Acunetix 360 On-Demand

Improvements

• Login Screen Recorder content and interactions: Updated the Login Screen Recorder content and fixed an issue where button clicks weren’t correctly captured during recording sessions.
• Chromium engine update: Updated the internal Chromium engine to version 149 to provide improved security, stability, and performance.

Resolved issues

• Platform stability during target configuration: Fixed an issue where editing a target caused the platform to become unresponsive, ensuring the service remains available and stable during configuration updates.
• Business Logic Recorder authentication with CyberArk: Fixed an issue where the Business Logic Recorder failed to authenticate with CyberArk credentials, ensuring recordings now correctly start from the authenticated session.
• SSO and Okta authentication after upgrade: Fixed an issue where SSO and Okta logins failed after an upgrade, allowing users to successfully authenticate and access the application again.

New features

• Partial API updates (PATCH semantics) for scan profile and policy endpoints: You can now modify specific settings through the API without resubmitting the entire configuration object, so existing values are preserved when you update only part of a profile or policy.

Improvements

• 730-day scan data retention: You can now configure scan data retention for up to 730 days (two years), giving you longer access to historical scan results.
• Scan control API endpoint no longer returns unauthorized errors: The scan control API endpoint now correctly accepts requests using valid API credentials, so you can manage scan settings without unexpected authentication failures.
• Auth Verifier Service upgraded to .NET 10: The Auth Verifier Service now runs on .NET 10, ensuring long-term support, improved security, and access to the latest platform features.
• Scan agent upgraded to .NET 10: The scan agent now runs on .NET 10, delivering improved performance and enhanced stability.

Resolved issues

• Scheduled scans now authenticate correctly with OAuth 2: Fixed an issue where scheduled scans failed to authenticate using OAuth 2, ensuring automated scans complete as expected.
• Scans no longer fail when encountering null values during concurrent scanning: Fixed an issue that caused scans to fail when encountering null values, ensuring more reliable performance during high-volume concurrent scanning.
• Interactive Login and OAuth2 Test Connection now complete reliably: Fixed issues where Interactive Login hung during session saving and the OAuth2 Test Connection button remained unresponsive, ensuring authentication configurations and tests complete successfully.
• GraphQL vulnerability reports now show correct request and response data: Security reports for GraphQL checks now display the accurate request and response details for the detected vulnerability.

New features

• Pre-scan authentication validation for NTLM, Basic, and Kerberos: Scans can now be configured to fail immediately if credentials are invalid, preventing unauthenticated scans from running silently.
• Sitemap data retention policy now available in General Settings: Root users can now enable automatic cleanup of sitemap data older than one year, helping manage storage and keep scan data relevant.
• Interactive Login now supported on the Form Authentication page: Users can now handle MFA, CAPTCHA, and other interactive authentication steps directly within the UI during scan setup. Captured sessions are stored encrypted and reused automatically across future scans.

Improvements

• Docker agent updated with latest security patches: The Docker agent base image has been updated to address a critical OpenSSL vulnerability.
• Scans now fail immediately when the target returns HTTP 502: If the first response is a 502, the scan stops right away rather than continuing against an unreachable target.

Resolved issues

• Custom policy severity settings no longer reset after a product update: User-configured severity levels in custom report policies are now preserved across upgrades.
• Multiple scan notifications can now be created for the same target with different scan groups: Creating more than one “New Scan Notification” for the same target was incorrectly blocked when scan groups differed. The duplicate check now accounts for scan group selection.
• Login/Logout Verification dialog no longer shows stale errors on quick reopen: Closing and immediately reopening the verification modal no longer causes outdated error messages or incorrect UI state to appear.
• Targets can no longer be re-imported before the deletion grace period has elapsed: A target deleted within the last week could cause “already exists” errors when re-adding the same URL. This is now handled correctly.
• Remediation scans now correctly use the target’s assigned agent group: On-Prem remediation scans triggered via “Mark as Fixed (Unconfirmed)” were getting stuck in queue because the wrong agent was selected instead of the target’s configured internal agent group. Remediation scans now use the same agent selection logic as full and retest scans.
• Splunk plugin link now directs to the correct page: The Splunk integration link was pointing to an incorrect destination and has been fixed.
• Report generation no longer fails for findings with expired request/response data: Generating reports that included older findings where HTTP request/response data had been purged per the retention policy could cause the report to fail entirely. The report engine now handles missing evidence gracefully.
• Sensitive information masking logic improved: The “Prevent any sensitive information showing within the product” option now works more reliably across relevant areas of the UI.
• FIDO2 security key (YubiKey) registration no longer fails with “Incorrect U2F security key” error: A dependency version mismatch was causing YubiKey registration to fail. This has been resolved and FIDO2 keys can now be registered successfully.

Security checks

• JavaScript Source Map detection now available Added Javascript Source Map detected vulnerability into security checks.

Security checks

• CVE-2026-32933 remediation: Upgraded the AutoMapper library to remediate CVE-2026-32933, protecting your environment against the recently disclosed unbounded-recursion vulnerability.

New features

• Evidence field for version disclosure and outdated technology findings: Version disclosure and outdated technology findings now include an evidence field that shows exactly where the scanner detected the library, so you can locate and remediate the source faster.

Improvements

• MongoDB injection detection accuracy: Improved the Boolean-based MongoDB injection detection engine to reduce false positives on applications that don’t use MongoDB.

Resolved issues

• Notifications to deactivated or deleted users: Notification emails no longer reach users who have been deactivated or deleted while an active notification relationship still exists, so scan-completion alerts only go to active recipients.