The SVM October 2026 update is now live.

Following improvements are now available in SVM.

Flexera Severity for WSUS-Published Software Updates

The Patch Publisher now includes severity information with software updates published to Windows Server Update Services (WSUS). After WSUS updates are synchronized through the Configuration Manager Software Update Point (SUP), administrators can view and filter updates by Severity in the Configuration Manager console itself. The severity is determined by the Criticality of the patch. This enhancement supports SPS and VPM packages published through the Patch Publisher wizard.

This enables patch admins to prioritize patches based on Flexera's risk assessment right from the tools they are using, in this case WSUS and Config Manager.

For release notes, refer here.

IMPORTANT ANNOUNCEMENT:

As part of our proactive security posture, SVM Cloud has been upgraded to latest vendor patch version to address recently disclosed PHP vulnerabilities. While the reported vulnerabilities primarily affect functionality that is not utilized by SVM, we have completed the upgrade to the vendor-patched version to ensure continued platform security and compliance with security best practices.

Impact Assessment

SVM Cloud: No known impact. Already upgraded to vendor patched version

SVM On-Prem Customers: Customers should upgrade PHP on their deployed hosts to the appropriate PHP secure version to mitigate potential exposure. The details are in the attached advisory.

For additional technical details, refer to Secunia Advisory SA182569 – PHP Multiple Arbitrary Code Execution Vulnerabilities.

The SVM August 2026 update is now live.

Following improvements are now available in SVM Cloud.

Duplicate Subscription Warning for SPS and VPM Patches

This feature is available for both SVM UI and Patch Publisher.

Continuing with the previous release which shows visibility on duplicate subscription, now when users subscribe to a patch that has already been subscribed to, SVM/Patch Publisher displays a Duplicate Subscription warning identifying the existing subscriber, and prompts users to continue or cancel the subscription.

• If the new subscription request exactly matches an existing subscription, the duplicate subscription is prevented.
• If the package has assigned groups that partially overlap with an existing subscription, the conflicting groups are automatically removed from the new subscription, and the subscription proceeds for the remaining non-conflicting groups.

This enhancement improves subscription management by reducing duplicate subscriptions while allowing valid group-based subscriptions to continue.

Updated Administrator-Initiated Password Reset Workflow

Password reset email notifications will guide users to complete the password reset process through the Set Your Password page, providing a more streamlined and secure password resetting experience.

New Database View for Device Application State Reporting

A new database view,

vw_csi_device_application_state

, has been added to the Database Console to simplify application state reporting across managed devices. The view consolidates application inventory, version, security status, criticality, and installation path information into a single queryable source, enabling easier reporting and integration with external business intelligence and compliance processes.

User Interface Improvements

Software Vulnerability Manager (SVM) includes minor user interface styling updates to improve visual consistency across the application. The overall layout, menu options, and their placement in the user interface remain the same.

For release notes, refer here.

The SVR August update is now live.

The update includes addition of CISA KEV and EPSS scores in UI and API.

The vulnerability database page feature a CISA KEV filter to quickly identify which CVEs are present in the CISA catalog. CVE details page include CISA KEV (Yes/No), EPSS score and EPSS percentile. All the three attributes are available in the API as well.

For details, click here.

The SVR July 2026 update v 260701 is now live.

The update includes important feature enhancements as mentioned below –

New API Usage Dashboard

Software Vulnerability Research (SVR) now includes a new API Usage option under Settings > API that provides administrators with visibility into API consumption metrics across the organization such as volume stats, throttle rates, usage data, etc. with flexible filtering options for administrators to slice and dice the data in varied ways.

In addition, API rate limiting has been enhanced to return consistent HTTP 429 responses with a Retry-After header when configured thresholds are exceeded. Throttle events are logged with account and stored information is available through account log exports for auditing and troubleshooting purposes.

Enhanced API Token Management, Lifecycle Auditing, and Anomaly Detection

A new Expiration option has been added when creating or editing API tokens. It allows administrators to specify or modify expiration date of the token, providing greater control of API access and improved enforcement of token lifecycle policies.

In addition, an API Token option has been added in the Settings > logs. This page contains two audit views:

Lifecycle Events - Tracks token management activities such as expiration date changes and other token lifecycle updates.

Anomalies - Records suspicious or unusual token activity, including token usage from previously unseen source IP addresses.

 Enhanced Two-Factor Authentication Security Notifications

With this enhancement, standard users must enter their login password before disabling either SMS-based or token-based two-factor authentication (2FA). This additional verification step helps prevent unauthorized changes to account security settings. Whenever a two-factor authentication method is disabled, SVR automatically sends a security notification email to both the affected user and the root account user associated with the account.

 Improved messaging during login

 When an invalid authentication token is entered, the login page displays the number of remaining attempts before account lockout. Users are allowed a maximum of five unsuccessful 2FA attempts. After the fifth failed attempt, the account is locked to help protect against unauthorized access and brute-force attacks.

For release notes, click here.

The SVM July 2026 update is live now.

 SVM cloud version 260701 is live now. This new version of the cloud edition is compatible with the latest version of the Patch Publisher v 7.34.2271

Improved Zombie File Reporting

Exclude Windows System Files from Zombie File Detection

You can now choose to exclude files located in the Windows System32 and SysWOW64 folders from zombie file detection. This helps reduce unnecessary results and ensures reports focus on files that are more likely to require attention, making zombie file insights more accurate and actionable.

Management of Intune Scope Tags

Assign Intune Scope Tags During Package Publishing

You can now assign one or more Intune Scope Tags directly from the Manage Assignments / Scope Tags screen when publishing a package. Scope Tags help organizations delegate administration, control visibility, and ensure that IT teams only manage the resources relevant to their responsibilities.

By making Scope Tag assignment available within the publishing workflow, it is easier to apply the right administrative controls from the start, helping support more organized, secure, and scalable Intune environments.

 For release notes, refer here.

The SVM March 2026 update is live now.

 SVM cloud version 260301 is live now. This new version of the cloud edition is compatible with the latest version of the Patch Publisher v 7.31.2212

The update includes important feature enhancements as mentioned below –

Software Vulnerability Manager User Interface Enhancements

The following enhancements have been added to the Software Vulnerability Manager user interface to expand platform support and improve endpoint deployment flexibility.

Support for Jamf Pro Unified Endpoint Management System

A new Jamf Pro platform has been introduced, enabling seamless configuration and management of Jamf Pro within Software Vulnerability Manager.

With this enhancement:

• macOS packages, such as .dmg and .pkg, can now be published successfully to Jamf Pro
• Packages can be deployed to endpoint systems using SVM
• This provides greater flexibility and improved support for macOS deployments

Patch Publisher Enhancements

The following improvements have been added to the Software Vulnerability Manager (SVM) Patch Publisher to enhance patch security and signing flexibility.

Digital Signing Support for SPS and VPM Patches

A new Digital Signing option is now available in the Settings menu, enabling secure digital signing of SPS and VPM patches, with added flexibility to support different signing requirements.

You can choose from the following signing options:

Standard Signing

• Uses a pre‑configured certificate to digitally sign patches. This option is suitable for most common patch‑signing scenarios and requires minimal configuration.

Custom Signing

• Allows you to configure and use a custom signing solution, including HSM‑based custom signing, for digitally signing SPS and VPM packages. This option is ideal for advanced or automated environments where standard signing does not meet specific security or compliance requirements.

For the release notes, please click here.

The SVM January 2026 update is live now.

SVM cloud version 260101 is live now. This new version of the cloud edition is compatible with the latest version of the Patch Publisher v 7.30.2191.

 The update includes important feature enhancements as mentioned below –

Patch Publisher Enhancements -

Streamlined Patch Publisher & AdminStudio Integration

This release enables tighter automation between Patch Publisher and AdminStudio. Patches published through Patch Publisher can now be auto‑assigned to a default AdminStudio workflow (Import + Customization) and automatically marked as Subscribed. Additionally, custom packages placed in a designated shared directory can be imported on a schedule. With AdminStudio REST API access configured, Patch Publisher—through automation or the publishing wizard—can seamlessly push custom packages into AdminStudio for repackaging and distribution with minimal manual effort.

Software Vulnerability Manager Enhancements

Expanded Intune Deployment Support for SVM Cloud

SVM Cloud now supports Intune publishing/deployments for both MSI and EXE-based Vendor Patch Module (VPM) packages. Previously restricted to MSI patches, this enhancement significantly broadens application coverage and offers greater flexibility in modern endpoint patch management.

Network Appliance Groups Now Available in the New SVM UI

Feature parity with the legacy UI is improved as the new SVM UI now supports the creation of Target Groups within Network Appliance Groups. These groups can be scanned directly using a Network Appliance Agent, simplifying asset segmentation and scanning workflows within the updated interface.

New IP-Based User Access Restrictions

Under User Management > Create New User, two new options—Restrict On IP Range and Restrict On IP Network—allow administrators to define the specific IP ranges or networks a user can access. These controls ensure users can only view or manage assets within authorized network boundaries, enhancing overall security and compliance.

Enhanced Visibility & Warnings for Digitally Signed Packages

Improvements across both Patch Publisher and the SVM User Interface now offer clearer identification and security guidance regarding digitally signed Vendor Patch Module (VPM) packages. In Patch Publisher, you can filter items using a new Digitally Signed option in Configure View, see a dedicated Digitally Signed property in the Patch Information dialog, and receive a security warning when subscribing to unsigned packages. Similarly, in the SVM UI, a new warning popup appears during the Create Update Package workflow if the selected package is not digitally signed, alerting administrators to potential security risks before they proceed.

For the release notes, please click here.