Modern infrastructure, minimal effort: the next Tenable Patch Management release is here
The April 2026 release of Tenable Patch Management is officially live. This update focuses on the unpatchables—modern ARM architectures, massive Windows feature updates, and performance-heavy drivers—giving you broader coverage without the operational lag. What’s changing and why it matters: Support for the modern cloud (Linux ARM): The value: Organizations are increasingly adopting ARM-based architectures (like AWS Graviton) for better cost and power efficiency. Tenable Patch Management now provides full patch lifecycle management for ARM-based versions of RHEL, Ubuntu, Debian, and more. Use case: If your DevOps team is scaling web-scale applications on ARM-based cloud instances, you can now include these specialized endpoints in your standard autonomous patch strategies, ensuring they receive the same security rigor as your traditional x86 fleet. Zero-friction windows upgrades: The value: We’ve automated the big ones. Windows 10/11 Feature Updates are notoriously difficult to manage due to their size and complexity. Tenable Patch Management now automates the eligibility checks and phased rollouts of these updates, utilizing peer-to-peer distribution to protect your bandwidth. Use case: A security manager can set a policy to roll out the latest Windows 11 Feature Update in waves, starting with a canary group in IT for validation before moving to broader business units, ensuring a smooth transition without disrupting global operations. Lightweight driver patching: The value: We’ve ditched heavy CAB-based catalogs. Get lightning-fast visibility into Dell, HP, and Lenovo drivers using native OS metadata. Use case: You can now perform frequent driver scans across thousands of remote laptops without worrying about "scan bloat" or slowing down employee machines during peak hours. Expanded Linux coverage & platform speed: The value: Stay current with the latest enterprise environments. We’ve added comprehensive support for Amazon Linux 2023 (AL2023), the latest Fedora (42/43) releases, and the newest SUSE and OpenSUSE iterations (including SLES/SLED 15 SP7 & 16). Combined with our migration to Java 25 virtual threads, we’ve slashed the memory footprint for both client and server, making the platform faster and leaner. In addition to all of the new features, we’re also making the following UI enhancements and bug fixes: Patch filter preview: Resolved a bug where multiple filter categories in the Strategy Editor (e.g., Tenable.vpr, risk.cvssscores) failed to return results when using the "Preview Filtered Software" function. Simple preview: Fixed an issue in the Simple Strategy Editor where the "Preview Targeted Patches" button returned empty results for products with a SoftwareProduct parent, including all Windows OS, Linux, and Driver patches. Pre-staging bug: Fixed a critical issue where Windows Update deployments would fail to start if the "pre-staging" option was enabled. Save as API: Resolved a REST API error that occurred when using the "Save As" feature on an existing strategy template. Character limits: Increased the character limit for User Interaction settings text fields (specifically the HTTP POST Message field) to prevent data truncation and database errors. Get the full details This release is available for both Tenable Patch Management SaaS and On-Prem customers. For a deep dive into the new distributions (Amazon Linux 2023, SLES 16, Fedora 42 & 43) and technical specs, check out the resources below: 👉 [Release Notes] 👉 [Technical Documentation] 👉 [Downloads]
April 2026 Tenable Product Newsletter
Check out our April newsletter to learn about the latest product and research updates, upcoming and on-demand webinars and educational content — all to help you get more value from your Tenable solutions. EXPOSURE 2026 The Tenable Exposure Management Conference There’s still time to register for EXPOSURE 2026, the first and only in-person event dedicated to exposure management for the AI era. Join us in Boston, Mass., from May 19-21, 2026, to: Get a practical blueprint for securing your AI attack surface. Hear real-world strategies from the industry’s top security executives. Master new techniques in hands-on labs and exclusive training sessions. Register now! Product update: Standardizing Tenable risk scoring Coming July 1: A new standard for VPR For the past several months, many customers have utilized VPR (Beta) to gain deeper insights into exploitability. We are excited to announce that on July 1, this model will be promoted to the primary Vulnerability Priority Rating (VPR) across the Tenable platform. By standardizing on this advanced model, we are retiring legacy VPR scoring to ensure every customer benefits from our most sophisticated threat intelligence. We're also enhancing our asset classification engine. As a result, customers with access to Asset Criticality Ratings (ACR) will see these scores more accurately reflect real-world business risk. Read the full update on Tenable Connect. Tenable Cloud Security Stop chasing ghosts. Start fixing what's actually exposed. This month, we’re trading “potential risk” for proof. Spotlight: Reachability, validated Network Scanner results now feed directly into our core risk engine. Instead of flagging every internet-facing asset, Tenable dynamically confirms what’s actually reachable across AWS, GCP, Azure, and OCI, so you chase toxic combinations on truly exposed assets, not shadows behind a WAF. Also new Unified accounts page. One view for every cloud and identity account. Goodbye, provider silos. More wins for your team Protect dev velocity. Exclude unresolvable CVEs from container scans so noise doesn’t break builds. Effortlessly scale triage. Turn any Explorer investigation into a permanent automation rule. Automate least privilege. Auto-generate custom roles for over-privileged Entra ID and GCP groups based on real usage. Find what others miss. Updated engine surfaces vulnerabilities buried in nested JAR files. View full release notes → Tenable Vulnerability Management Introducing VM-Native OT Discovery Safely identify and profile connected PLCs, HMIs, and IoT devices using the vulnerability management toolset you already own. No specialized hardware or complex deployments required. Turn your existing IT security tools into a safe OT discovery engine today and get visibility into your IT/OT security gap. Watch the guided demo to see this new capability in action. Review the latest documentation for Scan Templates and Discovery Settings to get started. Find and fix hidden risks across your infrastructure To protect your environment, you need a clear view of every asset and vulnerability. New reports and dashboards give you visibility to find hidden exposures in your Java, database, and operating system layers before they lead to a disruption. Identify every Java vulnerability: Go beyond a simple update to secure Java and see how unmanaged applications expand your risk. Java visibility and exposures dashboard: Get a full view of your Java ecosystem to find legacy flaws and library exploits that could give attackers access to your internal network. Java visibility and exposures report: Turn complex scan data into a clear map of your assets to find hidden weaknesses in unpatched installations before they cause a disruption. Prioritize your database security: Protecting your data depends on knowing which databases are most vulnerable. This new report and dashboard help your team close exposures and meet audit requirements by highlighting critical gaps. Database application visibility and exposures dashboard: Use this one-stop shop to see all supported and unsupported databases in one place. You can quickly see which assets are exploitable or have been active for too long, so you know what to patch first. Database visibility and exposures report: Streamline your compliance audits and vulnerability assessments with a clear breakdown of your database risks and best practices. Inventory your assets and improve scan accuracy: Full visibility requires knowing exactly what is running on your network. Operating system and application inventory with data troubleshooting report: Get a high-level summary of your OS and application instances. Includes specific queries to help you identify and fix scan fidelity issues for data accuracy and effective security operations. Tenable Nessus We’re thrilled to announce that Tenable Nessus v10.12 is now available for early access, with general availability expected later this month. This release streamlines your workflow with a revised interface and updated security protocols. Organize scans: Simply drag and drop existing scans from a list view directly into a folder or directory for easier organization. Import files: Instantly import a scan file (like .nessus) by dragging it from the local desktop into Nessus. OpenSSL 3.5 support: Nessus now fully supports OpenSSL 3.5, ensuring your vulnerability assessment operations meet the latest cryptographic standards. FIPS-140.3 support: Support for the FIPS 140-3 standard has been added. View Nessus 10.12 product documentation for more info Tenable Security Center Tenable Security Center 6.8 Focus on the vulnerabilities that truly matter with AI-powered VPR insights and clear mitigation guidance. This release streamlines your operations with unified asset repositories for IPv4, IPv6, and Agents, and improves efficiency with new background query processing and scan optimization tools. Foundational visibility for cyber-physical systems with VM-native OT Discovery We recently added native OT discovery capabilities in Tenable Security Center, allowing you to quickly map unknown/unmanaged cyber-physical systems (PLCs, IoT devices, etc.) using the tools you already own. Get insight into mission-critical OT assets across your network without risking disruption or the need for additional agents or add-on purchases. Find out how to configure your first scan here. View full release notes → Tenable OT Security Introducing Tenable OT Security 4.6 Our latest release introduces a variety of new features and performance enhancements, including refined scan controls and streamlined workflows for large-scale enterprise environments. Massive subnet scaling: Now supports up to 5,000 subnets per ICP, significantly increasing visibility for distributed large enterprise deployments. Centralized network management: A new Monitored Networks page includes bulk-add capabilities and the ability to stage inactive networks before monitoring. Precision scanning: New scan customization options allow you to define specific credential usage per scan for safe discovery of sensitive assets. Streamlined platform navigation: Updated workflow for SSO/SAML users allows you to instantly pivot back to the Tenable One platform with a single click. Remote agent updates and query restrictions: Update OT agents directly from the ICP, remove local site visits or manual CLI intervention, and restrict specific protocol queries with OT agents. Enhanced diagnostics: Deeper metadata in asset log exports for faster troubleshooting. IoT connector updates: Major stability and performance upgrades for Milestone, AvigilonES, and Exacq Edge integrations for IoT asset discovery. Update required: Tenable OT Security 4.5 Service Pack (version 4.5.61) All customers running version 4.5 should apply this upgrade immediately for optimal system stability and performance when processing high volumes of network conversations. This update also addresses communication gaps with Rockwell Stratix devices and Nessus scans. View full release notes → Tenable Identity Exposure Sharper signal. Steadier platform. This month, we are making the detections you rely on more precise, and the platform underneath more resilient. Detections that cut through the noise Golden Ticket IoA, now directory-aware. Smarter logic means fewer false positives and fewer missed hits in multi-domain environments. Richer PetitPotam context. Detections now surface hostnames and source IPs, so triage starts with answers, not questions. Platform you can count on Accurate API pagination. Iterate through result sets cleanly for faster, more reliable reporting. Self-healing listeners. RabbitMQ and Sysvol connections now auto-recover after restarts or network blips. View full release notes → Tenable PCI ASV Tenable PCI ASV interface update The Tenable PCI ASV interface will change on or around May 8, 2026, to simplify your compliance workflow. Changes will not affect your data, scan history, attestation records, or scan configurations. Here’s what’s changing: Renamed actions: Submit PCI is becoming Import to ASV Workbench, and the In Remediation tab changes to Scan Customer Review. Easier review: A new Accept button and compliance dialog let you confirm requirements in fewer clicks, with a progress indicator to track your status in real-time. Unified vulnerability view: Failures and Disputes merge into a single Vulnerability Review & Disputes tab. Updated Navigation: The Submit to ASV Review button is moving to a more intuitive position in the workflow. The changes will happen automatically. You don’t need to take action. Questions? Contact Tenable Support or your Customer Success Manager. Tenable Training and Product Education Enhanced Tenable Vulnerability Management training now available Maximize your security investment with the redesigned Introduction to Tenable Vulnerability Management course, available at no cost in Tenable University. This updated experience includes interactive elements, demonstration videos, and knowledge checks to help you quickly gain practical expertise. You will navigate the latest user interface with ease while implementing recommended settings to optimize your platform configuration from day one. Tenable Connect Join the Tenable Connect Office Hours group Missed a live Office Hours session? No problem! We are excited to launch the official Office Hours group to provide you with a centralized hub for Office Hours sessions and support. When you join the group, you’ll be able to: Watch recordings: Access the library of past regional Office Hours sessions at your convenience. Review key Q&As: Review important questions and expert answers from every call so you can find solutions without watching the full video. Search with ease: Use Tenable Connect’s unified search to find specific topics discussed across any of our recorded sessions. Don't miss a beat! Join the group to catch up on the latest sessions and stay ahead of the curve. And register for upcoming live Office Hours sessions here. Tenable Webinars Tune in for product updates, demos, how-to advice, and Q&A. See all upcoming live and on-demand webinars at tenable.com/webinars. On-demand Tenable customer update: April 2026: Watch this quarterly Tenable customer update to learn how to use AI to augment your security team, secure your expanding AI attack surface, uncover hidden risk across your connected IT/OT environments, and more. Products covered: Tenable One, AI Exposure, Tenable Vulnerability Management, OT functionality, third-party data connections, and Tenable Security Center. Customer Office Hours Recurring ask-me-anything sessions for Tenable One, Tenable Security Center, Tenable Vulnerability Management, Tenable Cloud Security, Tenable Identity Exposure and Tenable OT Security. Time-zone-appropriate sessions are available for the Americas, Europe (including Middle East and Africa), and Asia Pacific (APJ). Register here. Tenable Research Research Security Operations blog posts Subscribe to the Research team blog posts here. The hidden cost of AI speed: Unmanaged cyber risk Supply chain attack on Axios npm package: Scope, impact, and remediations Research release highlights Potential Vulnerabilities: Tenable Research is officially introducing Potential Vulnerabilities. A potential vulnerability is a finding that has a lower degree of certainty as to whether the assessed application is or is not vulnerable. Improvement to printer OS fingerprinting: Scanned printers will now have an OS artifact surfaced in their scan host metadata if the target has been identified as a printer when the Scan Network Printers policy option is disabled. Content coverage highlights Almost 4,500 new published vulnerability plugins. More than 130 new audits delivered to customers. Read Tenable documentation.
GA Announcement – Tenable App for Microsoft Sentinel v3.1.2
Release Date: April 16, 2026 Hi everyone! We’re excited to announce the general availability (GA) of version 3.1.2 of the Tenable App for Microsoft Sentinel! This release includes minor enhancements and version updates to help you get the most from your integration. Resources Download & Install: Tenable App for Microsoft Sentinel – Azure Marketplace Documentation: Installation & Upgrade Guide What’s New Multiple rsyslog Support: Updated the Tenable IE (TIE) data connector UI to support multiple rsyslog configurations. Schema Updates: Updated the Tenable VM Vulnerability and Tenable WAS Vulnerability table schemas within the ARM Template for the Tenable Vulnerability Management data connector. SDK Optimization: Updated the Tenable Vulnerability SDK method to utilize indexed_at instead of last_found for improved data handling. We recommend you upgrade to v3.1.2 to ensure full support for these latest schema changes and connector enhancements. Questions? We’re here to help! Reach out to us in connect.tenable.com — Ahmad Maruf Principle Product Manager, Tenable Ecosystem
Improvement to Printer OS Fingerprinting
Updated: April 3, 2026 Summary Scanned printers will now have an OS artefact surfaced in their scan host metadata if the target has been identified as a printer when the “Scan Network Printers” policy option is disabled. This change will not cause any additional asset licenses to be consumed within Tenable VM or Tenable Security Center. Background Printers are notoriously unstable scan targets. Oftentimes, they can behave erratically when scanned, so some users prefer to avoid scanning them altogether. At present, there is a switch in the scan policies to prevent further scanning of a host when it's identified as a printer. To enable this setting, go to Settings -> Host Discovery -> Fragile devices - Scan Network Printers (Currently, this is a checkbox setting, default value “off”). With that said, how can the scanner know the target is a printer if it cannot be scanned? In reality, the scanner still performs very basic fingerprinting (usually via SNMP) in order to gather enough information to make an educated guess at the device type. When the scan target is thought to be a printer, it essentially gets marked as “Host/dead" in the scan KB. When this happens, the scanner will not perform any further active scanning. Changes With this update, the fingerprint used to identify the printer as such, will now be stored in the scan Knowledge Base (KB) so it can be processed by os_fingerprint2.nasl ("Post-scan OS Identification", plugin ID 83349) and surfaced as metadata in the scan result. The relevant policy setting located at Settings -> Host Discovery -> Fragile devices -> Scan Network Printers. With this update, the printer's OS information will now be surfaced if it is available, regardless of the selected value for this setting. Impact Users can now see the OS information for their printer devices that would have otherwise gone unreported if the scan is not configured to “Scan Network Printers”. As plugin ID 83349 generates no plugin output, only an “operating-system” tag will be added to the scan result (and stored in an exported .nessus file). This information will be visible only the in “Host/Asset Details” section of the Tenable product UI, i.e: Tenable Nessus: Scans -> [Folder] -> [Individual Scan Result] - > Host Details -> OS (sidebar) Tenable Vulnerability Management: Explore -> Assets -> [Asset] -> Details -> Operating System Scans -> Vulnerability Management Scans -> [Individual Scan Result] -> Scan Details -> Asset Details -> Operating System Tenable Security Center: Analysis -> IP Summary -> [IP address] -> System Information -> OS Scans -> Scan Results -> [Individual Scan Result] -> IP Summary -> [IP address] -> System Information -> OS Note, we expect this information to surface mainly in individual scan results. It would only be present in cumulative asset details if a licensed asset already exists for the target in question. This update will not cause additional assets to be created or consume any additional licenses. Affected Plugins 83349 - os_fingerprint2.nasl 11933 - dont_scan_printers.nasl 22481 - dont_scan_settings.nasl Targeted Release Date Wednesday, March 4, 2026
AuditLang VSCode Extension Summary Tenable has created a...
AuditLang VSCode Extension Summary Tenable has created a Visual Studio Code extension to assist with custom audit writing and validation. Features include: Syntax highlighting Check snippets Command shortcuts for Compliance Checks reference documentation, download links, etc. Parse/Syntax checking For up-to-date features and installation information you can search for 'Tenable AuditLang' in VS Code -> Extensions: Marketplace, or visit https://marketplace.visualstudio.com/items?itemName=Tenable.vscode-auditlang If you have any use cases you’d like to see added to the extension, please either contact your CSM or add a suggestion through the Tenable Products Suggestion Portal. Please use your Community credentials to access the suggestions portal and choose the product “Plugins, Audits, and Compliance” on submittal. Target Release Date ImmediateImprovement: Handling Component Installs for Vulnerability Assessment
Background On Friday, February 6, 2026, Tenable Research published a plugin update that changed the way component installs are assessed for vulnerabilities. Those changes are outlined in a previous release highlight: Component Installs Require Paranoid Checks, This update essentially reverts this change, while adding new functionality to allow users to choose whether or not they want component installs assessed for vulnerabilities. Component installs are no longer influenced by scan paranoia settings. What are “Component Installs”? Software components, such as applications or language modules/libraries, are installed and managed by a primary "parent" package or application. The crucial point is that these components often cannot be updated individually. Instead, their vulnerability assessment and upgrade are entirely dependent on an update of the parent package. For instance, the SQLite database component is installed as part of the Trend Micro Deep Security Agent and is updated only when the Agent itself is updated. Nessus uses several factors to determine if a detected product is a component, or a standalone installation, including: Was the product installed by a package manager? These products are not considered components, as they are managed by the package manager and not a “parent” application Is the component a “language library”, i.e. a library or module used by the interpreter of a programming language like Python or Node.js? These enumerated libraries are marked as components by default. Does the product reside in a directory that is recognized for installations that are not component-based? Changes By default, component installs are once again assessed for vulnerabilities, as was the case prior to the release of the aforementioned update. If users wish to turn this setting off, so that component installs will not be assessed by generic vulnerability detection plugins, they can do so via the newly created scan preference. The end result of this change should be that fewer “false positives”, i.e. reported vulnerabilities for components that are “owned” by another application, are shown in scan results. Components with vulnerabilities that cannot be addressed independently of the “parent” application will not show in scan results. However, some customers have expressed a desire to see these vulnerabilities in their scan results anyway, to ensure full awareness of the risk profile of every application in their environment. This is still possible through the updated scan configuration settings. To modify this setting in your scan policy, go to Settings > Assessment > Accuracy > Override Normal Accuracy > Assess component installs for potential vulnerabilities. This setting is ON (checkbox is ticked) by default, so users must enable the Override Normal Accuracy checkbox (which is OFF / unchecked by default) if they wish to disable the setting and ensure that component installs are not assessed by generic vulnerability detection plugins in this scan. Please note that this update makes no other changes to the existing paranoia logic, outside of what is described above. For now, “Managed”, “Managed by OS” and “Backported” installs are still controlled by the Show/Avoid potential false alarms radio button. How can I tell if the detected install is a component or not? In addition to the above, we have also updated the relevant detection plugins so they will show if the component flag is set or not. At present, this includes detection plugins for OpenSSL, Curl, LibCurl, Apache HTTPD, Apache Tomcat, SQLite, Python Packages, Node.js modules and, soon to follow, Ruby and Nuget libraries. Using plugin ID 174788, SQLite Detection (Windows), here is a before and after example of the expected plugin output. Before: After: Expected Impact With the new default setting in place, users should anticipate an increase in vulnerability findings for the products in scope, returning to a level similar to what was observed before the first update. If users do not wish to surface these additional potential vulnerabilities, they should disable the "Assess component installs for potential vulnerabilities” setting. If the new scan preference is disabled, the volume of findings will remain consistent with current levels, when scanning with normal accuracy (paranoia) settings. Affected Plugins 12288, global_settings.nasl (updated to support the new scan policy preference) Any plugin that operates downstream of those in the list below: SQLite: 174788 - sqlite_nix_installed.nasl 171077 - sqlite_win_installed.nasl OpenSSL: 168007 - openssl_nix_installed.nasl 168149 - openssl_win_installed.nasl Curl: 182774 - curl_nix_installed.nasl 171860 - curl_win_installed.nasl LibCurl: 182848 - libcurl_nix_installed.nasl Apache HTTPD: 141394 - apache_http_server_nix_installed.nasl 141262 - apache_httpd_win_installed.nasl Apache Tomcat: 130175 - apache_tomcat_nix_installed.nasl 130590 - tomcat_win_installed.nasl Python Packages: 164122 - python_packages_installed_nix.nasl 139241 - python_win_installed.nasl Node.js Modules: 178772 - nodejs_modules_linux_installed.nasl 179440 - nodejs_modules_mac_installed.nasl 200172 - nodejs_modules_win_installed.nasl Targeted Release Date Tenable Nessus and Vulnerability Management: Monday, March 9, 2026 (ETA 22:30 Eastern Standard Time) Tenable Security Center: Monday, March 16, 2026March 2026 Tenable Product Newsletter
Check out our March newsletter to learn about the latest product and research updates, upcoming and on-demand webinars, and educational content — all to help you get more value from your Tenable solutions. EXPOSURE 2026 Save 50% on the security conference of the year Don’t miss EXPOSURE 2026, the first-ever conference dedicated exclusively to proactive, unified exposure management. Join us in Boston, Mass., from May 19-21, 2026, to get: Hands-on instruction with Exposure Management Strategy or Tenable One Technical Training Practical resources and real-world insights from Tenable leaders and industry experts Register before March 31 to save 50% off admission and training with early-bird pricing. Tenable customer update webinar 11 a.m. EST/3 p.m. BST, April 9, 2026 Join our upcoming webinar for an informative, fast-paced overview of recent product updates and best practices. Hosted by a team of Tenable product experts, this session will explore how to better secure your expanding attack surface and consolidate critical security data. Register now. Tenable One Coming soon: Data portability for Tenable Attack Path Analysis (APA) We’re introducing Full Export for Tenable APA, allowing you to move beyond single-page views and transform high-level visualizations into actionable offline intelligence. Key capabilities: Comprehensive data: Export full datasets for Top Attack Paths and Top Attack Techniques into CSV or JSON formats. Risk context: Exports include critical metrics like Source NES (Node Exposure Score) and Target ACR (Asset Criticality Rating). High capacity: Easily trigger exports for up to 100K+ results via a new global UI button. API parity: Programmatically pull path data into your SIEM, SOAR, or custom tools using the Tenable Public API. Tenable Cloud Security This month’s updates focus on operational scale, synchronizing security standards, and automating remediation across complex multi-cloud environments. Highlight: Synchronized policy management With linked queries, you can now connect saved explorer searches directly to custom policies and reports. Eliminate manual version control: When you update a source query, every linked policy and report automatically syncs, so your security standards are identical across your entire organization. Operational control: Pause automated workflows for maintenance without losing your configurations using the new enable/disable toggle for automation rules. High-impact capabilities Actionable CI/CD pipelines: Maintain developer velocity by excluding unresolvable vulnerabilities from container image scans. This prevents noise from breaking builds when no patch is currently available. Confirmed reachability: Bridge the gap between theoretical risk and actual exposure with Network Endpoints now displayed in your Inventory to surface the actual, validated entry points for your resources. Dynamic IaC protection: Tenable now scans Terraform dynamic configurations to give you visibility into scaled infrastructure and complex definitions before deployment. Expanded compliance: Immediate support for CIS AWS 6.0.0 and the NIS2 Directive keeps your cloud accounts aligned with the latest global regulatory benchmarks. Strategic update: Domain transition Note: Critical for continued service. The Console URL has officially transitioned to app.tenable.com. Please update your bookmarks and firewall allow lists to include *.app.tenable.com immediately to prevent service interruption. View Full March Release Notes Tenable Vulnerability Management Introducing VM-Native OT Discovery Safely identify and profile connected PLCs, HMIs, and IoT devices using the vulnerability management toolset you already own. No specialized hardware or complex deployments required. Turn your existing IT security tools into a safe OT discovery engine today and get visibility into your IT/OT security gap. Watch the guided demo to see this new capability in action. For more information, explore the user guide documentation for Scan Templates and Discovery Settings. Clean up your scan data: New OS and app inventory dashboard Our new Operating System and Application Inventory with Data Troubleshooting dashboard gives you an instant, high-level view of your asset counts across every OS and application. By using built-in troubleshooting queries, you can identify and fix scan fidelity issues and prioritize risk based on the most accurate data possible. View the dashboard details. Nessus Maximize your vulnerability assessment strategy with our recently introduced interactive Tenable Nessus demos. Skip the manuals and get immediate, hands-on experience securing your attack surface. Explore the Nessus Professional Onboarding demo to launch your first comprehensive scans in minutes. Dive into the Nessus Expert Onboarding demo to master advanced assessment features and eliminate security blind spots, whether on-prem or in the cloud. Tenable Security Center Uncover the OT blind spots across your network If you’re not already a Tenable OT Security user, your IT environment is likely full of shadow OT, like HVAC controllers and IoT devices, that standard scans can’t see. We recently added native OT discovery capabilities directly inside Tenable Security Center, so you can safely map these assets using the tools you already own. Get deep identity data for PLCs and HMIs without risking a disruption or deploying new network sensors. See it in action in this guided demo, and find out how to configure your first scan here. Reminder: Upgrade to Tenable Security Center 6.8 Focus on the vulnerabilities that truly matter with AI-powered VPR insights and clear mitigation guidance. This release streamlines your operations with unified asset repositories for IPv4, IPv6, and Agents, and improves efficiency with new background query processing and scan optimization tools. Explore the release notes for more information before you upgrade. Tenable Patch Management Improved patching precision and reliability Update (v10.0.971.26) includes critical fixes around strategy corruption and inaccurate compliance reporting. By upgrading, you keep your workflows intact, your data precise, and your environment benefits from the modernized performance and security of Java 25. View the release notes or access TPM documentation. Tenable OT Security Update required: Tenable OT Security 4.5 Service Pack (version 4.5.61) We advise all customers currently running version 4.5 apply this upgrade immediately to ensure optimal system stability and performance when processing high volumes of network conversations. This update also addresses specific communication gaps with Rockwell Stratix devices and Nessus scans. Review the release notes for the full list of fixes and improvements. Introducing Tenable OT Security 4.6 (Early Access) Our upcoming release introduces a variety of new features, performance enhancements, and streamlined workflows for large-scale industrial environments. Massive subnet scaling: Now supports up to 5,000 subnets per ICP, significantly increasing visibility for massive enterprise deployments. Centralized network management: A new Monitored Networks page includes bulk-add capabilities and the ability to stage inactive networks before monitoring. Precision scanning: New Nessus workflows let you define specific credential usage per scan for safe discovery of sensitive assets. Streamlined platform navigation: Updated workflow for SSO/SAML users helps you pivot back to the Tenable One platform instantly with the return button. Remote agent updates and query restrictions: Update OT agents directly from the ICP. and remove local site visits or manual CLI intervention. New infrastructure for OT agents also enables you to restrict specific protocol queries. Enhanced diagnostics: Exported asset logs now include deeper metadata to speed up Support and Engineering troubleshooting. IoT connector overhaul: Major stability and performance fixes for Milestone, AvigilonES, and Exacq Edge integrations for IoT asset discovery. This update focuses heavily on large-scale infrastructure, refined scan controls, and better integration with the Tenable One ecosystem. Check out the release notes and user guide for details. Tenable Web App Scanning Stop chasing dead keys: New secrets validation for WAS Don’t waste time manually verifying every leaked credential. Our new Secrets Validation automatically tests detected tokens, like GitHub or AI service API keys, to see if they are live and exploitable. By distinguishing between a harmless string and a critical vulnerability, you can prioritize your remediation efforts based on real-world risk, rather than noise. View the documentation or read the full breakdown on Tenable Connect. Tenable Training and Product Education Evolve from reactive patching to proactive risk oversight The Exposure Management Business Theory course, now available at no cost in Tenable University, guides you in self-paced modules toward building a sustainable exposure management program through the five pillars of the exposure lifecycle: scoping, discovery, prioritization, validation, and mobilization. Get strategic insight to align Tenable’s capabilities with your business goals, drive meaningful change, and make informed decisions. Get hands-on expertise with current industrial security capabilities The newly-updated Tenable OT Security Specialist instructor-led training course, now aligned with Tenable OT Security version 4.4, ensures you can effectively protect your critical infrastructure using the latest product features and workflows. You will learn to: Maximize visibility: Learn to leverage these enhancements to see and secure every asset in your OT environment. Reduce risk: Practice real-world scenarios to identify vulnerabilities and threats faster. Get expert guidance: Interact directly with instructors to master complex configurations and best practices. Visit tenable.com/education to learn more about our Tenable University education offerings, see global instructor-led training (ILT) schedules, and buy virtual ILT or on-demand courses. Tenable webinars Tune in for product updates, demos, how-to advice, and Q&A. See all upcoming live and on-demand webinars at https://www.tenable.com/webinars. Customer office hours These are recurring ask-me-anything sessions for Tenable Security Center, Tenable Vulnerability Management, Tenable Cloud Security, Tenable Identity Exposure and Tenable OT Security. Time-zone-appropriate sessions are available for the Americas, Europe (including the Middle East and Africa and Asia Pacific (APJ). Learn more and register here. Tenable Research Research Security Operations blog posts Subscribe to the Research team blog posts here. The cloud and AI velocity trap: Why governance is falling behind innovation Dynamic objects in Active Directory: The stealthy threat New malicious npm package "ambar-src" targets developers with open-source malware Research release highlights Improvement: Handling component installs for vulnerability assessment: Adds the ability to remove findings for component-based vulnerabilities from scan results New Dell OS10 compliance plugin and audit files: Customers can now measure compliance against Dell OS10 devices with new plugin ID Dell OS10 Compliance Checks (275781) on Tenable Vulnerability Management and Nessus. Content coverage highlights More than 2,700 new published vulnerability plugins. Nearly 50 new audits delivered to customers. Read Tenable documentation.Component Installs Require Paranoid Checks (DEPRECATED)
Update - March 4, 2026 After considering customer feedback, we. have decided to re-evaluate these changes and come up with a better way of handling Component installs. For the latest information, please refer to the new release highlight: Improvement: Handling Component Installs for Vulnerability Assessment Summary With this update, products that are deemed to be components of another application, will now require the scan to be run in paranoid mode to trigger generic vulnerability detection plugins. In this context, “generic vulnerability detection plugins” refers to plugins that cover advisories published by the component vendor (e.g., plugin ID 242325, SQLite < 3.50.2 Memory Corruption) rather than the operating system or “parent” application that distributes the component, either as a part of the operating system or a dependent tool of the parent application. Overview Tenable covers software that can be either installed as base level software, or be included as component software of a larger product installation. Base level software can be updated without any impact to the base product functionality. Component software is typically updated as part of the vendor update for the larger packaged product, and the individual components are not updatable. Non-paranoid scans will report base software vulnerabilities that are actionable. Paranoid scans will report on base software vulnerabilities as well component software vulnerabilities that are not actionable, but still package a potentially vulnerable version of the component. To enhance the accuracy of our vulnerability detection and provide users with greater control over scan results, we are implementing an update affecting how we flag vulnerabilities in software components. Our detection plugins for OpenSSL, Curl, LibCurl, Apache HTTPD, Apache Tomcat, SQLite, PHP, Python packages and Node.js modules can now identify when these packages are installed as components of another parent application (e.g., SQLite bundled with Trend Micro’s Deep Security Agent), rather than as standalone installs. Key Changes: Non-Paranoid Scans: Scans running in the default mode will no longer flag generic vulnerability detection plugins for these component installs. This is because vulnerabilities in components generally cannot be patched directly; users must wait for the parent application's vendor to issue an update. OS Vendor Advisories Unaffected: This change does not affect plugins for OS vendor security advisories that cover the same vulnerabilities (e.g., plugin ID 243452, RHEL 9 : sqlite (RHSA-2025:12522)). Paranoid Scans: For scans running in paranoid mode, generic vulnerability detection plugins will still trigger for component installs if the detected version is lower than the expected fixed version. Expected Impact: Customers running non-paranoid scans should anticipate seeing a reduction in potential vulnerability findings for OpenSSL, Curl, LibCurl, Apache HTTPD, Apache Tomcat, SQLite, PHP, Python packages and Node.js modules that are installed as components. Technical Details: The changes are entirely contained within two shared libraries, vcf.inc and vdf.inc, utilized by the affected plugins. This update impacts approximately 750 plugins specific to OpenSSL, Curl, LibCurl, Apache HTTPD, Apache Tomcat, and SQLite. Targeted Release Date: Friday, February 6, 2026
New Dell OS10 Compliance Plugin and Audit files
Summary Customers can now measure compliance against Dell OS10 devices with new plugin ID Dell OS10 Compliance Checks (275781) on Tenable Vulnerability Management and Nessus. This plugin is published as a part of the Policy Compliance template and will use the existing SSH credential type. The plugin will retrieve all target data using "show" commands and will evaluate actual values against a given audit policy. Three audits implementing the DISA STIG will be released along with the plugin: DISA Dell OS10 Switch Layer 2 Switch STIG v1r1 20 checks DISA Dell OS10 Switch NDM STIG v1r1 39 checks DISA Dell OS10 Switch Router STIG v1r1 42 checks These audits contain a total of 101 checks. Some examples include: OS10-NDM-000010 The Dell OS10 Switch must limit the number of concurrent sessions to an organization-defined number for each administrator account and/or administrator account type. OS10-NDM-000410 The Dell OS10 Switch must enforce password complexity by requiring that at least one uppercase character be used. OS10-L2S-000240 The Dell OS10 Switch must not use the default VLAN for management traffic. OS10-RTR-001040 The Dell OS10 Router must be configured to suppress Router Advertisements on all external IPv6-enabled interfaces. Additional Notes For those that are interested in creating custom audit content for their environment, please see the plugin documentation for all supported keywords and uses at https://docs.tenable.com/nessus/compliance-checks-reference/Content/dell-os10.htm. Target Release Date Nessus/Tenable.VM - Immediate Tenable.sc - To be determined[GA] Tenable Patch Management v10.0.971.26 is officially LIVE!
We are pleased to announce the General Availability of Tenable Patch Management (TPM) v10.0.971.26! This quality-focused update delivers critical stability and performance fixes for both On-Premise and SaaS environments. Enhanced Reliability & Precision Reporting This release addresses high-priority issues including strategy corruption, database scaling, and compliance reporting accuracy. Top Fixes to Pitch: Strategy Integrity: Fixes a critical defect where simplified patching strategies could become corrupted or fail to load "How to Patch" configurations. Precision Reporting: Corrects compliance percentage variables to eliminate "over 100%" reporting errors. Improved SaaS Reliability: Resolves "502 Bad Gateway" errors and database deadlocks by optimizing connection pooling and PostgreSQL-specific ports. Patch Filter Conditions: Corrects errors in Patch Filter UI and Tenable.Vpr filter handling. Added a dropdown for true/false boolean fields and updated VPR filters to require the Tenable.VprInteger format. Cloud Compatibility: Fixed the cloud install script (.sh) for successful execution when used in JAMF script payloads. Platform Modernization: Full integration of Java 25 and log4j 2.25.3 for peak security and performance. WSUS Intelligence: Improved WSUS scanning logic to mark patches as "Not Applicable" if a superseding patch is already present. P2P Configuration: New brp2p.minimum_viable_volunteer_count setting to better manage peer-to-peer download sources. Customer-Facing Resources: Release Date: March 5, 2026 Hotfix Version: 10.0.971.26 Changelog: View Release Notes Docs: TPM Complete Documentation Upgrade Path: SaaS/Cloud: Your SaaS Tenants are upgraded to v10.0.971.26 automatically. Please upgrade your clients accordingly. On-Premise: Customers can download the latest version of server and clients from the TPM Downloads portal immediately. Questions? We’re a ping away! Reach us at connect.tenable.com. Happy Upgrading! - Ahmad Maruf Tenable Patch Product Management
