runZero Release Notes

runZero 4.9.260604.1

Thu, 04 Jun 2026 00:00:00 +0000

This console-only release addressed a bug in hosted external scan scheduling.

runZero 4.9.260604.0

Thu, 04 Jun 2026 00:00:00 +0000

Stale integration attribute and vulnerability expiration settings now support client-level defaults, which can be updated by superusers.
The site-updated event now includes details about what changes were made to the site.
An issue that could cause the scanner to incorrectly identify MCP services in rare cases has been resolved.
An issue that could cause tasks to fail with message explorer timeout when the initial upload fails has been resolved.
Fingerprint improvements.

runZero 4.9.260602.0

Tue, 02 Jun 2026 00:00:00 +0000

Custom dashboards now have widgets available to show vulnerability counts.
An issue that caused the Export dropdown on asset attribute analysis reports to be partially obscured has been resolved.
An issue that could result in incorrectly merging certain models of Cisco IP phones has been resolved.
An issue that could cause incomplete data collection from BACnet devices has been resolved.
An issue that could cause Windows explorers to crash while taking screenshots has been resolved.
Fingerprint improvements.

runZero 4.9.260529.0

Fri, 29 May 2026 00:00:00 +0000

An issue that could cause findings updates to fail has been resolved.
The performance of vulnerability exports for certain queries has been greatly improved.
Fingerprint improvements.

runZero 4.9.260528.0

Thu, 28 May 2026 00:00:00 +0000

The account and organization API endpoints for creating and updating an organization now support a new field, expiration_settings. The fields expiration_integration_attributes, keep_latest_integration_attributes, and expiration_vulnerabilities are being deprecated in favor of the new field.
The runZero console now allows the attribute and vulnerability expiration settings to be left blank to use default values when creating or editing an organization.
An issue that could cause an inaccurate Instances count in the Findings table has been resolved.
Fingerprint improvements.

runZero 4.9.260526.0

Tue, 26 May 2026 00:00:00 +0000

The Shodan integration now supports the ability to selectively exclude tags from assets.
runZero now offers the ability to configure which integrations can modify asset OS, hardware, and device type.
An issue that could cause the CLI scanner to return truncated scan results has been resolved.
An issue that allowed bogus arp.mac data into scan results has been resolved.
Fingerprint improvements.

runZero 4.9.260521.2

Thu, 21 May 2026 00:00:00 +0000

Protocol negotiation is now skipped by default for TCP ports 9042 and 9160.

runZero 4.9.260521.1

Thu, 21 May 2026 00:00:00 +0000

An issue that could cause Windows explorers to crash during high-speed scans has been resolved.

runZero 4.9.260521.0

Thu, 21 May 2026 00:00:00 +0000

The AWS integration’s VPC assets are now enriched with VPC endpoints data.
An issue that prevented the enrollment of TOTP tokens has been resolved.
An issue that caused scan and passive sampling tasks to duplicate assets in some circumstances has been resolved.
An issue that prevented empty sites from being removed has been resolved.
An issue that caused the “Set asset comments” and “Set asset tags” buttons to be removed from the Modify action within the asset inventory has been resolved.
An issue that could cause the CrowdStrike integration credential verification to fail has been resolved.
An issue that could cause Windows explorers to crash while taking screenshots has been resolved.
Fingerprint improvements.

runZero 4.9.260519.0

Tue, 19 May 2026 00:00:00 +0000

Users with the User role may now delete individual assets.
The AWS integration now processes VPC assets from connected accounts.
The performance of asset queries that use the vuln_exploitable keyword has been improved.
An issue affecting Time-based One Time Password (TOTP) multi-factor authentication (MFA) has been resolved.
Fingerprint improvements.

runZero 4.9.260514.0

Thu, 14 May 2026 00:00:00 +0000

An issue that could result in multi-source AWS ELBs maintaining old IP addresses has been resolved.
The scanner now scans additional DTLS ports (12346, 12366, 12386, 12406, 12426).
An issue that caused the Export dropdown on the Asset Risk Report to be partially obscured has been resolved.

runZero 4.9.260512.0

Tue, 12 May 2026 00:00:00 +0000

The vulnerability inventory now displays details when hovering over a vulnerability group name.
The Explorer details page now includes an option to download Explorer system logs.
An issue that could prevent the Overview dashboard from loading in My Organizations view has been resolved.
An issue that could cause the task details page to display negative scan and data acquisition durations has been resolved.
An issue that caused errors when sorting by Explorer Groups on the Explorer list page has been resolved.
An issue that prevented “findings-with-instances” alert rules from filtering by risk has been resolved.
An issue that caused “findings-with-instances” alert rules that were configured to notify when the vulnerability count decreases to instead notify when it increases has been resolved.
An issue that caused the total result count to be inaccurate after deleting or merging assets in the asset inventory has been resolved.
Fingerprint improvements.

runZero 4.9.260511.0

Mon, 11 May 2026 00:00:00 +0000

The scanner now detects network disruption and automatically lowers the send rate to accommodate.
The NetBox integration now supports a wide range of server versions (4.0 - 4.5).
The Query-Assets MCP tool now has the option to export services, attributes, and foreign attributes.
An issue that could result in tasks failing to process in low disk space scenarios has been resolved.
An issue that could prevent cloud-based integrations from using configured proxies via Explorers has been resolved.
An issue that could result in custom integration data continuing to report assets even after a definition was removed has been resolved.
An issue that could result in assets mismerging when IPv6 NA/NS requests are proxied by the router has been resolved.

runZero 4.9.260508.1

Fri, 08 May 2026 00:00:00 +0000

An issue that could result in assets failing to merge has been resolved. This was a race condition that primarily affected passive traffic sampling and IPv6 link-local scans.

runZero 4.9.260508.0

Fri, 08 May 2026 00:00:00 +0000

The Rapid7 InsightVM Cloud integration now handles larger data objects.
The single-count custom widget now includes a value delta for the time period of the dashboard.
The CLI scanner tool will now warn when run without the appropriate network permissions.
The embedded version of npcap provided with Windows Explorers has been updated to v1.88.
An issue that could cause certain error messages from integrations to report a misleading “API unreachable” message has been resolved.
An issue that prevented the display of the Avaya OS icon within the product has been resolved.
An issue that could cause Oracle ILOM devices to be displayed with an HP logo within the product has been resolved.
Fingerprint improvements.

runZero 4.9.260504.0

Mon, 04 May 2026 00:00:00 +0000

Integrations

The AWS integration now reports FSx assets.
The CrowdStrike connector now supports more retries when hitting transient 401 responses.

User experience

The Asset Inventory CSV report now includes the VLAN column.
Users with Annotator role access may now add asset comments in addition to tags.
The Network Maps now treat eol:true as meaning the later of the OS EOL or EOL Extended dates.

Scanner

The scanner no longer reports Siemens S7Comm virtual modules (“Firmware”) as sub-assets.
The scanner now randomizes TCP ports to reduce pressure on transparent proxies.
The scanner now uses less system resources and handles screenshots more reliably.
The scanner now reports screenshots for non-NLA RDP (Windows) and no-auth VNC.
The scanner now spends less time on network “tar pits” (hundreds of bogus services).
The scanner now reports application-layer data for SSL 2.0 wrapped services.
The scanner now handshakes PQC hybrid ciphers for SSH services.

Bug fixes

An issue that could result in single-source AWS ELBs maintaining old IP addresses has been resolved.
An issue that could result in ARP results reporting mangled IPs has been resolved.
An issue that could lead to duplicate GeoIP asset attribute values has been resolved.
An issue that could lead to stale Chrome processes during scans has been resolved.
An issue that could result in invalid SNMP versions being reported has been resolved.
An issue that could cause Certificates to not correctly sort by Subject or Subject Key ID has been resolved.

Content updates

Fingerprint improvements.

runZero 4.9.260430.1

Thu, 30 Apr 2026 00:00:00 +0000

An issue that could cause dashboard widgets to render with an incorrect chart height has been resolved.
An issue that could result in Custom Integration Scripts throwing an error when comparing IPAddress values has been resolved.
An issue that could cause the Custom Integration Scripts code editor to render incorrectly in dark mode has been resolved.
An issue that could cause inventory tables to sort by unavailable columns has been resolved.
The scanner worker group size is now decoupled from the configured scan rate to improve resource usage.
The scanner now completes web screenshots faster on machines with generous memory but low CPU core counts.
The scanner now uses less resources during the HTTP and vulnerability scan phases.
Fingerprint improvements.

runZero 4.9.260430.0

Thu, 30 Apr 2026 00:00:00 +0000

The runZero 4.9 release is live! This version is focused on OT, attack graphs, and segmentation analysis.
The Network Maps (2D/3D) now render unmapped MACs and unscanned traceroute hops by default.
An issue that could lead to SNMP v3 reporting a username when none was specified has been resolved.
The scanner now uses significantly less resources while also reducing scan times.
Tags can now be used to manually specify geo locations: (ex: geo.City=Austin/TX/USA).
Assets with geolocation data now link to the World Map from the inventory icon fields.
Fingerprint improvements.

runZero 4.8.260429.0

Wed, 29 Apr 2026 00:00:00 +0000

An additional issue with SCTP exceeding task rate limits has been resolved. The SCTP protocol is now disabled by default as a precaution and can be re-enabled via the scan configuration probes page (mark sctp-tenable as true to re-enable).
The mtconnect protocol is now used to collect default device information when available.
The Ethernet/IP CIP protocol stack now identifies a wider range of modules, including CNCs.

runZero 4.0.260428.2

Tue, 28 Apr 2026 00:00:00 +0000

An issue with SNMP sysObjectID normalization that could prevent asset matching has been resolved.
An issue that could result in larger-than-necessary scan files has been resolved.
The scanner now deduplicates the output of DCERPC and EPM protocol enumeration.
The S7 source has been folded into the existing S7Comm definition.

runZero 4.0.260428.1

Tue, 28 Apr 2026 00:00:00 +0000

Fingerprint improvements.

runZero 4.0.260428.0

Tue, 28 Apr 2026 00:00:00 +0000

Bug fixes

Two issues were resolved with the new SCTP protocol implementation, both of which could lead to network disruption.
The first issue impacted environments where the configured scan rate was close to the network limit. The root cause was a misconfiguration of the rate limiter that treated SCTP separately from the rest of the scan traffic, which could lead to scans running at 1.5x to 2.0x of the configured rate. The fix was a correction to use the shared rate limiter as intended.
The second issue impacted stateful middle-boxes with low session limits and long timeouts for SCTP flows. The SCTP INIT scan did not proactively reset sessions; this could lead to quickly growing session counts and disruption of other flows once the device limit was reached. The fix was to implement proactively tear-down of SCTP sessions, similar to how runZero handles TCP SYN scans.
An issue that could result in asset inventory links returning a not-found error when in My Organizations mode has been resolved.
An issue that could lead to slow exports of the software and vulnerabilities table has been resolved.
An issue that could result in DCERPM EPM results not being captured completely has been resolved.

General updates

LDAP-sourced Active Directory records and CrowdStrike endpoint records now use the objectGUID and objectSid attributes for matching and merging.

Content updates

Fingerprint improvements.

runZero 4.0.260426.0

Sun, 26 Apr 2026 00:00:00 +0000

The Organizational Overview Report, Network Map, and World Map have been updated.
Fingerprint improvements.
4.0.260426.0

runZero 4.0.260423.0

Thu, 23 Apr 2026 00:00:00 +0000

The platform now includes a native integration for Rapid7’s InsightVM Cloud.
The assets and services inventory search now support comma-delimited values for the protocols keyword.
Fingerprint improvements.

runZero 4.0.260421.0

Tue, 21 Apr 2026 00:00:00 +0000

Two additional issues that could cause Explorer processes to abort on Windows have been resolved.
The specific fields that contribute to an outlier score are now tracked in asset attributes.
Fingerprint improvements.

runZero 4.0.260420.1

Mon, 20 Apr 2026 00:00:00 +0000

An issue that could prevent TCP diagnostics from being reported in the task data has been resolved.

runZero 4.0.26020.0

Fri, 17 Apr 2026 00:00:00 +0000

Two issues that could cause Explorer processes to abort on Windows have been resolved.
An issue that could prevent email delivery due to provider rate limits has been addressed.
An issue that could prevent Unmerge actions from being completed has been resolved.
New maps are in preview; find them under the Manage menu of the asset details page.
Fingerprint improvements.

runZero 4.0.260417.0

Fri, 17 Apr 2026 00:00:00 +0000

An issue that could cause Windows Explorers to crash mid-scan has been addressed and all binaries are now built with the Go 1.26.2 toolchain. The root cause was a race condition leading to stack corruption in the TCP connection tracking logic.
An issue that could cause some saved software queries to error when run as part of a metrics task has been resolved.
An issue that could prevent integration searches from working with capital letters has been resolved.
An issue that could result in self-hosted upgrades showing a migration error has been resolved.
Fingerprint improvements.

runZero 4.0.260416.0

Thu, 16 Apr 2026 00:00:00 +0000

Features

The runZero console now offers the ability to switch between three themes: Classic, light, and dark mode.

Security

An issue that could allow a dashboard configuration to be viewed from outside of the authorized organization scope has been resolved.

Bug fixes

An issue that could cause the Windows Explorer service to crash mid-scan has been mitigated by a switch back to the Go 1.25 runtime for production builds while we continue to investigate.
An issue that prevented the Shodan integration from running all queries has been resolved.
A performance issue with the Software inventory has been resolved.

Content updates

OS reporting now takes into account the “os-release” OID for Linux systems running net-snmp.
Fingerprint improvements.

runZero 4.0.260414.0

Tue, 14 Apr 2026 00:00:00 +0000

The Wiz integration now supports filtering assets by cloud provider.
The scan template form now represents the “Additional security tests” options the same way as the standard form.
Scan configured from a template now use the template settings for “Additional security tests”.
An issue that caused API-created scan tasks to store an incorrect start time due to timezone conversion has been resolved.
Additional issues that could lead to the Explorer service crashing during scans has been resolved.
An issue that caused the vulnerability inventory by asset index to show vulnerabilities that has been suppressed by group has been resolved.
Fingerprint improvements.

runZero 4.0.260410.0

Fri, 10 Apr 2026 00:00:00 +0000

The display order of asset host names can now be configured at the account and organization level.
Operating System End of Life (EOL) dates for Microsoft Windows Desktops now default to the Enterprise edition values unless a more specific edition is reported.
Operating System End of Life (EOL) information for Microsoft Windows Server has been improved.
Fingerprint improvements.

runZero 4.0.260407.0

Tue, 07 Apr 2026 00:00:00 +0000

Improved handling of ARP data for asset correlation, using only the latest available data when appropriate.
The software inventory now provides an organization name for each software group.
An issue that could result in incorrect SharePoint version collection has been resolved.
An issue that showed the incorrect icon color for Explorers without screenshot capabilities has been resolved.
An issue that caused some NetBox assets to merge incorrectly has been resolved.
Fingerprint improvements.

runZero 4.0.260402.0

Thu, 02 Apr 2026 00:00:00 +0000

The InsightVM integration now provides more detail in authentication errors.
The performance of and reliability of Explorers has been improved.
An issue that caused suppressed vulnerabilities to incorrectly reappear with updated scan results has been resolved.
Fingerprint improvements.

runZero 4.0.260401.2

Wed, 01 Apr 2026 00:00:00 +0000

An issue that could prevent self-hosted installations from upgrading correctly has been resolved.

runZero 4.0.260401.0

Wed, 01 Apr 2026 00:00:00 +0000

An issue that prevented overlapping site subnets from being configured has been resolved.
An issue that prevented sub-asset enumeration for IPv6 OT services has been resolved.
An issue that could result in scan tasks crashing during technology detection has been resolved.
An issue that led to the CrowdStrike integration using the wrong retry timer has been resolved.
An issue that could cause the asset grid to disappear when selecting an asset with a deleted custom integrations has been resolved.
An issue that resulted in the Subnet report double-counting some addresses has been resolved.
An issue that prevented Select All from working on the Software By Asset view has been resolved.
An issue that led to the date picker overflowing the container has been resolved.
Assets identified through BACnet, CIP, MODBUS and KNXnet gateways are now temporarily excluded from license counts while we improve the configurability of this feature.

runZero 4.0.260331.0

Tue, 31 Mar 2026 00:00:00 +0000

An issue that prevented the software tab on the asset details screen from loading has been resolved.
An issue that prevented the services inventory from loading has been resolved.
An issue that prevented software queries from calculating results has been resolved.
An issue that prevented service queries from calculating results has been resolved.
Fingerprint improvements.

runZero 4.0.260330.1

Mon, 30 Mar 2026 00:00:00 +0000

Fingerprint improvements.

runZero 4.0.260330.0

Mon, 30 Mar 2026 00:00:00 +0000

Assets are now identified through network-reachable BACnet, CIP, MODBUS and KNXnet gateway devices.
Assets are now automatically placed into a Category (IT, OT, IoT) and OT assets are assigned Functions.
An issue that caused Explorers deployed on Windows hosts to log “Failed to write to log” error messages has been resolved.
An issue that could cause Explorers running on Windows to crash under certain scenarios has been resolved.
Fingerprint improvements.

runZero 4.0.260329.0

Sun, 29 Mar 2026 00:00:00 +0000

An issue that resulted in zero-byte downloads for Windows executables has been resolved.

runZero 4.0.260327.1

Fri, 27 Mar 2026 00:00:00 +0000

Fingerprint improvements.

runZero 4.0.260327.0

Fri, 27 Mar 2026 00:00:00 +0000

The merge logic has been updated to avoid incorrectly merging assets with conflicting Intune hardware data.
An issue that caused failed recurring tasks to create events with incorrect metadata has been resolved.
An issue that could cause the console to run out of memory when serving Explorer or scanner binaries and large content updates has been resolved.

runZero 4.0.260326.0

Thu, 26 Mar 2026 00:00:00 +0000

runZero now offers an optional API key IP address allowlist which can be configured in the Account Settings section of your console.
The InsightVM integration now supports the ability to import asset tags.
The Tanium integration now filters additional invalid attribute values.
The Active Directory integration now includes Referrals in LDAP search error messages, if available.
The performance of loading the Tasks page has been improved.
An issue where cross-site aggregate query metrics could fail to be populated has been resolved.
An issue that prevented users from creating new dashboards has been resolved.
Fingerprint improvements.

runZero 4.0.260323.0

Mon, 23 Mar 2026 00:00:00 +0000

The runZero Risk Management dashboard is now the default view when no other dashboard has been selected.
The LDAP integration now includes extension attributes in its available data.
An issue that prevented images from displaying in specific sections of the console has been resolved.
An issue that prevented the BACnet probe from pulling data from the BACnet Broadcast Management Device (BBMD) and the Foreign Device Table (FDT) has been resolved.
An issue that caused the user avatars in the team tables to render incorrectly has been resolved.
An issue where suppressed vulnerabilities would not be returned when queried in metrics calculations has been addressed.
Fingerprint improvements.

runZero 4.0.260318.0

Wed, 18 Mar 2026 00:00:00 +0000

The asset view now offers Unmerge and Export as task data actions under the Manage menu.
The scanner now supports the Atlas Copco Open Protocol for device discovery.
The scanner now provides additional detail for the IPMI protocol.
The scanner now skips screenshots for TLS versions unsupported by Chrome.
The scanner now enumerates the backplane of Ethernet/IP CIP services automatically, reporting any visible assets.
Operating System End of Life (EOL) data for Microsoft Windows and HP/HPE iLO has been updated.
The web console minimum supported browser version has been updated to Chrome 123 (March 2024).
An issue that could prevent tasks from being rescheduled when console disk space is low has been resolved.
Fingerprint improvements.

runZero 4.0.260312.0

Thu, 12 Mar 2026 00:00:00 +0000

An issue that caused the AWS integration to trim the role prefix from the ARN has been resolved.
An issue that caused the self-hosted console return an error when the AWS_CA_BUNDLE environment variable is set has been resolved.
An issue that caused the self-hosted console to remove the systemd service during manual restarts has been resolved.
An issue that caused the self-hosted console to print an error on startup has been resolved.
An issue that could prevent in empty notification templates being sent has been resolved.
An issue causing excessive software record refreshes during task processing has been resolved.
Fingerprint improvements.

runZero 4.0.260311.0

Wed, 11 Mar 2026 00:00:00 +0000

The scanner now covers additional default ports for the BACnet protocol.
The Known Exploited Vulnerability finding has been retired in favor of direct vulnerability inventory queries (kev:true).
The self-hosted console will suggest email as an alternative if the fingerprint exceeds the maximum size.
The SentinelOne integration now supports a longer timeout for API calls (5 minutes).
The Tanium integration asset matching behavior is now more accurate
The LDAP integration’s import of directory groups is now much faster.
Fingerprint improvements.

runZero 4.0.260307.1

Sat, 07 Mar 2026 00:00:00 +0000

Integration tasks with significant software records now process faster after an initial sync.
Fingerprint improvements.

runZero 4.0.260307.0

Sat, 07 Mar 2026 00:00:00 +0000

The performance of software: searches from the asset inventory has been improved.
A bug that could result in valid SSH endpoints being removed during ghost asset filtering has been resolved.
A bug that prevented the NetBox integration from connecting to some 4.2.x versions has been resolved.
A bug that allowed excessive domain: keywords to be supplied during scan configuration has been resolved.
A bug that prevented the Shodan integration from resolving scan targets when configured as part of a scan task has been resolved.
A bug that could result in an Explorer registering as a new instance during an upgrade has been resolved.
A bug that could lead to inconsistent fingerprinting via BACnet has been resolved.
Fingerprinting has been improved for assets imported from Dragos.

runZero 4.0.260304.1

Wed, 04 Mar 2026 00:00:00 +0000

Performance improvements.
Merge logic improvements.
Phantom device detection has been improved.
Shodan integration tasks that do not find any results are now logged, but do not fail.
Accessibility of navigation items within dropdown menus has been improved.

Content updates

Fingerprint improvements.

Bug fixes

An issue preventing some inventory searches linked to outliers from returning the expected results has been resolved.

runZero 4.0.260302.0

Mon, 02 Mar 2026 00:00:00 +0000

A bug that could result in CrowdStrike fingerprinting not being applied to assets has been resolved.
Fingerprint improvements.