runZero Release Notes

runZero 4.9.260430.0

Thu, 30 Apr 2026 00:00:00 +0000

The runZero 4.9 release is live! This version is focused on OT, attack graphs, and segmentation analysis.
The Network Maps (2D/3D) now render unmapped MACs and unscanned traceroute hops by default.
An issue that could lead to SNMP v3 reporting a username when none was specified has been resolved.
The scannner now uses significantly less resources while also reducing scan times.
Tags can now be used to manually specify geo locations: (ex: geo.City=Austin/TX/USA).
Assets with geolocation data now link to the World map from the inventory icon fields.
Fingerprint improvements.

runZero 4.8.260429.0

Wed, 29 Apr 2026 00:00:00 +0000

An additional issue with SCTP exceeding task rate limits has been resolved. The SCTP protocol is now disabled by default as a precaution and can be re-enabled via the scan configuration probes page (mark `sctp-tenable` as `true` to re-enable).
The `mtconnect` protocol is now used to collect default device information when available.
The Ethernet/IP CIP protocol stack now identifies a wider range of modules, including CNCs.

runZero 4.0.260428.2

Tue, 28 Apr 2026 00:00:00 +0000

An issue with SNMP sysObjectID normalization that could prevent asset matching has been resolved.
An issue that could result in larger-than-necessary scan files has been resolved.
The scanner now deduplicates the output of DCERPC and EPM protocol enumeration.
The `S7` source has been folded into the existing `S7Comm` definition.

runZero 4.0.260428.1

Tue, 28 Apr 2026 00:00:00 +0000

Fingerprint improvements.

runZero 4.0.260428.0

Tue, 28 Apr 2026 00:00:00 +0000

Bug fixes

Two issues were resolved with the new SCTP protocol implementation, both of which could lead to network disruption.
The first issue impacted environments where the configured scan rate was close to the network limit. The root cause was a misconfiguration of the rate limiter that treated SCTP separately from the rest of the scan traffic, which could lead to scans running at 1.5x to 2.0x of the configured rate. The fix was a correction to use the shared rate limiter as intended.
The second issue impacted stateful middle-boxes with low session limits and long timeouts for SCTP flows. The SCTP INIT scan did not proactively reset sessions; this could lead to quickly growing session counts and disruption of other flows once the device limit was reached. The fix was to implement proactively tear-down of SCTP sessions, similar to how runZero handles TCP SYN scans.
An issue that could result in asset inventory links returning a not-found error when in My Organizations mode has been resolved.
An issue that could lead to slow exports of the software and vulnerabilities table has been resolved.
An issue that could result in DCERPM EPM results not being captured completely has been resolved.

General updates

LDAP-sourced Active Directory records and CrowdStrike endpoint records now use the `objectGUID` and `objectSid` attributes for matching and merging.

Content updates

Fingerprint improvements.

runZero 4.0.260426.0

Sun, 26 Apr 2026 00:00:00 +0000

The Organizational Overview Report, Network Map, and World Map have been updated.
Fingerprint improvements.
4.0.260426.0

runZero 4.0.260423.0

Thu, 23 Apr 2026 00:00:00 +0000

The platform now includes a native integration for Rapid7's InsightVM Cloud.
The assets and services inventory search now support comma-delimited values for the `protocols` keyword.
Fingerprint improvements.

runZero 4.0.260421.0

Tue, 21 Apr 2026 00:00:00 +0000

Two additional issues that could cause Explorer processes to abort on Windows have been resolved.
The specific fields that contribute to an outlier score are now tracked in asset attributes.
Fingerprint improvements.

runZero 4.0.260420.1

Mon, 20 Apr 2026 00:00:00 +0000

An issue that could prevent TCP diagnostics from being reported in the task data has been resolved.

runZero 4.0.26020.0

Fri, 17 Apr 2026 00:00:00 +0000

Two issues that could cause Explorer processes to abort on Windows have been resolved.
An issue that could prevent email delivery due to provider rate limits has been addressed.
An issue that could prevent Unmerge actions from being completed has been resolved.
New maps are in preview; find them under the Manage menu of the asset details page.
Fingerprint improvements.

runZero 4.0.260417.0

Fri, 17 Apr 2026 00:00:00 +0000

An issue that could cause Windows Explorers to crash mid-scan has been addressed and all binaries are now built with the Go 1.26.2 toolchain. The root cause was a race condition leading to stack corruption in the TCP connection tracking logic.
An issue that could cause some saved software queries to error when run as part of a metrics task has been resolved.
An issue that could prevent integration searches from working with capital letters has been resolved.
An issue that could result in self-hosted upgrades showing a migration error has been resolved.
Fingerprint improvements.

runZero 4.0.260416.0

Thu, 16 Apr 2026 00:00:00 +0000

Features

The runZero console now offers the ability to switch between three themes: Classic, light, and dark mode.

Security

An issue that could allow a dashboard configuration to be viewed from outside of the authorized organization scope has been resolved.

Bug fixes

An issue that could cause the Windows Explorer service to crash mid-scan has been mitigated by a switch back to the Go 1.25 runtime for production builds while we continue to investigate.
An issue that prevented the Shodan integration from running all queries has been resolved.
A performance issue with the Software inventory has been resolved.

Content updates

OS reporting now takes into account the "os-release" OID for Linux systems running net-snmp.
Fingerprint improvements.

runZero 4.0.260414.0

Tue, 14 Apr 2026 00:00:00 +0000

The Wiz integration now supports filtering assets by cloud provider.
The scan template form now represents the "Additional security tests" options the same way as the standard form.
Scan configured from a template now use the template settings for "Additional security tests".
An issue that caused API-created scan tasks to store an incorrect start time due to timezone conversion has been resolved.
Additional issues that could lead to the Explorer service crashing during scans has been resolved.
An issue that caused the vulnerability inventory by asset index to show vulnerabilities that has been suppressed by group has been resolved.
Fingerprint improvements.

runZero 4.0.260410.0

Fri, 10 Apr 2026 00:00:00 +0000

The display order of asset host names can now be configured at the account and organization level.
Operating System End of Life (EOL) dates for Microsoft Windows Desktops now default to the Enterprise edition values unless a more specific edition is reported.
Operating System End of Life (EOL) information for Microsoft Windows Server has been improved.
Fingerprint improvements.

runZero 4.0.260407.0

Tue, 07 Apr 2026 00:00:00 +0000

Improved handling of ARP data for asset correlation, using only the latest available data when appropriate.
The software inventory now provides an organization name for each software group.
An issue that could result in incorrect SharePoint version collection has been resolved.
An issue that showed the incorrect icon color for Explorers without screenshot capabilities has been resolved.
An issue that caused some NetBox assets to merge incorrectly has been resolved.
Fingerprint improvements.

runZero 4.0.260402.0

Thu, 02 Apr 2026 00:00:00 +0000

The InsightVM integration now provides more detail in authentication errors.
The performance of and reliability of Explorers has been improved.
An issue that caused suppressed vulnerabilities to incorrectly reappear with updated scan results has been resolved.
Fingerprint improvements.

runZero 4.0.260401.2

Wed, 01 Apr 2026 00:00:00 +0000

An issue that could prevent self-hosted installations from upgrading correctly has been resolved.

runZero 4.0.260401.0

Wed, 01 Apr 2026 00:00:00 +0000

An issue that prevented overlapping site subnets from being configured has been resolved.
An issue that prevented sub-asset enumeration for IPv6 OT services has been resolved.
An issue that could result in scan tasks crashing during technology detection has been resolved.
An issue that led to the CrowdStrike integration using the wrong retry timer has been resolved.
An issue that could cause the asset grid to disappear when selecting an asset with a deleted custom integrations has been resolved.
An issue that resulted in the Subnet report double-counting some addresses has been resolved.
An issue that prevented `Select All` from working on the Software By Asset view has been resolved.
An issue that led to the date picker overflowing the container has been resolved.
Assets identified through BACnet, CIP, MODBUS and KNXnet gateways are now temporarily excluded from license counts while we improve the configurability of this feature.

runZero 4.0.260331.0

Tue, 31 Mar 2026 00:00:00 +0000

An issue that prevented the software tab on the asset details screen from loading has been resolved.
An issue that prevented the services inventory from loading has been resolved.
An issue that prevented software queries from calculating results has been resolved.
An issue that prevented service queries from calculating results has been resolved.
Fingerprint improvements.

runZero 4.0.260330.1

Mon, 30 Mar 2026 00:00:00 +0000

Fingerprint improvements.

runZero 4.0.260330.0

Mon, 30 Mar 2026 00:00:00 +0000

Assets are now identified through network-reachable BACnet, CIP, MODBUS and KNXnet gateway devices.
Assets are now automatically placed into a Category (IT, OT, IoT) and OT assets are assigned Functions.
An issue that caused Explorers deployed on Windows hosts to log "Failed to write to log" error messages has been resolved.
An issue that could cause Explorers running on Windows to crash under certain scenarios has been resolved.
Fingerprint improvements.

runZero 4.0.260329.0

Sun, 29 Mar 2026 00:00:00 +0000

An issue that resulted in zero-byte downloads for Windows executables has been resolved.

runZero 4.0.260327.1

Fri, 27 Mar 2026 00:00:00 +0000

Fingerprint improvements.

runZero 4.0.260327.0

Fri, 27 Mar 2026 00:00:00 +0000

The merge logic has been updated to avoid incorrectly merging assets with conflicting Intune hardware data.
An issue that caused failed recurring tasks to create events with incorrect metadata has been resolved.
An issue that could cause the console to run out of memory when serving Explorer or scanner binaries and large content updates has been resolved.

runZero 4.0.260326.0

Thu, 26 Mar 2026 00:00:00 +0000

runZero now offers an optional API key IP address allowlist which can be configured in the Account Settings section of your console.
The InsightVM integration now supports the ability to import asset tags.
The Tanium integration now filters additional invalid attribute values.
The Active Directory integration now includes Referrals in LDAP search error messages, if available.
The performance of loading the Tasks page has been improved.
An issue where cross-site aggregate query metrics could fail to be populated has been resolved.
An issue that prevented users from creating new dashboards has been resolved.
Fingerprint improvements.

runZero 4.0.260323.0

Mon, 23 Mar 2026 00:00:00 +0000

The runZero Risk Management dashboard is now the default view when no other dashboard has been selected.
The LDAP integration now includes extension attributes in its available data.
An issue that prevented images from displaying in specific sections of the console has been resolved.
An issue that prevented the BACnet probe from pulling data from the BACnet Broadcast Management Device (BBMD) and the Foreign Device Table (FDT) has been resolved.
An issue that caused the user avatars in the team tables to render incorrectly has been resolved.
An issue where suppressed vulnerabilities would not be returned when queried in metrics calculations has been addressed.
Fingerprint improvements.

runZero 4.0.260318.0

Wed, 18 Mar 2026 00:00:00 +0000

The asset view now offers `Unmerge` and `Export as task data` actions under the `Manage` menu.
The scanner now supports the Atlas Copco Open Protocol for device discovery.
The scanner now provides additional detail for the IPMI protocol.
The scanner now skips screenshots for TLS versions unsupported by Chrome.
The scanner now enumerates the backplane of Ethernet/IP CIP services automatically, reporting any visible assets.
Operating System End of Life (EOL) data for Microsoft Windows and HP/HPE iLO has been updated.
The web console [minimum supported browser version](https://help.runzero.com/docs/troubleshooting-supported-browsers/) has been updated to Chrome 123 (March 2024).
An issue that could prevent tasks from being rescheduled when console disk space is low has been resolved.
Fingerprint improvements.

runZero 4.0.260312.0

Thu, 12 Mar 2026 00:00:00 +0000

An issue that caused the AWS integration to trim the role prefix from the ARN has been resolved.
An issue that caused the self-hosted console return an error when the `AWS_CA_BUNDLE` environment variable is set has been resolved.
An issue that caused the self-hosted console to remove the systemd service during manual restarts has been resolved.
An issue that caused the self-hosted console to print an error on startup has been resolved.
An issue that could prevent in empty notification templates being sent has been resolved.
An issue causing excessive software record refreshes during task processing has been resolved.
Fingerprint improvements.

runZero 4.0.260311.0

Wed, 11 Mar 2026 00:00:00 +0000

The scanner now covers additional default ports for the BACnet protocol.
The `Known Exploited Vulnerability` finding has been retired in favor of direct vulnerability inventory queries (`kev:true`).
The self-hosted console will suggest email as an alternative if the fingerprint exceeds the maximum size.
The SentinelOne integration now supports a longer timeout for API calls (5 minutes).
The Tanium integration asset matching behavior is now more accurate
The LDAP integration's import of directory groups is now much faster.
Fingerprint improvements.

runZero 4.0.260307.1

Sat, 07 Mar 2026 00:00:00 +0000

Integration tasks with significant software records now process faster after an initial sync.
Fingerprint improvements.

runZero 4.0.260307.0

Sat, 07 Mar 2026 00:00:00 +0000

The performance of `software:` searches from the asset inventory has been improved.
A bug that could result in valid SSH endpoints being removed during ghost asset filtering has been resolved.
A bug that prevented the NetBox integration from connecting to some 4.2.x versions has been resolved.
A bug that allowed excessive `domain:` keywords to be supplied during scan configuration has been resolved.
A bug that prevented the Shodan integration from resolving scan targets when configured as part of a scan task has been resolved.
A bug that could result in an Explorer registering as a new instance during an upgrade has been resolved.
A bug that could lead to inconsistent fingerprinting via BACnet has been resolved.
Fingerprinting has been improved for assets imported from Dragos.

runZero 4.0.260304.1

Wed, 04 Mar 2026 00:00:00 +0000

Performance improvements.
Merge logic improvements.
Phantom device detection has been improved.
Shodan integration tasks that do not find any results are now logged, but do not fail.
Accessibility of navigation items within dropdown menus has been improved.

Content updates

Fingerprint improvements.

Bug fixes

An issue preventing some inventory searches linked to outliers from returning the expected results has been resolved.

runZero 4.0.260302.0

Mon, 02 Mar 2026 00:00:00 +0000

A bug that could result in CrowdStrike fingerprinting not being applied to assets has been resolved.
Fingerprint improvements.

runZero 4.0.260301.0

Sun, 01 Mar 2026 00:00:00 +0000

An issue that could cause Explorer processes to crash during a scan has been resolved.
Fingerprint improvements.

runZero 4.0.260222.0

Sun, 22 Feb 2026 00:00:00 +0000

The matching engine now uses hostnames from Rapid7 and Tanium sources to break matches.
An issue that could cause Explorer processes to crash during a scan has been resolved.
An issue where excessive memory was used by large vulnerability processing tasks has been resolved.
An issue that could result in incomplete IPMI enumeration has been resolved.
The scanner now skips protocol discovery for the Microsoft SQL Server replication service.
Protocol handling was improved for IDENTD, Daytime, RIP, STUN, and TURN services.
Fingerprint improvements.

runZero 4.0.260219.0

Thu, 19 Feb 2026 00:00:00 +0000

The asset inventory search now allows results to be filtered by vulnerability suppression state.
An issue where scan scheduling grace period settings from scan templates were not being applied has been resolved.
An issue where old software records were not being properly removed has been resolved.
The platform now supports a larger limit on asset vulnerability records.
Fingerprint improvements.

runZero 4.0.260218.1

Wed, 18 Feb 2026 00:00:00 +0000

An issue that prevented the stale integration attribute cleanup task from completing has been resolved.

runZero 4.0.260218.0

Wed, 18 Feb 2026 00:00:00 +0000

The AWS integration now supports roles with non-default paths for the IAM Role credential type.
The SNMP probe now trims whitespace from v3 credentials to avoid inadvertant misconfigurations.
The PAN API probe data is now used in the Layer-2 topology report.
The performance of the explorer details view has been improved.

Content updates

Fingerprint improvements.

Bug fixes

An issue that could result in addresses being incorrectly removed from an asset's Addresses Extra list has been resolved.
An issue that prevented services from using the latest fingerprints when manually refingerprinting assets has been resolved.
An issue that prevented the IEC 60870-5-104 probe from operating as expected has been resolved.
An issue that could prevent some MDNS data from being applied to assets as expected has been resolved.
An issue that prevented TOTP MFA tokens from being deleted by the "Reset security tokens" user action has been resolved.
An issue that could prevent the speedtest results table from rendering has been resolved.
An issue that could cause a scan task to report the error `scan data is unavailable` has been resolved.
An issue that could cause LDAP connector scan tasks to hang when the service is unreachable was resolved.
An issue that caused assets discovered through the MECM integration to be mis-merged with assets discovered in other Microsoft integrations has been resolved.

runZero 4.0.260213.0

Fri, 13 Feb 2026 00:00:00 +0000

Performance of loading the scan creation page has been improved.
The subnet import action on the site edit page will now provide error messages if the chosen file is malformed or incorrect.
The scanner can better detect and filter bogus MSSQL responses from Azure firewalls.
The runZero Service Graph Connector’s asset export API now defaults to a page size of 1,000.

Content updates

Fingerprint improvements.

Bug fixes

An issue causing tasks to show an inaccurate "Assets ignored" count in the change summary has been resolved.

runZero 4.0.260211.0

Wed, 11 Feb 2026 00:00:00 +0000

The site options on the import page are now sorted alphabetically.

Content updates

Fingerprint improvements.

runZero 4.0.260210.0

Tue, 10 Feb 2026 00:00:00 +0000

Security updates

An issue that could allow a credential to be updated and used for a task from outside of the authorized organization scope has been resolved.

Content updates

Data extraction from LLMNR sources has been improved.
Fingerprint improvements.

Bug fixes

A bug that could result in missing collection of CLDAP responses has been resolved.

runZero 4.0.260209.0

Mon, 09 Feb 2026 00:00:00 +0000

Content updates

Fingerprinting and data extraction from CDP sources has been improved.
The scanner now supports a `redact-secrets` option for the IPMI probe.
Fingerprint improvements.

Bug fixes

An issue that prevented previously scanned assets from being marked offline as expected has been resolved.
An issue where incorrect vulnerability counts could be returned from metrics calculations has been resolved.
An issue where AWS integration tasks running with IAM-console credentials within EC2 could not access AWS GovCloud regions has been resolved.
SNMP-reported interface MACs are skipped if the LAA bit is set and other non-LAA MACs are present in the interface list.
A bug that could result in HP iLOs being categorized as Server and not BMC has been resolved.

runZero 4.0.260208.0

Sun, 08 Feb 2026 00:00:00 +0000

Security updates

An issue that could allow access to explorer groups from outside of the authorized organization scope has been resolved.

Content updates

The scanner reports additional UDP protocols, including echo, daytime, cldap, iec104, llmnr, qotd, stun, time, turn, and zebra.
The scanner reports new IPMI attributes, including cipher zero support, RAKP hash disclosure, and weak passwords found via RAKP.
New queries have been added to report vulnerabilities associated with the new IPMI service attributes.
The scanner supports a new option for the SNMP probe: `debug-scope`. When provided an IP address or CIDR, full diagnostics logs of the SNMP session are recorded into the scan task file.
Improved normalization for hardware values received through the NetBox integration.
Fingerprint improvements.

Bug fixes

An issue that could prevent custom fingerprints from being used in all situations has been resolved.

runZero 4.0.260206.0

Fri, 06 Feb 2026 00:00:00 +0000

Security updates

An issue that could expose records outside of the authorized organization scope through the MCP endpoints has been resolved.
The runZero platform has fully adopted v2 of the AWS Go SDK, addressing potential risk with the out-of-support v1 library.

Content updates

Fingerprint improvements for Telerik, Cockpit, RustDesk, Home Assistant OS, and Tenable Core.
Improved device type normalization for free-form values ingested through integrations.

Bug fixes

An issue that could result in dashboard vulnerability metrics not matching the underlying queries has been resolved.
An issue that prevented the scanner from collecting Palo Alto Networks TLS thumbprints has been resolved.
An issue that could lead to UX issues when viewing an Explorer with a long web screenshot diagnostic message has been resolved.

runZero 4.0.260205.0

Thu, 05 Feb 2026 00:00:00 +0000

Security updates

An issue that could expose task information outside of the authorized organization scope has been resolved.

Content updates

The scanner now identifies and reports detailed version information for exposed MCP servers.
The NetBox connector now better normalizes free-form operating system values.
Fingerprint improvements.

Bug fixes

An issue that regressed the onboarded status filter for Microsoft Defender connections has been resolved.
An issue that resulted in only a single subnet tag being applied to a matching asset has been resolved.
An issue that could result in slow loads of the scan configuration page has been resolved.
An issue that led to SNMP warnings being reported as errors has been resolved.
The bundled npcap driver has been updated to v1.87, this resolves a potential BSoD in NPF_DoTap().
The asset inventory now deprioritizes hostnames with the `.localdomain` and `.crestron` suffixes.

runZero 4.0.260204.2

Wed, 04 Feb 2026 00:00:00 +0000

Security updates

An issue that could allow an authorized to view the clear-text secrets for a subset of credential types and fields has been resolved.

Content updates

Fingerprint improvements.

Bug fixes

An issue preventing the task inspection card on the task overview from automatically refreshing has been resolved.
An issue causing the Explorer speed test results to include speed tests from other Explorers within the organization has been resolved.

runZero 4.0.260204.1

Wed, 04 Feb 2026 00:00:00 +0000

A site name column has been added to the "Software inventory" table.

runZero 4.0.260204.0

Wed, 04 Feb 2026 00:00:00 +0000

An issue that could cause scan processing to fail with an error has been resolved.

runZero 4.0.260203.0

Tue, 03 Feb 2026 00:00:00 +0000

Security updates

An issue that allowed MCP agents to access certificate information from outside of their authorized organization scope has been resolved.
An issue that allowed administrators to create and update users outside of their authorized organization scope has been resolved.
An issue that could prevent session inactivity timeouts from triggering due to automatic page reloading has been resolved.
An issue that could allow a user with access to a credential to view sensitive fields through an API response has been resolved.

Content updates

Fingerprint improvements.

Bug fixes

An issue that could cause metric counts to not match live search results in some circumstances has been resolved.
An issue that could lead to excessive memory use in scan tasks that enable web screenshots has been resolved.
An issue that could result in `scan data is unavailable` errors for large Explorer-run tasks has been resolved.
An issue that could trigger a console stack trace when deleting the last organization within an account has been resolved.

runZero 4.0.260202.0

Mon, 02 Feb 2026 00:00:00 +0000

New features

Internet speed tests can be requested from any deployed Explorer. These tests can be run on-demand as well on a recurring schedule.
Users may now re-fingerprint assets in bulk from the Asset Inventory using the new "Refingerprint assets" action within the "Modify" action menu.

Security updates

An issue that allowed MCP agents to access remediation and asset information from outside of the authorized organization scope has been resolved.
An issue that allowed all-organization administrators to promote accounts to superuser status has been resolved.

Content updates

Fingerprint improvements.

Bug fixes

An issue that could cause site subnet tags on an asset to be inadvertently cleared has been resolved.
An issue that could cause scans to stall for up to fifteen minutes has been resolved.
An issue that could cause the scanner to stall during initialization on MacOS has been resolved.
An issue that could cause tasks to stall while stopping in certain rare cases has been resolved.
An issue that could cause tasks to stall at 99% in certain rare situations has been resolved.
An issue that could result in resource leaks during screenshot capture has been resolved.
An issue that could prevent a custom integration task from re-importing correctly has been resolved.
An issue that could prevent NetBox imports from including certain assets has been resolved.
An issue that could lead to custom integration warnings when no integration was specified has been resolved.