Acunetix 360 On-Premises

Improvements

• Second-level domain discovery: Domain discovery now permanently identifies second-level domains in all environments.
• Jira configuration alerts: Improved Jira configuration alerts with clearer messaging to ensure you’re notified when your integration is incorrectly set up.
• Jira integration credential security: Jira integration credentials are now automatically cleared from the cache after a set period instead of remaining there indefinitely.
• Vulnerability list performance: Vulnerability lists now load faster and the application stays more stable, even when you work with large datasets.
• Scan notifications for custom roles: You can now let custom roles send scan notifications to external recipients without giving them full access to all organizational notifications.
• Scan report loading times: Scan reports with a high volume of vulnerabilities now load faster and respond more quickly.
• Core component updates: Updated the application’s core components to improve performance, security, and support for the latest web features.

Resolved issues

• Scan data uploads: Fixed an issue that caused errors when uploading scan data, ensuring that files are processed successfully without encountering timeouts.
• Target imports with duplicate domains: Fixed an error that occurred when importing targets with duplicate domains or different protocols, ensuring discovery and restoration processes complete successfully.
• Internal IP detection on the IP restriction page: Fixed an issue where internal IP addresses were incorrectly detected on the IP restriction page, ensuring you no longer receive false warning messages when configuring access settings.
• Custom login scripts without an active persona: Fixed an issue where custom login scripts were omitted from scans when no active persona was configured, ensuring authentication scripts now execute correctly in script-only configurations.
• Interactive Login configuration errors: Fixed an issue where Interactive Login configuration failures occurred without notification, adding error messages to inform you when settings can’t be saved.
• Scheduled group scan profiles: Fixed an issue where scheduled group scans used default profiles instead of assigned primary scan profiles, ensuring targets are scanned with their correct configurations.

Security checks

• Multi-factor authentication removal: Fixed the multi-factor authentication removal process to require a second-factor code, ensuring that only authorized users can disable this security feature.

API changes

• Default protocol in website API responses: Added the default protocol parameter to website API responses, allowing you to view the default protocol for your websites.

Verify the hash value for package integrity in Acunetix 360 on-premises

• The hash value for the 26.10.1.zip file is 7BE06E6E8947A902AA348576AF9486D92233B91BC72334E134DF56CC31774557.

You can verify the integrity of the file by checking its hash value using one of the outlined methods:

• PowerShell (Windows): Get-FileHash -Path "26.10.1.zip" -Algorithm SHA256
• Command Prompt (Windows): certutil -hashfile "26.10.1.zip" SHA256
• Linux or macOS: sha256sum "26.10.1.zip"

New features

• Secrets in custom authentication scripts: Added support for secrets in custom authentication scripts, allowing you to securely manage and test sensitive credentials during automated scans.

Improvements

• Extended scan data retention: Improved scan data retention settings to allow you to store scan results for longer periods.
• API endpoint accuracy for HTTPS websites: Fixed an issue where API requests for HTTPS websites incorrectly returned HTTP records, ensuring the correct website data is retrieved based on the requested protocol.

Bug fixes

• CyberArk NTLM authentication: Fixed an issue where CyberArk secret resolution failed for NTLM authentication, allowing credentials and vault connections to be verified successfully.

Verify the hash value for package integrity

The hash value for the 26.9.1.zip file is D784D7F115F82329DF97084DB54DBE24D760EC184183A90C4001D655AC17577C.

You can verify the integrity of the file by checking its hash value using one of the outlined methods:

• PowerShell (Windows): Get-FileHash -Path "26.9.1.zip" -Algorithm SHA256
• Command Prompt (Windows): certutil -hashfile "26.9.1.zip" SHA256
• Linux or macOS: sha256sum "26.9.1.zip"

Improvements

• Generate HAR files option for authentication verification: Added an opt-in Generate HAR files option for authentication verification. The option is turned off by default to avoid unnecessary HAR file generation.
• Background tasks no longer generate excessive database transactions: Fixed excessive database transactions generated by background tasks to prevent rapid audit log growth and ensure stable performance on Azure SQL Managed Instances.

Resolved issues

• Text pasting in the Interactive Login window now works as expected: Fixed an issue preventing text from being pasted into the Interactive Login window, so you can now use keyboard shortcuts to enter credentials.
• Scheduled scans now use available agents when the preferred agent is unavailable: Fixed an issue where scheduled scans failed if a specific agent became unavailable. Scans now correctly use other available agents within the assigned agent group.

Verify the Hash value for package integrity in Acunetix 360 on-premises

The hash value for the “26.8.1.zip” file is 10CF093A86B4656A64480CB2BF9A08F4723BFDF2D74C6F978ABAFDF52946CEE17.

You can verify the integrity of the file by checking its hash value using one of the outlined methods:

PowerShell (Windows):

Get-FileHash -Path "26.8.1.zip" -Algorithm SHA256

Command Prompt (Windows):

certutil -hashfile "26.8.1.zip" SHA256

Linux or macOS:

sha256sum "26.8.1.zip"

Improvements

• Agents page now alerts you when vulnerability database updates can’t be completed: Added a notification to the agents page that alerts you when vulnerability database updates fail due to connection issues, with guidance on how to resolve the issue.
• AWS Load Balancer configuration no longer hides dropdown menus and agent options: Fixed an issue where AWS Load Balancer settings could cause dropdown menus and agent selection options to disappear.

Resolved issues

• OAuth2 Test Connection and Interactive Login now complete reliably: Fixed issues where Interactive Login hung during session saving and the OAuth2 Test Connection UI remained unresponsive, ensuring authentication configurations and tests complete successfully.
• Docker agents updated with security improvements: Updated Docker agents to address reported security findings and improve overall system security.
• PDF reports now correctly handle special characters in vulnerability titles: Fixed an issue where vulnerability titles containing special characters weren’t properly escaped during PDF report generation, which could allow unintended access to system files.
• Scheduled scans now apply the most recent primary scan profile: Fixed an issue where scheduled scans used outdated profile information, ensuring that updates to primary scan profiles are correctly applied to all future scans.
• Agents and verifiers now download the correct runtime payload versions: Fixed an issue where the license download path could deliver incorrect agent and verifier runtime payloads, resulting in mixed component versions being installed.

Verify the Hash value for package integrity in Acunetix 360 on-premises

The hash value for the “26.7.1.zip” file is 72CAB75C7DE323CE66CCDEE4E5C129AB0FEDFD5A15433E4B382305164C5C79B9.

You can verify the integrity of the file by checking its hash value using one of the outlined methods:

PowerShell (Windows):

Get-FileHash -Path "26.7.1.zip" -Algorithm SHA256

Command Prompt (Windows):

certutil -hashfile "26.7.1.zip" SHA256

Linux or macOS:

sha256sum "26.7.1.zip"

New features

• Pre-scan authentication validation for NTLM, Basic, and Kerberos: Scans can now be configured to fail immediately if credentials are invalid, preventing unauthenticated scans from running silently.
• Sitemap data retention policy now available in General Settings: Root users can now enable automatic cleanup of sitemap data older than one year, helping manage storage and keep scan data relevant.
• Interactive Login now supported on the Form Authentication page: Users can now handle MFA, CAPTCHA, and other interactive authentication steps directly within the UI during scan setup. Captured sessions are stored encrypted and reused automatically across future scans.

Improvements

• Docker agent updated with latest security patches: The Docker agent base image has been updated to address a critical OpenSSL vulnerability.
• Scans now fail immediately when the target returns HTTP 502-503-504: If the first response is 502-503-504, the scan stops right away rather than continuing against an unreachable target.

Resolved issues

• Custom policy severity settings no longer reset after a product update: User-configured severity levels in custom report policies are now preserved across upgrades.
• Multiple scan notifications can now be created for the same target with different scan groups: Creating more than one “New Scan Notification” for the same target was incorrectly blocked when scan groups differed. The duplicate check now accounts for scan group selection.
• Login/Logout Verification dialog no longer shows stale errors on quick reopen: Closing and immediately reopening the verification modal no longer causes outdated error messages or incorrect UI state to appear.
• Targets can no longer be re-imported before the deletion grace period has elapsed: A target deleted within the last week could cause “already exists” errors when re-adding the same URL. This is now handled correctly.
• Remediation scans now correctly use the target’s assigned agent group: On-Prem remediation scans triggered via “Mark as Fixed (Unconfirmed)” were getting stuck in queue because the wrong agent was selected instead of the target’s configured internal agent group. Remediation scans now use the same agent selection logic as full and retest scans.
• Report generation no longer fails for findings with expired request/response data: Generating reports that included older findings where HTTP request/response data had been purged per the retention policy could cause the report to fail entirely. The report engine now handles missing evidence gracefully.
• Sensitive information masking logic improved: The “Prevent any sensitive information showing within the product” option now works more reliably across relevant areas of the UI.
• FIDO2 security key (YubiKey) registration no longer fails with “Incorrect U2F security key” error: A dependency version mismatch was causing YubiKey registration to fail. This has been resolved and FIDO2 keys can now be registered successfully.

Security checks

• JavaScript Source Map detection now available Added Javascript Source Map detected vulnerability into security checks.

Verify the Hash value for package integrity in Acunetix 360 on-premises

The hash value for the “26.6.2.zip” file is D25551814278DA7BE384A2991AF3D6A715AAAA3236479EB5A36DB8543798E971.

You can verify the integrity of the file by checking its hash value using one of the outlined methods:

PowerShell (Windows):

Get-FileHash -Path "26.6.2.zip" -Algorithm SHA256

Command Prompt (Windows):

certutil -hashfile "26.6.2.zip" SHA256

Linux or macOS:

sha256sum "26.6.2.zip"