Acunetix 360 On-Demand

New features

• Clone scan profiles to different targets: Added the ability to clone scan profiles to different targets, allowing you to reuse configurations across multiple websites without manual setup.

Resolved issues

• HAR file generation and login verification results: Fixed an issue where enabling HAR file generation prevented login and logout verification results from displaying, ensuring the interface loads correctly and files are available for download.
• PDF reports with an absolute scan data path: Fixed an issue where PDF reports were exported as empty files when using an absolute physical path for the scan data directory.
• SSRF responder registration: Fixed an issue that prevented the SSRF responder from registering, ensuring that security scans can successfully test for SSRF vulnerabilities.
• Script actions in Business Logic Recordings: Fixed an issue where script actions in Business Logic Recordings failed to execute, ensuring custom scripts and dynamic values are correctly applied during scan execution.
• Scan profile name updates through the API: Fixed an issue where updating a scan profile name via the API failed with validation errors for unrelated fields, allowing for successful profile updates.
• New Secret button tooltip: Fixed the tooltip on the New Secret button to correctly display “SEM integration”, providing accurate information about secret retrieval.

Security checks

• Invitation codes in the member list: Fixed a security vulnerability by hiding invitation codes in the member list, preventing unauthorized users from hijacking invitations or gaining elevated account access.

API changes

• User Scope in the notification creation API: Fixed the notification creation API to include the User Scope parameter, allowing you to programmatically set notifications to Self or Any User, consistent with the web interface.

Improvements

• Login Screen Recorder content and interactions: Updated the Login Screen Recorder content and fixed an issue where button clicks weren’t correctly captured during recording sessions.
• Chromium engine update: Updated the internal Chromium engine to version 149 to provide improved security, stability, and performance.

Resolved issues

• Platform stability during target configuration: Fixed an issue where editing a target caused the platform to become unresponsive, ensuring the service remains available and stable during configuration updates.
• Business Logic Recorder authentication with CyberArk: Fixed an issue where the Business Logic Recorder failed to authenticate with CyberArk credentials, ensuring recordings now correctly start from the authenticated session.
• SSO and Okta authentication after upgrade: Fixed an issue where SSO and Okta logins failed after an upgrade, allowing users to successfully authenticate and access the application again.

New features

• Partial API updates (PATCH semantics) for scan profile and policy endpoints: You can now modify specific settings through the API without resubmitting the entire configuration object, so existing values are preserved when you update only part of a profile or policy.

Improvements

• 730-day scan data retention: You can now configure scan data retention for up to 730 days (two years), giving you longer access to historical scan results.
• Scan control API endpoint no longer returns unauthorized errors: The scan control API endpoint now correctly accepts requests using valid API credentials, so you can manage scan settings without unexpected authentication failures.
• Auth Verifier Service upgraded to .NET 10: The Auth Verifier Service now runs on .NET 10, ensuring long-term support, improved security, and access to the latest platform features.
• Scan agent upgraded to .NET 10: The scan agent now runs on .NET 10, delivering improved performance and enhanced stability.

Resolved issues

• Scheduled scans now authenticate correctly with OAuth 2: Fixed an issue where scheduled scans failed to authenticate using OAuth 2, ensuring automated scans complete as expected.
• Scans no longer fail when encountering null values during concurrent scanning: Fixed an issue that caused scans to fail when encountering null values, ensuring more reliable performance during high-volume concurrent scanning.
• Interactive Login and OAuth2 Test Connection now complete reliably: Fixed issues where Interactive Login hung during session saving and the OAuth2 Test Connection button remained unresponsive, ensuring authentication configurations and tests complete successfully.
• GraphQL vulnerability reports now show correct request and response data: Security reports for GraphQL checks now display the accurate request and response details for the detected vulnerability.

New features

• Pre-scan authentication validation for NTLM, Basic, and Kerberos: Scans can now be configured to fail immediately if credentials are invalid, preventing unauthenticated scans from running silently.
• Sitemap data retention policy now available in General Settings: Root users can now enable automatic cleanup of sitemap data older than one year, helping manage storage and keep scan data relevant.
• Interactive Login now supported on the Form Authentication page: Users can now handle MFA, CAPTCHA, and other interactive authentication steps directly within the UI during scan setup. Captured sessions are stored encrypted and reused automatically across future scans.

Improvements

• Docker agent updated with latest security patches: The Docker agent base image has been updated to address a critical OpenSSL vulnerability.
• Scans now fail immediately when the target returns HTTP 502: If the first response is a 502, the scan stops right away rather than continuing against an unreachable target.

Resolved issues

• Custom policy severity settings no longer reset after a product update: User-configured severity levels in custom report policies are now preserved across upgrades.
• Multiple scan notifications can now be created for the same target with different scan groups: Creating more than one “New Scan Notification” for the same target was incorrectly blocked when scan groups differed. The duplicate check now accounts for scan group selection.
• Login/Logout Verification dialog no longer shows stale errors on quick reopen: Closing and immediately reopening the verification modal no longer causes outdated error messages or incorrect UI state to appear.
• Targets can no longer be re-imported before the deletion grace period has elapsed: A target deleted within the last week could cause “already exists” errors when re-adding the same URL. This is now handled correctly.
• Remediation scans now correctly use the target’s assigned agent group: On-Prem remediation scans triggered via “Mark as Fixed (Unconfirmed)” were getting stuck in queue because the wrong agent was selected instead of the target’s configured internal agent group. Remediation scans now use the same agent selection logic as full and retest scans.
• Splunk plugin link now directs to the correct page: The Splunk integration link was pointing to an incorrect destination and has been fixed.
• Report generation no longer fails for findings with expired request/response data: Generating reports that included older findings where HTTP request/response data had been purged per the retention policy could cause the report to fail entirely. The report engine now handles missing evidence gracefully.
• Sensitive information masking logic improved: The “Prevent any sensitive information showing within the product” option now works more reliably across relevant areas of the UI.
• FIDO2 security key (YubiKey) registration no longer fails with “Incorrect U2F security key” error: A dependency version mismatch was causing YubiKey registration to fail. This has been resolved and FIDO2 keys can now be registered successfully.

Security checks

• JavaScript Source Map detection now available Added Javascript Source Map detected vulnerability into security checks.