now supports \u201cAllow external DNS\u201d setting<\/li>\n<li>Improvements to app stability\u00a0<\/li>\n<li>Improvements to Safari Extension filtering algorithm<\/li>\n<li>The network now resets automatically when the DNS setting changes.<\/li>\n<\/ul>\n<h3 data-id=\"endpoint-detection-and-response\"><strong>Endpoint Detection and Response<\/strong><\/h3>\n<h4 data-id=\"elements-edr-response-views-language-support\"><strong>Elements EDR &#8211; Response views language support <\/strong><\/h4>\n<p>Response views\u00a0now support\u00a0all languages available in the Elements Security Center:<\/p>\n<ul>\n<li>English (US)<\/li>\n<li>Finnish<\/li>\n<li>French<\/li>\n<li>German<\/li>\n<li>Italian<\/li>\n<li>Japanese<\/li>\n<li>Polish<\/li>\n<li>Portuguese (Brazil)<\/li>\n<li>Spanish (Latin America)<\/li>\n<li>Swedish<\/li>\n<\/ul>\n<p>This enhancement ensures a more inclusive and accessible experience for our global user base.Here is an example of our French localization of Response views.<\/p>\n<figure class=\"entry-image display-large float-none\"><a class=\"embedImage-link\" href=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture1-28.png.webp\" rel=\"nofollow noopener ugc\" target=\"_blank\"><img decoding=\"async\" class=\"embedImage-img\" src=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture1-28.png.webp\" srcset=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture1-28.png.webp 1460w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture1-28-300x103.png.webp 300w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture1-28-1024x351.png.webp 1024w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture1-28-768x264.png.webp 768w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture1-28-447x153.png.webp 447w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture1-28-425x146.png.webp 425w\" sizes=\"auto, 100vw\" alt=\"Picture1.png\" height=\"501\" width=\"1460\" loading=\"lazy\" data-display-size=\"large\" data-float=\"none\" data-type=\"image\/png\" data-embed-type=\"image\"><\/img><\/a><\/figure>\n<h2 data-id=\"exposure-management\"><strong>Exposure Management<\/strong><\/h2>\n<p>We have released updates to Exposure Management with following changes:\u00a0<\/p>\n<ul>\n<li>Two new Identity findings are introduced for Entra ID tenants by analyzing the user\u2019s role assignments with corresponding recommendation to review privileged roles and their permissions:<\/li>\n<\/ul>\n<p>Entra ID tenant has more than 5 global administrators<\/p>\n<p>Entra ID tenant has more than 10 privileged roles<\/p>\n<ul>\n<li>Recommendation list page (Home =&gt; Exposure =&gt; Recommendation) has now a possibility to filter recommendations by status value. It is currenlly possible to filter only using one value. Multi-value filtering is coming. By default, list now filters recommendations having status Done.<\/li>\n<li>Previously, in Elements attack path simulation, MITRE TTPs were linked to the MITRE website, while WithSecure extensions were not linked anywhere. With this update, WithSecure TTP extension IDs in the UI now link to\u00a0<a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fti.withsecure.com%2F\" target=\"_blank\" rel=\"nofollow noopener ugc\">https:\/\/ti.withsecure.com<\/a>, providing direct access to detailed information.<\/li>\n<\/ul>\n<h3 data-id=\"exposure-management-for-business\"><strong>Exposure Management for Business<\/strong><\/h3>\n<h4 data-id=\"exposure-management-portal\"><strong>Exposure Management Portal<\/strong><\/h4>\n<p>We have released an update to the Exposure Management portal, which includes the following changes:<\/p>\n<ul>\n<li>Resolved an issue in network scan and scan group configuration where the severity condition ignored critical vulnerabilities, preventing email notifications from being sent after a network scan was completed.<\/li>\n<li>Agent scanning will now be automatically enabled for new devices with Vulnerability Management or Exposure Management subscriptions as soon as they are installed. This means no user interaction is needed to start the scanning process. Devices with other subscriptions will require manual activation for scanning.<\/li>\n<li>Resolved an issue where user deletions were incomplete, causing access issues for new accounts created with the same email address.<\/li>\n<li>Resolved a potential vulnerability that could have led to unauthorized access to Scan Nodes.<\/li>\n<li>Resolved an issue where an insecure direct object references (IDOR) vulnerability in user permissions could lead to privilege escalation.<\/li>\n<li>Resolved an issue where email notifications from vulnerability scanning were not being sent.<\/li>\n<\/ul>\n<h4 data-id=\"system-scan\"><strong>System Scan<\/strong><\/h4>\n<p>Support for detecting vulnerabilities in the following products was added to Authenticated Scanning:<\/p>\n<ul>\n<li>Absolute Secure Access<\/li>\n<li>Apache Camel<\/li>\n<li>Apache Commons VFS<\/li>\n<li>Dell SupportAssist OS Recovery<\/li>\n<li>Docusnap<\/li>\n<li>Duet Display<\/li>\n<li>Exasol JDBC Driver<\/li>\n<li>HPE Insight Remote Support<\/li>\n<li>JetBrains TeamCity<\/li>\n<li>MetaDefender Core<\/li>\n<li>MetaDefender ICAP Server<\/li>\n<li>MongoDB Shell (mongosh)<\/li>\n<li>Nakivo Backup &amp; Replication<\/li>\n<li>Paragon Partition Manager<\/li>\n<li>Privilege Management for Windows<\/li>\n<li>Progress Telerik Fiddler<\/li>\n<li>RemotePC<\/li>\n<li>RustDesk<\/li>\n<li>SolarWinds Web Help Desk<\/li>\n<\/ul>\n<p>In addition, the detections of Windows Cumulative updates have now been divided into families. <strong>Warning<\/strong>: This change may result in significant change of findings and numbers of CVEs related to Windows Cumulative Updates<\/p>\n<h2 data-id=\"elements-foundations\"><strong>Elements Foundations<\/strong><\/h2>\n<h3 data-id=\"elements-security-center\"><strong>Elements Security Center<\/strong><\/h3>\n<h4 data-id=\"subscriptions-view-improvements\"><strong>Subscriptions View improvements<\/strong><\/h4>\n<p>We\u2019ve made performance enhancements and added prefix matching to the subscription key filter in the Subscriptions view:<\/p>\n<ul>\n<li>Subscriptions now load faster.<\/li>\n<li>Filtering by subscription key is quicker, especially for organizations with many subscriptions.<\/li>\n<li>You can now filter using a \u201cStarts with\u201d condition to match keys by prefix.<\/li>\n<\/ul>\n<figure class=\"entry-image display-large float-none\"><a class=\"embedImage-link\" href=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture2-25.png.webp\" rel=\"nofollow noopener ugc\" target=\"_blank\"><img decoding=\"async\" class=\"embedImage-img\" src=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture2-25.png.webp\" srcset=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture2-25.png.webp 720w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture2-25-300x123.png.webp 300w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture2-25-447x183.png.webp 447w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture2-25-358x146.png.webp 358w\" sizes=\"auto, 100vw\" alt=\"Picture2.png\" height=\"294\" width=\"720\" loading=\"lazy\" data-display-size=\"large\" data-float=\"none\" data-type=\"image\/png\" data-embed-type=\"image\"><\/img><\/a><\/figure>\n<h2 data-id=\"other-items-of-interest\"><strong>Other items of interest<\/strong><\/h2>\n<h3 data-id=\"threat-advisories\"><strong>Threat Advisories<\/strong><\/h3>\n<h4 data-id=\"ruby-vulnerabilities-saml-graphql\"><strong>Ruby vulnerabilities (SAML &amp; GraphQL)<\/strong><\/h4>\n<p><strong>Technical Summary<\/strong><\/p>\n<p>Ruby is a programming language widely used in designing web-facing services and applications.<\/p>\n<p>Recently published advisory contains three vulnerabilities that can be exploited remotely without user interaction. The vulnerabilities are:<\/p>\n<p><strong>CVE-2025-25291\/ CVE-2025-25292<\/strong> : Authentication bypass in the <strong>ruby-saml library<\/strong>. An attacker with access to a valid signed SAML document from an Identity Provider (IdP) could impersonate or authenticate as <strong>another user<\/strong>.<\/p>\n<p><strong>CVE-2025-27407<\/strong>: Remote code execution in the <strong>Ruby GraphQL library<\/strong>. An attacker could exploit this by transferring a maliciously-crafted project via the Direct Transfer feature.<\/p>\n<h4 data-id=\"advisory-oracle-cloud-compromise\"><strong>Advisory \u2013 Oracle Cloud Compromise<\/strong><\/h4>\n<p><strong>Summary<\/strong><\/p>\n<p>Since Friday 21st March, Our Threat Intelligence team has been monitoring a claim that an exposed vulnerable Oracle cloud subdomain was compromised in a large supply chain attack impacting up to 140,000 victims.<\/p>\n<figure class=\"entry-image display-large float-none\"><a class=\"embedImage-link\" href=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture3-25.png.webp\" rel=\"nofollow noopener ugc\" target=\"_blank\"><img decoding=\"async\" class=\"embedImage-img\" src=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture3-25.png.webp\" srcset=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture3-25.png.webp 867w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture3-25-300x123.png.webp 300w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture3-25-768x315.png.webp 768w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture3-25-447x184.png.webp 447w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture3-25-356x146.png.webp 356w\" sizes=\"auto, 100vw\" alt=\"Picture3.png\" height=\"356\" width=\"867\" loading=\"lazy\" data-display-size=\"large\" data-float=\"none\" data-type=\"image\/png\" data-embed-type=\"image\"><\/img><\/a><\/figure>\n<p>Such claims (of varying magnitude) are relatively common across deep and dark web forums and social media. By looking at the reputation and \u201creliability\u201d of the threat actor, evaluating what limited data or information the offending actor may have shared about the breach as proof of veracity and what statements the victim company has made help us to pass assessment on the legitimacy of the claims posed by the threat actor.<\/p>\n<p>You can\u00a0<a href=\"http:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fwww.withsecure.com%2Fen%2Fexpertise%2Fresearch-and-innovation%2Fresearch%2Fmonthly-threat-highlights-report\" target=\"_blank\" rel=\"nofollow noopener ugc\">sign up<\/a>\u00a0to receive the monthly Threat Reports, with full details of these threats.<\/p>\n<h2 data-id=\"in-case-you-missed-it\"><strong>In case you missed it<\/strong><\/h2>\n<p>We will soon be removing some older Organization Management screens in Elements Security Center. You can find out more in the <a href=\"https:\/\/community.withsecure.com\/en\/kb\/articles\/31656-removal-of-deprecated-organization-management-screens-in-elements-security-center\" rel=\"nofollow noopener ugc\" target=\"_blank\">dedicated community article<\/a>.<\/p>\n<h2 data-id=\"share-your-ideas-with-us\"><strong>Share your ideas with us<\/strong><\/h2>\n<p>Our purpose is to co-secure the world with you \u2013\u00a0now as WithSecure\u2122. To co-create the best possible cyber security products and services, we warmly recommend you share your ideas via <a href=\"https:\/\/community.withsecure.com\/categories\/ideas\" target=\"_blank\" rel=\"nofollow noopener ugc\">the Ideas section of the WithSecure Community<\/a>, now accessible directly from WithSecure\u2122 Elements Security Center.<\/p>\n<figure class=\"entry-image display-medium float-none\"><a class=\"embedImage-link\" href=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture4-25.png.webp\" rel=\"nofollow noopener ugc\" target=\"_blank\"><img decoding=\"async\" class=\"embedImage-img\" src=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture4-25.png.webp\" srcset=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture4-25.png.webp 337w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture4-25-300x298.png.webp 300w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture4-25-150x150.png.webp 150w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture4-25-147x146.png.webp 147w\" sizes=\"auto, 100vw\" alt=\"Picture4.png\" height=\"335\" width=\"337\" loading=\"lazy\" data-display-size=\"medium\" data-float=\"none\" data-type=\"image\/png\" data-embed-type=\"image\"><\/img><\/a><\/figure>\n<h2 data-id=\"further-information\"><strong>Further information<\/strong><\/h2>\n<p>Changelogs and Release Notes for all parts of WithSecure\u2122 Elements can be found at the\u00a0<a href=\"http:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fwww.withsecure.com%2Fuserguides%2F\" target=\"_blank\" rel=\"nofollow noopener ugc\">Help Center\u00a0<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Extended Detection and Response Endpoint Protection Elements Agent for Mobile update for iOS We\u2019ve updated the WithSecure Elements Mobile Protection app for iOS (version 25.5.11428) as of April 1, 2025.&hellip;<\/p>\n","protected":false},"template":"","announcement_category":[142],"class_list":["post-7149","announcement","type-announcement","status-publish","hentry"],"acf":{"source_system":"vanilla-import","import_hash":"1284d86282276858a56f7e89cf32f317a0edf5d2","vanilla_article_id":31681,"legacy_author":"AndyF_WS","vanilla_url":"https:\/\/community.withsecure.com\/announcements-en\/kb\/articles\/31681-whats-new-in-elements-march-2025","vanilla_category_id":142,"machine_translated":false},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement\/7149","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement"}],"about":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/types\/announcement"}],"version-history":[{"count":1,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement\/7149\/revisions"}],"predecessor-version":[{"id":8604,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement\/7149\/revisions\/8604"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=7149"}],"wp:term":[{"taxonomy":"announcement_category","embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement_category?post=7149"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}