• Bug fix
• Enhancements
  • Add Log Manager module
    • Unified Management - Centralized control of log upload frequency.
    • Enhanced Reliability - Supports offline storage and transmits logs when network connectivity is restored.

• Bug fix

• Bug fix

• Support unified policy
• Support Agent Console unload
• Bugfix

• Bug fix

• Bug fix

• Bug fix

• Support offline package
• Bug fix

• Bug fix

• Agent Console
• WSC (web service communicatior)
• CETA (telemetry process)
  • Fix Trend Micro Cloud Endpoint Telemetry Service can't be removed
• Fix MQTT huge log size issue

• Support Agent Console
• Support WSC merge into VOM

• Bug fix

• Fix VDI idle mode can't detect system proxy change
• Fix VDI refresh device ID didn't reload VOM
• Support SPC

• Security enhancement

• Bug fix

• Bug fix

• Policy Management

• Support version control policies

• Remove the telemetry process and integrate the function into XBC
• Support version control policies

• Bug fix
• Support version control policies

• Enhance data collection

• Enhance Service Gateway
• Enhance Trend Vision One Endpoint Security communication module

• Agent monitoring enhancement
• Monitor tm_netserv and tm_netagent

• Support deployment script for SWP package
• Enhance Trend Vision One Endpoint Security communication module

• Enhance service gateway/proxy management

• VDI detect enhancement

• Enhance site migration

• Enhance data collection

• Support IoT Trend domain

• Enhance GUID de-duplication mechanism
• Enhance proxy handling

• Enhance download mechanism

• Enhance data collection

• Support Trend Vision One Endpoint Security

• Install Amazon Root CA

• Enhance debug log

• Security enhancement

• Security enhancement

• Enhance proxy handling

• Collect more sensor status

• Security enhancement

• Enhance binary issuer check

• Adjust agent behavior

• Security enhancement

• Service Gateway support FQDN

• Enhance user experience

• Collect process product name
• Collect sensor performance counter

• Enhance Service Gateway server selection
• Support bandwidth control at the end of June

• Enhance proxy handling

• Support Service Gateway at the beginning of May

• Support Service Gateway at the beginning of May

• Support Service Gateway at the beginning of May

• Support VDI environment at the beginning of April

• Support VDI environment at the beginning of April

• Support VDI environment at the beginning of April

• Enhance the proxy handling for Windows 11

• Enhance the stability

• Collect Endpoint Basecamp Status

• Enhance error handling when network unstable
• Bug fixed
  • Possible files remaining after uninstallation

• Collect provision type telemetry
• Bug fixed
  • Correct process name detection

• Remove unused sites
• Security enhancement
• Enhance register device flow (reduce request api count)
• Enhance error handling for unzip and checking WSC service

• Resolve crash issue
• Enhance polling mode flow
• Persistent connection bypass proxy

• Collect service disable telemetry

• Command throttling
• Retry enhancement

• Collect Telemetry plug-in crash events
• Security enhancement

• Support agent self-protection

• Bug fixed

  • New proxy bypass resolving mechanism
  • Invalid proxy format handling

• Bug fixed

  • Enhance server/agent communication by correct trace id format

• Enhance agent logging mechanism by applying log level

• Added error handling on network unstable scenario
• Security enhancement

• Made communication between agent and server more efficient

• Fixed the crash issue when collecting performance data
• Collect Apex One agent GUID and server GUID

• Collect Vulnerability Assessment scanning status

• Fixed issue of service shutdown event handling flow

• Made the agent identifier consistent

• Always use the latest version to run the default script

• Upgraded XBC agent itself once triggered

• Introduced XDR device ID

• Support for new data center in Japan
• Fixed encoding error when hostname is non-EN
• Limit times of rerun action when the action encounters an issue

• Fixed crash issue if the endpoint connects to the Internet through VPN

• Added a new data center in Asia. The Agent will be moved to the Asia data center if the region of AC key is AMEA.

• Provided more visibility for certificate error on agent console, and refined wording

• Added new data center in Europe. The Agent will be moved to EU data center if the region of AC key is EU

• Support for deployment of Freemium Trend Vision One Endpoint Sensor
• Collection of the number of Apex One detection log and endpoint risk indicator for the recommended list in Trend Vision One inventory app
• Enhanced agent authentication

• Enhanced communication method between Endpoint Basecamp agent and tools

• Fixed issues from static code scan

• Enhanced retry mechanism
• Added progress bar on the agent console
• Reports exception to the backend when the agent is abnormally terminated
• Enhanced script for integrated products

• Initial release

October 1, 2025

• Support Quarantine Actions
• Support macOS26 Tahoe
• bug fixed

13.7 MB

• Trend Vision One 3rd part libraries update to latest version
• Bug fixed

• Support enable DDR without enabling EDR
• ASD Collect additional hardware information
• Bug fixed

• Support Unify agent console
• Support unified policy
• Support Monitoring level
• Bug fixed

• Support DVAS
• Support Incident Response
• Bug fixed

• Update DDR status
• Copyright update to 2025
• Bug fixed

• Support Pattern version control policies
• Bug fixed

• Support version control policies
• Bug fixed

• Support Generic Caching Service
• Enhance download mechanism
• Bug fixed

• Support XBC-based inventory
• Bug fixed

• Support endpoint group for service gateway/proxy management

• Support pre-signed URL
• Integrate with new iCore 3.3.1005
• Bug fixed

• Support MEA site
• Support IoT Trend domain
• Bug fixed

• Update OpenSSL and Curl lib
• Introduce GUID de-duplication mechanism
• Pre-check control by PingMS
• Support UDSO domain/URL
• Support Trend Vision One Endpoint Security "Scan Now" feature
• Record the timestamp of successful heartbeat
• Bug fixed

• Drop support for MacOS 10.14
• Support Worry-Free Business Security Service
• Bug fixed

• Support MacOS 14
• Bug fixed

• Support UDSO-IP
• Support Network Isolation Allow List
• Bug fixed

• Bug fixed

• Bug fixed

• Support custom proxy
• Bug fixed

• New API to update offline/online status timely
• Bug fixed

• Notification for Network Isolation
• Bug fixed

• Service Gateway support for ADDA
• GUID alignment with Cloud One
• Bug fixed

• Service Gateway support FQDN
• End of support macOS 10.13
• Support macOS Ventura
• Bug fixed

• Implement Self Protection
• Bug fixed

• Report the status of network isolation
• Separate upgrade check from status update API
• Third party libraries updated
• Bug fixed

• Support PAC proxy
• Bug fixed

• Collect endpoint information for Apps under Risk Insights
• Bug fixed

• Support bandwidth control
• Bug fixed

• Disable iES when XES is enabled
• Bug fixed

• Support Service Gateway at the beginning of May
• Bug fixed

• Enhance networking function
• Bug fixed

• Apply V2 API to notify status

• MacOS 12 support
• Common Agent Gateway integration
• EI V4 API integration
• Policy API integration
• Universal binary for both Apple silicon and Intel-based Mac computers

• Implemented ring deployment

• Optimized push notification

• Integrated with backend API v2

• Changed site support
• Self upgrade check

• Enhanced XPC connection

• Initial release

• Update CACert
• Bug fix
• Security enhancement

• Update CACert
• Support Oracle10 amd64
• Bug fix

• Update CACert
• Shorten the time of update used proxy info.
• Prevent service from modify rpm lock file to tm_xes file group.

• Support RHEL10 amd64
• Support unified policy preview. Support disable self-protection using unified policy access token.
• Collect extra hardware info including cpu, brand manufacturer model, serial number, disk info, network adapter info.

• Update CACert
• Bug fix

• Bug fix

• Bug fix
• Endpoint response support list mounted devices

• Fixed an issue where upgrades from versions older than v1.1.0.6086 failed

• Fixed an issue where upgrades from versions older than v1.1.0.6086 failed

• Update CACert
• Bug fix
• Data collection enhancement of ASRM module
• Security enhancement

• Update CACert
• Bug fix
• Adjust ASRM scan scheduling mechanism
• Enhance ASRM zero-day scan capability
• Update endpoint response FQDN

• Update CACert
• Bug fix
• Security enhancement
• Support version control policies to manage kernel support updates

• Bundled new DVAS module
  • Zero-Day Scan feature support
• New platform support for XES: Ubuntu 24 x64
• Bug fix

• Upgrade API version
• Bug fix
• Enrich log information

• Bug fixed
• Enhance debug log
• New platform support for XES (SUSE 15 ARM V8)

• Support XBC-based inventory
• Support Trend Vision One Endpoint Security deployment script
• Bug fixed

• Fixed an issue found in Endpoint Basecamp v1.1.0.4511 where SWP endpoint fails to download the kernel support plugin.
• Fixed an issue found in Endpoint Basecamp v1.1.0.4511 where, in Red Hat 6 and CentOS 6, group management for service gateway/proxy is not supported
• Bug fixed

• Support endpoint group for service gateway/proxy management
• Support fast track
• Bug fixed

• Allow tmxbc to be installed on DSA-compliant platforms:
  • Debian 12 (x86_64)
• Bug fixed

• Security enhancement
• Bug fixed

• Support IoT Trend domain
• Bug fixed

• Enhance GUID de-duplication mechanism
• Enrich log information
• Upgrade package for vulnerability issue
• Enhance CLI for proxy setting

• Enhance download mechanism
• Enhance pattern deployment mechanism
• Support forensic evidence collection
• Enhance uninstallation flow

• Allow tmxbc to be installed on DSA compliant platforms:
  • Amazon Linux 2 (AArch64)
  • Amazon Linux 2023 (x86_64/AArch64)
  • RHEL 8 (AArch64)
  • Ubuntu 18.04 (AArch64)
  • Ubuntu 20.04 (AArch64)
  • Ubuntu 22.04 (AArch64)
  • AlmaLinux 9 (x86_64)
  • RHEL Workstation 7 (x86_64)
• Bug fixed

• Bug fixed

• Allow tmxbc to be installed on DSA compliant platforms:
  • CloudLinux 7.8
  • Debian 8, 9, 10, 11
  • Oracle Linux 6, 7, 8, 9
  • RHEL 9
  • SuSE 12, 15
  • Ubuntu 22.04
  • AlmaLinux 8
  • Rocky Linux 8, 9
• Support Trend Vision One Endpoint Security
  • Full package installation
  • ASD.DVASS/AASRM integration
  • Support Service Gateway and custom proxy
  • UDSO integration (bridge to XES)
  • Support network isolation command (bridge to XES)
• Adopt new XBC API versions
  • register_company v2
  • get_actions v3
  • get_configs v2
• Bug fixed

• Integrate with XBC init_notify_setting v4

• Bug fixed

• Bug fixed

• Correct sensor status so that EI backend/UI can show error messages correctly.

• EI V4 API integration for sensor
• Collect endpoint information for Apps under Risk Insights
• Bug fixed

• Bug fixed

• Bug fixed

• Upload collected files with hash values (SHA-1 & SHA-256) provided

• Support Custom Script with parameter
• Bug fixed

• Support collect file command via Remote Shell

• Bug fixed

• Bug fixed

• Support log4j scanner in Assessment App

• Collect File and Run Custom Script for Azure site
• Bug fixed

• Bug fixed

• Bug fixed

• Enable Remote Shell to kill process

• Support for users to use remote shell to run custom scripts for Azure site

• Bug fixed

• Uploaded collected files for AWS site
• Remote Shell support for AWS site

• Bug fixed

• Initial Release

• Resolved an upgrade failure (error code: 201) that occurred when a service could not be stopped during the process.
• Fixed an issue where the tm_netsrv service failed to restart properly

• Bug fixed

• Bug fixed

• Support unified policy

• Bug fixed
  • Fixed XES’s NCIE pattern version update when co-exist with SEP
• Enhancement
  • Enable XES’s network visibility with NCIE when co-exist with SEP

• Bug fixed
• Feature:
  • Add browser extension

• Bug fixed
• Feature:
  • Add agent console

• Bug fixed
• Enhancement:
  • Installer package support local upgrade

• Bug fixed

• Bug fixed
• Enhancement:
  • NCIE, LWE support latest pattern version
  • ER handle license expired case

• Adjusted the uninstall action to ensure correct behavior for non-opt-in NCIE.

  Reference: KA-0018244

• Support feature:
  • NCIE: Enhance endpoint sensor detections by enabling deep analysis and inspection of network traffic with the Network Content Inspection Engine.
  • Deepfake: Analyzes ongoing video calls to determine if they contain synthesized images.
• Bug fix:
  • Add random delay to avoid concurrent request/traffic of pattern update.
  • Update 'recoverCEStatus' registry value once XES run properly.

• Bug fixed

• Add deep fake module but not enabled
• Bug fixed

• Before installation, the endpoint environment will be checked to see if it supports Microsoft Azure Code Signing(ACS)
  • Reference: https://success.trendmicro.com/dcx/s/solution/000291904
• Bug fixed

• License expiration
• AMPPL in normal mode control release
  • TBD

• Enhance telemetry efficiency
  • Add Smart Telemetry pattern for optimizing bandwidth usage when sending telemetry
• Endpoint Response modularized
• Bug fixed

• Enhance the request that adjust agent communication interval
• Handle CSV ((cluster shared volume) I/O to prevent hang issue

• MEA site support

• Emergency fixes for version 1.2.0.4592:
  • Remove browser extension

• UDSO for URL/Domain
• Enhance GUID de-duplication mechanism
• Disable aggressive mode for Windows 2012 R2
• Bug fixed

• Platform support Windows 11 (23H2)
• Support Windows Event ID 4769 and 4625
• Bug fixed

• Bug fixed

• Support UDSO-IP
• Support Network Isolation Allow List
• Bug fixed

• Bug fixed

• Bug fixed

• Support UDSO
• Support full package installation
• Support Server Profile (server and co-exist with Trend Cloud One)
• Bug fixed

• Exception for Apex One ScanNow
• Bug fixed

• Bug fixed

• Notification for Network Isolation
• Bug fixed

• Windows 7 End-of-Life
• Bug fixed

• Bug fixed
• Platform support Windows 10 (22H2)
• Turn on PowerShell Script Block Logging 

• Bug fixed

• Bug fixed

• Bug fixed
• Platform support Windows 11 (22H2)

• Bug fixed

• Bug fixed

• Bug fixed

• Bug fixed

• Support Service Gateway at the beginning of May
• Bug fixed

• Support VDI environment at the beginning of April
• ZTSA Integration
• Bug fixed

• Bug fixed

• Bug fixed
• Platform Support (21H2)
• Platform Support (Server 2022)

• Bug fixed

• Bug fixed

• Bug fixed
• Fixed vulnerability
• Performance enhancement
• Platform Support (21H1)

• Bug fixed
• Performance enhancement

• Fixed hostname that has null terminated(\u0000) issue

• 34.2MB(EDRAgent.app)
• 14.2MB(EDRMainUI.app)

• Support Quarantine Actions
• Support macOS26 Tahoe
• bug fixed

• 32.2MB(EDRAgent.app)
• 9.7MB(EDRMainUI.app)

• Trend Vision One 3rd part libraries update to latest version
• Bug fixed

• 22.7 MB (EDRAgent.app)
• 10 MB (EDRMainUI.app)

• Support enable DDR without enabling EDR
• ASD Collect additional hardware information
• Bug fixed

• 22 MB (EDRAgent.app)
• 9.7 MB (EDRMainUI.app)

• Support Unify agent console
• Support unified policy
• Support Monitoring level
• Bug fixed

• 19 MB (EDRAgent.app)
• 10 MB (EDRMainUI.app)

• Support DVAS
• Support Incident Response
• Bug fixed

• 18.8MB (EDRAgent.app)
• 9.6MB (EDRMainUI.app)

• Support List all mounted drives command
• Integrate with iCore 3.3.1022
• Copyright update to 2025
• Bug fixed

• 18.8MB (EDRAgent.app)
• 9.8MB (EDRMainUI.app)

• Bug fixed

• 18.7MB (EDRAgent.app)
• 9.6MB (EDRMainUI.app)

• Bug fixed

• 18.7MB (EDRAgent.app)
• 9.6MB (EDRMainUI.app)

• Bug fixed

• 18.6MB (EDRAgent.app)
• 9.6MB (EDRMainUI.app)

• Support macOS 15
• Drop macOS 10.15
• Bug fixed

• 18.6MB (EDRAgent.app)
• 9.6MB (EDRMainUI.app)

• Bug fixed

• 21.1MB (EDRAgent.app)
• 9.7MB (EDRMainUI.app)

• Support XBC-based inventory
• License expiration
• Bug fixed

• 21 MB (EDRAgent.app)
• 9.5 MB (EDRMainUI.app)

• Support fast track
• Bug fixed

• 21 MB (EDRAgent.app)
• 9.5 MB (EDRMainUI.app)

• Support pre-signed URL
• Integrate with new iCore 3.3.1005
• Bug fixed

• 20.9 MB (EDRAgent.app)
• 9.5 MB (EDRMainUI.app)

• Support MEA site
• Support IoT Trend domain
• Bug fixed

• 20.9 MB (EDRAgent.app)
• 9.5 MB (EDRMainUI.app)

• Update OpenSSL & Curl lib
• Introduce GUID de-duplication mechanism
• Pre-check control by RingMS
• Support UDSO Domain/URL
• Support Trend Vision One Endpoint Security "Scan Now" feature
• Record the timestamp of successful heartbeat
• Bug fixed

• 20.8 MB (EDRAgent.app)
• 9.5 MB (EDRMainUI.app)

• Drop support for MacOS 10.14
• Support Worry-Free Business Security Service
• Bug fixed

• 20.8 MB (EDRAgent.app)
• 9.5 MB (EDRMainUI.app)

• Support MacOS 14
• Bug fixed

• 20.8 MB (EDRAgent.app)
• 9.4 MB (EDRMainUI.app)

• Support UDSO-IP
• Support Network Isolation Allow List
• Bug fixed

• 20.7 MB (EDRAgent.app)
• 9.4 MB (EDRMainUI.app)

• Enhanced data collection
• Bug fixed

• 24.2 MB (EDRAgent.app)
• 9.3 MB (EDRMainUI.app)

• Bug fixed

• 24.2 MB (EDRAgent.app)
• 9.3 MB (EDRMainUI.app)

• Support UDSO
• Support full package installation
• Support custom proxy
• Bug fixed

• 24.0 MB (EDRAgent.app)
• 9.2 MB (EDRMainUI.app)

• New API to update offline/online status timely
• Bug fixed

• 24.0 MB (EDRAgent.app)
• 9.2 MB (EDRMainUI.app)

• Notification for Network Isolation
• Bug fixed

• 27.9 MB (EDRAgent.app)
• 8.4 MB (EDRMainUI.app)

• Service Gateway support for ADDA
• GUID alignment with Cloud One
• Bug fixed

• 23.9 MB (EDRAgent.app)
• 8.6 MB (EDRMainUI.app)

• Service Gateway support FQDN
• End of support macOS 10.13
• Support macOS 13 Ventura
• Bug fixed

• 23.9 MB (EDRAgent.app)
• 8.6 MB (EDRMainUI.app)

• Implement Self Protection
• Bug fixed

• 22.9 MB (EDRAgent.app)
• 6.8 MB (EDRMainUI.app)

• Report the status of network isolation
• Separate upgrade check from status update API
• Third party libraries updated
• Bug fixed

• 20.4 MB (EDRAgent.app)
• 6.8 MB (EDRMainUI.app)

• Support PAC proxy
• Bug fixed

• 20.3 MB (EDRAgent.app)
• 6.8 MB (EDRMainUI.app)

• Collect endpoint information for Apps under Risk Insights
• Bug fixed

• 17.1 MB (EDRAgent.app)
• 6.8 MB (EDRMainUI.app)

• Support bandwidth control
• Bug fixed

• 17.1 MB (EDRAgent.app)
• 6.8 MB (EDRMainUI.app)

• Disable iES when XES is enabled
• Bug fixed

• 17.1 MB (EDRAgent.app)
• 6.8 MB (EDRMainUI.app)

• Support Service Gateway at the beginning of May
• Bug fixed

• 17.1 MB (EDRAgent.app)
• 6.7 MB (EDRMainUI.app)

• Add hash value in File Collection
• Bug fixed

• 21.7 MB (EDRAgent.app)
• 6.8 MB (EDRMainUI.app)

• Enhance networking function
• Bug fixed

• 20.6 MB (EDRAgent.app)

• Support Custom Script with parameter

• 20.6 MB (EDRAgent.app)
• 6.7 MB (EDRMainUI.app)

• Support memory dump collection in Remote Shell
• Bug fixed

• 20.6MB (EDRAgent.app)
• 6.7 MB (EDRMainUI.app)
• 1.4 MB (SupportTool.app)
• 7.0 MB SilentInstaller.app)
• 1.3 MB PreCheck.app)

• MacOS 12 support
• Common Agent Gateway integration
• EI V4 API integration
• Policy API integration
• Universal binary for both Apple silicon and Intel-based Mac computers

• 9.7 MB (EDRAgent.app)
• 5.2 MB (EDRMainUI.app)
• 854 KB (SupportTool.app)

• Provide network isolation and restoration capability on MacOS endpoints.

• Implemented ring deployment

• Remote Shell - Support Custom Script. With this feature, customer is able to execute previously uploaded bash script.

• Bug fixed

• Sensor support for RHEL10

• Bug fixed
• CPU control via Cgroup

• Bug fixed
• Support the TPL feature
• Sensor support for RHEL10
• dsa-response-plugin support for RHEL10

• Bug fixed
• Support .jsp file extension

• Bug fixed

• Bug fixed

• Bug fixed

• Bug fixed

• PCT Fix
  • Fix link path of PIDFile for vls_agent
  • Fix missing lock when getting hash
• New sensor filter rule

• Support wildcard exclusion

• Fixed bug of loading driver

• Bug fixed

• Update CA certificates

• New platform support for XES (SUSE 15 ARM V8)
• Bug fixed
  • Timing issue for GetXLogRToken when agent startup
  • Fix missing FILE_OPEN event in driver-less mode
  • Fix "Kernel not support" warning for driver-less mode
• Local control for MITRE exam
  • FILE_CHMOD event
  • FILE_DELETE event
  • All file extension

• Bug fixed
• Support driver-less mode

• Bug fixed
• Support fast track

• Bug fixed

• Bug fixed

• Fix proxy issue of Linux XES

• Enhance agent security
• Support IPv6 host address in activity logs
• Bug fixed

• Support agent metrics
• Bug fixed

• Allow Linux XES to be installed on DSA compliant platforms:
  • Amazon Linux 2 (AArch64)
  • Amazon Linux 2023 (x86_64/AArch64)
  • CloudLinux 7 (x86_64)
  • CloudLinux 7 (x86_64)
  • Debian 8 (x86_64)
  • Debian 9 (x86_64)
  • Debian 10 (x86_64)
  • Debian 11 (x86_64)
  • OracleLinux 6 (x86_64)
  • OracleLinux 7 (x86_64)
  • OracleLinux 8 (x86_64)
  • OracleLinux 9 (x86_64)
  • RHEL 8 (AArch64)
  • RHEL 9 (x86_64)
  • SuSE 12 (x86_64)
  • SuSE 15 (x86_64)
  • Ubuntu 18.04 (AArch64)
  • Ubuntu 20.04 (AArch64)
  • Ubuntu 22.04 (x86_64/AArch64)
  • RockyLinux 8 (x86_64)
  • RockyLinux 9 (x86_64)
  • AlmaLinux 8 (x86_64)
  • AlmaLinux 9 (x86_64)
  • RHEL Workstation 7 (x86_64)
• Bug fixed

• Bug fixed

• Support UDSO
• Support network isolation
• Support full package installation
• Bug fixed

• EI V4 API integration for sensor

• New Pattern 1302
• Bug fixed

• New Pattern 1268
• Bug fixed

• Bug fixed

• Azure site supported
• Bug fixed

• New Pattern 1243
• Bug fixed

• Ubuntu 16, 18, 20 supported
• Remote shell supported

• Red Hat 8 supported

• Initial Release

• Update heartbeat/task FQDN

• Use proxy setting from CE

• Use two-step to save config to avoid power-off causing config empty issue

• Endpoint Response modularized

• Enhance multiple threads
• Support pre-signed URL

• Update SDK and certificates

• Update library for vulnerability issue

• Enhance download mechanism
• Reduce total package size

• Update .NET runtime SDK

• Support Network Isolation Allow List
• Bug fixed

• Bug fixed

• Bug fixed

• 27 MB (Agent package)
• 43 MB (Dotnet Runtime package)

• Support full package installation
• Bug fixed
• Upgrade dotnet runtime to address vulnerabilities

• Bug fixed

• Platform support Windows Storage Server 2012
• Bug fixed

• Support Incident Response at the beginning of March
• Platform support Microsoft Hyper-V server 2016
• Bug fixed

• Bug fixed

• Bug fixed

• Platform Support Windows 11 (22H2)
• Bug fixed

• Bug fixed

• Bug fixed

• Bug fixed

• Bug fixed

• Reduce Agent package size
• Bug fixed

• Support Service Gateway at the beginning of May
• Bug fixed

• Support endpoint response features in VDI environment at the beginning of April

• Upload collected files with hash values (SHA-1 & SHA-256) provided

• Support Custom Script with parameter
• Bug fixed

• Enable Remote Shell to execute process memory dumps
• Enable Remote Shell to delete registries
• Bug fixed

• Enable self-protection to enhance module security
• Enhance the error message for unsupported response features
• Improves response feature execution by referring online and offline agent statuses

• Provided network isolation and restoration capability on endpoints

• Support for users to use PowerShell custom scripts for incident investigation and response

• Cumulative bug fix

• Enhance data collection

• Enhance data collection
• Performance enhancement

• Enhance data collection

• Enhance agent metrics collection

• Enhance data collection to detect app change

• Fix vulnerability
• Cumulative bug fix

• Cumulative bug fix

• Bug fixed

• Enhance data collection
• Bug fixed

• Enhance data collection

• Enhance data collection to detect OS upgrade
• Bug fixed

• Bug fixed

• Enhance data collection
• Bug fixed

• Enhance data collection
• Bug fixed

• Enhance data collection
• Bug fixed

• Bug fixed

• Bug fixed

• Bug fixed

• Enhance data collection to detect legacy Windows OS
• Enhance data collection to dynamically detect more vulnerabilities

• Enhance data collection

• Enhance data collection

• Ready to support ZTSA agent notify reassessment scan

• Remove standalone version
  • C:\Program Files (x86)\Trend Micro\DVASSTool\DVASSTool.exe
  • Windows task scheduler

• Refactor WMIC API

• Collect installed application list

• Register Windows task scheduler "Trend Micro Endpoint Vulnerability Scan Service"
• Install agent to machine path "%PROGRAMFILES(x86)%\Trend Micro\DVASSTool"

• Enhanced collection of Windows KB history
• Enhanced error handling
• Integrated Xlogr API

• Collect Windows KB history

• Cumulative bug fix

• Enhance data collection of hardware and network information

• Enhance data collection of hardware and network information
• Enhance data collection of registry and local user group

• Enhance data collection of hardware and network information

• Collect information: joined domain, screen lock, installed & activated EDR

• Fix vulnerability

• Collect hardware information

• Shorten the scan interval
• Enhance the ability to detect WSUS-managed status

• Enhance data collection

• Add telemetry

• Bug fixed

• Bug fixed

• Bug fixed

• Protobuf schema change

• Bug fixed
• Collect endpoint information for Apps under Risk Insights
• A hidden policy setting for Attack Surface Discovery (ASD) module which is default enabled for policy-based customers

Ring Deployment Plan:

• Oct 27: AU/MEA
• Oct 28: US/IN
• Oct 29: JP/SG/EU

• Resolved issues
  • Private Access failed to connect when multiple IP addresses were assigned to LightTunnelAdapter.
  • Private Access got stuck at connecting after Windows Update.
  • Refined the wording on the sign-in loading page when NTLM authentication is enabled.
• Enhancement
  • After XBC proxy changes, ZTSA now maintains the Private Access connection instead of disconnecting it.

• Enhancement
  • Cumulative bug fix

Ring Deployment Plan:

• Sep 30: AU/MEA
• Oct 1: US/IN
• Oct 2: JP/SG/EU

• New feature

  Private Access can connect using the last known good status even if the backend service is temporarily unavailable.

• New feature

  Private Access can connect using the last known good status even if the backend service is temporarily unavailable.

• New feature
  • Private Access can connect using the last known good status even if the backend service is temporarily unavailable.
• Resolved issues
  • Fixed the issue where the Internal Domains cannot be connected in Private Access.
  • Fixed the issue where the Security Scan is always performed when going back to the app.

• New feature
  • Private Access can connect using the last known good status even if the backend service is temporarily unavailable.
  • Support API 35.
  • Support 16 KB Page.
• Resolved issues
  • Fix APP detection show as file detected in V1 console problem (PCT-70673).
  • Fix SG will not work if set "Allow access to all services" on V1 console problem (PCT-71091).
  • Fix packet pass to SG instead of ZTSA when both SG and ZTSA exist problem (PCT-71091).
  • Fix VPN log level and reduce unnecessary log.
  • Clear SG cache when SG turned off (PCT-71091).

Ring Deployment Plan:

• Aug 25: AU/MEA
• Aug 26: US/IN
• Aug 27: JP/SG/EU

• Resolved issues
  • Fixed an issue where sometimes Private Access fail to connect due expired cookie.

• Resolved issues
  • The Popup of “Changing Configuration by Administrator” will show after update.
• Enhancement
  • Unify the log timestamps and format.
  • IA Authentication header is also recorded in user defaults in tunnel mode.

Ring Deployment Plan:

• Jul 28: AU/MEA
• Jul 29: US/IN
• Jul 30: JP/SG/EU

• New Feature
  • Added connector IP information to Private Access connection details page.
• Resolved issues
  • Fixed an issue where changes to the NTLM enable/disable setting in V1 does not immediately take effect in the ZTSA module.
  • ZTSA failed to log in via NTLM when multiple users were logged into Windows.
  • The user displayed in the ZTSA UI differed from the user shown on the Internet Access diagnostics page.

• Enhancement

  • Checks connectivity to the XBC proxy when switching networks and falls back to direct connection if the proxy is unreachable.

• 8/4: AU/MEA
• 8/5: US/IN
• 8/6: JP/SG/EU

• New Feature
  • Added connector IP information to Private Access connection details page.
• Resolved issues
  • Provide a notification popup reminding users to sign in to ZT

Ring Deployment Plan:

• Jun 30: AU/MEA
• Jul 1: US/IN
• Jul 2: JP/SG/EU

• Jul 8: AU/MEA
• Jul 9: US/IN
• Jul 10: JP/SG/EU

• Resolved issues

  • Prevented the update and uninstall processes from running simultaneously.
  • Fixed crash issues in ZTSAUpdate.exe and ZTSADownloader.exe that could occur during the update process.
  • NTLM authentication fails when NT service account is logged in.
  • Private Access internal apps are not reachable if any internal app FQDN contains a space.
  • Private Access connection fails because an empty proxy is used for connecting to Trend Micro backend.

• Enhancement

  • Skip connectivity checks for other proxies in the PAC file if any proxy is reachable.
  • Replace netsh command by Windows API or PowerShell command.

• Resolved issues
  • Resolved the issue where PA disconnection notifications were missing after a module update and removed residual search domain information from the system.
  • Fixed an issue where search domain details persisted in system settings following an abnormal PA disconnection.

• New feature

  • During OOBE mode, ZTSA will bypass all traffic.

• Resolved issues

  • When WMI is corrupt in Windows, ZTSA UI can't show up.
  • When NTLM is enabled and Forward Proxy Service is installed on the Service Gateway, ZTSA fails to sign-in.
  • Constant sign-in popup shows up even if Internet Access is connected.

• Enhancement

  • Show system notification when Private Access is disconnected.

• Resolved issues
  • After update, ZTSA still shows the sign-in popup.
  • Shutdown Mac device and reboot it after few times, the ZTSA will show the blank UI.
• Enhancement
  • Show system notification when Private Access is disconnected.

• New Feature
  • Support installation in restricted environment where direct internet access is blocked and only proxy connections are allowed. For more information, see Deploy Zero Trust Secure Access Module in restricted environment.
• Resolved Issues
  • When authentication server is down, ZTSA will retry the login page infinitely.
  • Private Access get stuck in “connecting“ state when netsh.exe crashes.
• Improvements
  • Upgrade .NET SDK to version 8.0.

• Resolved issues
  • Cannot access Internal App by Private Access if there are more than 100 internal apps.
  • Fix crash and UI issues when disabling the Internet Access in some specific steps
  • Auto proxy discovery is turned on after uninstallation
  • Some log is not complete
• Improvements
  • Improve debug log collecting

• Resolved issues
  • In Private Access diagnostics page, round-trip time (RTT) test always fails.
  • After Private Access is connected, NRPT rules are not being set up.
  • Sometimes Trend Vision One shows ZTSA uninstallation fails, but ZTSA is uninstalled successfully.
  • (JP region only) Fix an issue so that some management traffics now go through the proxy configured by "Primary Custom Proxy Settings" in both [Agent Installer Proxy Settings] and [Runtime Proxy Policy Settings]

• Resolved issues
  • In Private Access diagnostics page, round-trip time (RTT) test always fails.
  • IA will be enabled for a short time during bypass key is activated.
• Improvements
  • Improve debug log collecting

^{Released to AU Region only}

• Resolved Issues
  • After updating ZTSA, it fails to launch the default browser to sign-in when using browser-based authentication.

• Feature Availability
  • Support ZTNP connector resilience.
  • Support displaying endpoint connector information on the Trend Vision One console.
  • Support common proxy (neither cloud gateway proxy nor On-Premises gateway proxy) in the PAC file. (Refer to https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-pac-file-configuration for details).
• Improvements
  • ZTSA will no longer modify the system's manual proxy setting when Internet Access is enabled.
• Resolved issues
  • After Internet Access is disabled in Trend Vision One, it sometimes becomes enabled again and redirect traffic to SWG.
  • There are multiple firewall allow rules after update.
  • Sign-in popup doesn't show up when the second user RDP to Windows Server.
  • After Private Access is connected, the connection status is still disconnected in connection details page.
  • Cumulative bug fix.

• Feature Availability
  • Support ZTNP connector resilience
  • Support displaying endpoint connector information on the Trend Vision One console
• Improvements
  • Improve debug log collecting

• Resolved Issues
  • Apex One JP version is not detected as antivirus software in device posture.
  • Antivirus software is not detected in device posture on Windows Server OS.
  • Multiple "Local Area Connection" adapters are created in network connections.
  • Cumulative bug fix.

• Improvements
  • Fixed repeated MFA issue.
  • Added www.recaptcha.net to whitelist when authentication method is browser-based.
  • Cleaned up WebView2 user data folder when ZTSA UI starts.
  • Eliminated the use of tasklist.exe in Private Access.
  • Cumulative bug fix.

• Improvements
  • Updated the guide to allow system extension on MacOS 15.

^{(Released to JP Region only)}

• Improvements
  • Fixed ZTSA UI restarting issue.

• Feature Availability
  • After XBC is installed, ZTSA module can be automatically deployed.
• Improvements
  • Cumulative bug fix.

^{Release to SG/AU region only.}

• Improvements
  • Show “Switch User“ link when autheticating with NTLM.
  • When ZTSA is updating, shutting down the machine will display a message indicating ZTSA is updating.
  • Improve the error message when Private Access is disconnected due to environment issue.
  • Only install webview when it is not installed during update and install.
  • Cumulative bug fix.

^{Release to SG region only.}

• Improvements
  • Delete all NRPT rules after BSOD happens.
  • Fix unable to access internal apps if FQDN contains newline character in the end.
  • Cumulative bug fix.

• Improvements
  • Fix unable to access internal apps if FQDN contains newline character in the end.

• Improvements
  • Update webview2 installer to the latest.
  • Always install the latest webview2 during install and update.
  • Prevent sign-in failures caused by timeouts.
  • Fix invalid proxy server in user's pacfile.
  • Fix screenlock false positive in device posture.
  • Cumulative bug fix

• Feature Availability
  • Device posture - Add Trellix EDR check
• Improvements
  • Prevent ZTSAMonitorService.exe easily got crashed on Windows server environment
  • Cumulative bug fix

• Feature Availability
  • Cumulative bug fix

• Feature Availability
  • Agent upgrade rate control
• Improvements
  • Improve the performance of SetupRoute and RemoveRoute
  • Cumulative bug fix

• Feature Availability
  • Agent upgrade rate control

• Feature Availability
  • Provide an option for customers to connect corporate network without relay - Private Preview
• Improvements
  • Add error handling when WMI is corrupted and cause internal app to be unreachable
  • Add error handling when ZTSAWindows load local service port as empty string
  • Cumulative bug fix

• Feature Availability
  • Provide an option for customers to connect corporate network without relay - Private Preview
  • Support to use app's short name to access

• Improvements
  • Can downgrade the ZTSA version through the deploy and update commands in the Trend Vision One console
  • Add NRPT rule by powershell cmd
  • After changing separate auth from disable to enable, PA should auto-reconnect
  • Cumulative bug fix

• Improvements
  • After changing separate auth from disable to enable, PA should auto reconnect
  • Cumulative bug fix

• Feature Availability
  • Newly support an option in agent to disable the ZTNA block access popup notification
• Improvements
  • Windows proxy setting will be removed when Internet Access service status is OFF in Credit Settings
  • Cumulative bug fix

• Feature Availability
  • Newly support an option in agent to disable the ZTNA block access popup notification
• Improvements
  • Cumulative bug fix

• Feature Availability
  • AI gateway for public GenAI access protection - public preview
• Improvements
  • Reduce ZTSA install package size
  • Cumulative bug fix

• Feature Availability
  • AI gateway for public GenAI access protection - public preview
• Improvements
  • Cumulative bug fix

• Feature Availability
  • Newly support Google IDP SSO for browser-based auth
• Improvements
  • Cumulative bug fix

• Feature Availability
  • Newly support Google IDP SSO for browser-based auth
• Improvements
  • Cumulative bug fix

• Feature Availability
  • Support MEA site deployment

• Feature Availability
  • Newly support for endpoint-to-connector traffic encryption
  • Newly support the version configuration can be selected as N-1, N-2 in the Trend Vision One console
  • Newly support for revoking the access keys from the Trend Vision One console
• Improvements
  • Cumulative bug fix.

• Feature Availability
  • Newly support for endpoint-to-connector traffic encryption
  • Newly support the version configuration can be selected as N-1, N-2 in the Trend Vision One console
  • Newly support for revoking the access keys from the Trend Vision One console

• Improvements
  • Cumulative bug fix.

• Improvements
  • Cumulative bug fix.

• Improvements

• Feature Availability
  • Newly support separate auth for internet access and private access on SA module.
• Improvements
  • Cumulative bug fix.

• Feature Availability
  • Newly support separate auth for internet access and private access on SA module.
• Improvements
  • Cumulative bug fix.

• Feature Availability
  • Support to enable internet access or private access separately on SA module
  • Support VDI machine clone scenario
  • Improve the auth flow to allow SWG transparent auth
• Improvements
  • Cumulative bug fix.

• Feature Availability
  • Support to enable internet access or private access separately on SA module
  • Support VDI machine clone scenario
  • Improve the auth flow to allow SWG transparent auth
• Improvements
  • Cumulative bug fix.

• Feature Availability
  • Support wintun mode
• Improvements
  • Cumulative bug fix.
  • Enhance data collection.

• Improvements
  • Cumulative bug fix.
  • Enhance data collection.

• Standard Endpoint Protection (Windows): 14.0.20315
• Standard Endpoint Protection (Mac): 3.5.8052

• Standard Endpoint Protection (Windows): 14.0.20225
• Standard Endpoint Protection (Mac): 3.5.8052

• New Features
  • N/A
• Enhancements
  • This Hotfix updates the Virus Scan Engine (VSAPI) to version 25.560.1005 to deliver proactive and advance solutions to address challenging real-world threats.
  • This Hotfix updates the Damage Cleanup Engine (DCE) to version 7.5.1217 to enhance process chain cleanup capability and provides more details for cleanup information.
  • This Hotfix updates the TmEyes module to version 8.55.1403 and AMSP module 6.6.1216 to enhance ransomware detection capability.
• Resolved Issues
  • The notification of firewall policy violation does not behave according to the policy rule settings.
  • Apex One agent is unable to start Data Loss Prevention (DLP) service due to version comparison issue.
  • Malicious IP is not being blocked by user defined suspicious object (UDSO).
  • Manual scan ends with the displayed message “Stopped by Apex One” without any user interaction.
  • This Hotfix includes a new module Net Filter 1.0.456 to enhance web browser detection capability.
  • This Hotfix updates the Data Loss Prevention (DLP) to version 6.2.6098 to enhance print check logic and support Windows 11 25H2.
  • This Hotfix enhances the log upload mechanism to reduce network payload for Data Loss Prevention, Device Access Control, Behavior Monitoring, and Predictive Machine Learning logs.
  • This Hotfix enhances the quarantined file verification to prevent incorrect operations.
  • This Hotfix updates the Trend Micro Apex One Security Agent program to protect against a potential resource loading security issue.
• Security Updates
  • N/A

• Standard Endpoint Protection (Windows): 14.0.201??
• Standard Endpoint Protection (Mac): 3.5.80??

• New Features
  • This hotfix adds the quarantine file path and SHA-256 information to the detection results in Data Explorer.
• Enhancements
  • This Hotfix removes the Diagnostic Tool UI from the web console to enhance user experience.
  • This Hotfix updates the Windows SDK to version 10.0.19041.
  • This Hotfix enhances the protection capabilities of Behavior Monitoring to detect and block malicious behaviors originating from a valid driver.
  • This Hotfix updates the ofcntcer.dat file.
  • This Hotfix enables the system to remove specific outdated components from the agent folder.
  • This Hotfix updates the debug log to enhance agent processes on x86 platforms.
  • This Hotfix updates the Virus Scan Engine (VSAPI) to version 25.560.1004 and the Advanced Threat Scan Engine (ATSE) to version 25.560.1004 to enhance memory and file scans.
• Resolved Issues
  • When Behavior Monitoring is enabled, an issue may cause excessive memory usage in the system.
  • When configuring scan exceptions, the system may create duplicate entries.
  • An issue related to the agent update process may prevent Security Agents from performing updates.
  • Sometimes the system tray icon may not display.
  • When the Ntrtscan.exe process becomes unresponsive, the Security Agent console may display the "Protection at Risk" status.
  • Sometimes the agent driver (tmnciesc.sys) may become unresponsive.
  • An issue related to Data Loss Prevention (DLP) may prevent the system from applying the approved list for the SMB channel.
  • Some times the TCacheGen_x64.exe tool may not stop PccNTMon.exe properly.
  • An issue related to Data Loss Prevention (DLP) may prevent the system from checking compressed files in email messages.

• Standard Endpoint Protection (Windows): 14.0.20114
• Standard Endpoint Protection (Mac): 3.5.8052

• Enhancements
  • This Hotfix updates SEP Windows Agent for the Curl module to version 8.14.1 and OpenSSL to 3.0.16 to enhance product security. (CVE-2025-5025) (CVSS 3.x, Score 4.8)
  • This Hotfix updates the Data Loss Prevention (DLP) module to version 6.2.6090 to enhance product performance.
  • This Hotfix enhances the system logs to display policy names containing non-English characters.
  • This Hotfix updates the iCore module in SEP Mac Agent to enhance product security.
  • This Hotfix updates the Boost C++ libraries in Standard Endpoint Protection (SEP) to version 1.88.0 to enhance product security.
• Resolved Issues
  • An issue related to the trusted program list in SEP-Windows Security Agent may cause performance issues for some programs that are included in the list.
  • An issue related to the firewall exception profile rule set may prevent the system from applying the firewall exception rules properly.
  • An issue related to the update process when migrating to Standard Endpoint Protection (SEP) may prevent the system from updating the Trend Micro Security Agents properly.
  • After updating to SEP 2025-01 release, running the TMBMSRV.exe service may result in high memory usage on Security Agent endpoints.
  • An issue related to Behavior Monitoring may result in false positive alerts for Microsoft Applications.
  • When Data Loss Prevention (DLP) is enabled, the system may not block the transmission of sensitive data through webmail.
  • When uploading files to OneDrive, Data Loss Prevention (DLP) may not block sensitive files with a non-English filename.

• Standard Endpoint Protection (Windows): 14.0.14649
• Standard Endpoint Protection (Mac): 3.5.8010

• Enhancements
  • This Hotfix adds the "Dynamic Intelligence Mode"setting to automatically adjust monitoring levels tooptimize security responses based on analyzingdetected threats, user behavior, and system context.
  • This Hotfix updates the Virus Scan Engine (VSAPI) toversion 25.530.1011 and the Advanced Threat ScanEngine (ATSE) to version 25.530.1011 to protectagainst a Link Following Local Privilege Escalationsecurity issue.
  • This Hotfix updates the PHP component in Trend MicroApex One to enhance product security.
  • This Hotfix updates the Trend Micro Apex OneSecurity Agent program to protect against apotential Local Privilege Escalation Vector securityissue.
  • This Hotfix updates the related modules in TrendMicro Apex One to protect against the Virus ScanEngine Link Following Local Privilege EscalationVulnerability. (ZDI-CAN-24972)(CVSS 3.0, Score 7.8)
  • This Hotfix updates the Behavior Monitoring CoreService module to version 2.98.2105 and BehaviorMonitoring Core Drive module to version 2.98.2111 toenhance the Security Agent self-protectioncapabilities.
• Resolved Issues
  • When opening files with exclusive access (non-sharedmode), PowerShell scripts may not execute successfullyon Trend Micro Apex One Security Agent endpoints.
  • When Trend Micro Apex One Security extracts 7z fileattachments and stores the extracted files in a tempfolder, third-party security programs may scan thetemp folder resulting in high CPU usage on SecurityAgent endpoints.
  • The system may not install Trend Micro Security Agenton endpoints successfully using the installationpackage (EXE).
  • Trend Micro Apex One Security Agent is unable todetect Hong Kong identity card data containinglower-case alphabets.
  • When uploading files containing sensitive informationfrom Security Agent endpoints to cloud storage, thesystem may not apply the exclusion settings.
  • After updating Trend Micro Apex One Security Agent toBuild 14.0.14492, the web console displays the offlinestatus for multiple server endpoints.
  • A program memory leak issue in the TMCCSF.exe servicemay affect system performance.
  • When Trend Micro Firewall is enabled, the system isunable to access the ZScaler application.
  • Trend Micro Apex One may not detect suspicious filesin a hidden folder with an empty folder name on USBstorage devices.
  • File Reputation Service may become unavailable onSecurity Agent endpoints.
  • An issue related to Data Loss Prevention (DLP) mayprevent users from saving or deleting files on USBdevices that are granted read access in DeviceControl.

• Standard Endpoint Protection (Windows): 14.0.14492
• Standard Endpoint Protection (Mac): 3.5.7996

• Enhancements
  • This Hotfix updates the feature description on the Endpoint Sensor policy settings screen to enhance user experience.
  • This Hotfix adds application version information in Application Control detection logs for methods matched in the Application Reputation List.
  • This Hotfix enhances the self-protection capability for the SEP-Windows Security Agent program folder to improve product security.
  • This Hotfix enhances the Predictive Machine Learning module for suspicious Anti-malware Scan Interface (AMSI) event detections.
  • This Hotfix updates the SEP-Windows Security Agent program to enhance the blue screen of death (BSOD) Loop Prevention monitoring mechanism.
  • This Hotfix updates the Behavior Monitoring Core Service module to version 2.98.2101 and Behavior Monitoring Core Drive module to version 2.98.2100 to enhance the Security Agent self-protection capabilities.
  • This Hotfix enhances the Security Agent program update process in Trend Micro Apex One to prevent excessive network bandwidth usage.
  • This Hotfix enables SEP-Mac to send real-time scan status to Standard Endpoint Protection.
  • This Hotfix updates the iCore module in SEP-Mac Security Agent to support the millisecond format in detection logs.
• Resolved Issues
  • Adding file SHA-256 suspicious objects in Trend Vision One may prevent Trend Micro Apex One as a Service from upgrading to Standard Endpoint Protection.
  • The system may not send notification email for policy owner update to the policy owner in Standard Endpoint Protection.
  • The system may not display the updated Trend Micro Apex One group name in the Apex Central (Standard Endpoint Protection) Product Status view.
  • An issue may prevent Trend Micro Apex Central (Standard Endpoint Protection) from deploying components to integrated Trend Micro products.
  • An issue related to Application Control criteria processing may result in high CPU usage affecting system performance on SEP-Windows Security Agent endpoints.
  • Data Loss Prevention (DLP) may not function properly for 7-Zip compressed files on SEP-Windows Security Agent endpoints.
  • After updating the SEP-Windows Security Agent program, the system may display the Security Agent console unexpectedly on endpoints.
  • When updating the Suspicious Object (SO) lists in the SEP-Windows Security Agent, the Apex One NT Listener service ("TmListen.exe") may consume high CPU resource affecting system performance on Security Agent endpoints.
  • An issue related to virus/malware file path processing may cause the system to display spaces in detection file path as ASCII codes for the associated detection logs on the Log Query screen.
  • An issue related to the Trend Micro Apex One web console may prevent users from viewing the predefined port lists in Firewall Policy Rules.
  • A blue screen of death (BSOD) error may occur on SEP-Windows Security Agent endpoints when the Trend Micro Unauthorized Change Prevention Service is enabled and users attempt to save Microsoft Office files through network drives.

• Standard Endpoint Protection (Windows): 14.0.14320
• Standard Endpoint Protection (Mac): 3.5.7976

• Support in Application Control feature of Standard Endpoint Protection for SHA-256 suspicious object type from Suspicious Object Management in Trend Vision One.

• Standard Endpoint Protection (Windows): 14.0.14260
• Standard Endpoint Protection (Mac): 3.5.7952

• New platform support for Trend Vision One Endpoint Security - Standard Endpoint Protection (Windows Server 2025)
• Fixed bug/issue that Standard Endpoint Protection Agent does not trigger agent GUID synchronization with Endpoint Basecamp.

• Resolved Issues
  • Fix potential crashes caused by race conditions when manipulating Linux network devices during network packet processing.
  • Fix potential crashes caused by race conditions when multiple threads update the driver configuration.
  • Fix metrics of bmsensor is missing when SWP agent reports to Vision One.
  • Fixed the memfd detection failed issue

• New Features
  • Advanced TLS Traffic Inspection now supports TLS1.3 on Windows 11, Windows Server 2022 and Windows Server 2025.

• New features
  • Support Oracle Linux 10
• Resolved Issues
  • Fixed potential memory leak.
  • Fixed get podman service informatio issue.

• Resolved issues
  • Fixed potential memory leak.
  • Fix a restoration function failed when there is no Real-time scan configuration.

• Enhancements
  • Remove all Agent-PGPCore* files as well as Agent-Core* files in app folder after agent upgrade
• Resolved Issues
  • Avoid Integrity Check fail when multiple plugins download the same KSP at almost same time.
  • Agent sometimes crashes when doing heartbeat connection.

• Enhancements
  • Prevent the use of invalid path string when setting up temporary folders.
• Resolved issues
  • Agent sometimes crashes when doing heartbeat connection.

• Enhancements
  • Inject packet when connection is not locked to avoid crash
  • Red Hat Enterprise Linux 10: Deep Security Agent 20.0.2.14430 or later now supports Red Hat Enterprise Linux 10, including SELinux, Secure Boot and FIPS mode support.
• Resolved Issues
  • Fix the issue where the "Scan Now" button for on-demand scans doesn't work for Enhanced Recommendation Scans until the first automatic scan is triggered after agent activation or agent restart.

• Enhancements
  • Inject packet when connection is not locked to avoid crash
  • Agent Interface: Deep Security Agent now supports Agent Interface, which allows Trend Vision One Agent Interface to manage agent, component updates, and trigger scan for any endpoint with the Trend Micro Endpoint Basecamp (XBC) agent installed.
• Resolved issues
  • Fix the issue where the "Scan Now" button for on-demand scans doesn't work for Enhanced Recommendation Scans until the first automatic scan is triggered after agent activation or agent restart.
  • Agent language will be reverted to system default language after remote upgrade
  • Fix a bug that a file is detected by PML as safe file, and it won't be scanned by changing to higher detection level.
  • Add a hidden setting that product will not set relative registry keys for Windows Defender

• Enhancements
  • Support .jsp file extension on windows and linux platform.
  • Default Enabled, Web Reputation Service use Server Name Indication (SNI) queries when determining the risk level of a website
• Resolved Issues
  • Fix Agent report 5102 Protection Module Deployment Failed with "No such file or directory" error when V1ES Version Control Policy enabled
  • Fix the potential crashing issue during SSL handshake.

• Enhancements
  • Support .jsp file extension on windows and linux platform.
  • Let iAU always can duplicate full pattern if the incremental version is not available.
  • Default Enabled, Web Reputation Service use Server Name Indication (SNI) queries when determining the risk level of a website
  • Enhance the information of result when Process Memory Scan dedups.
• Resolved issues
  • Fix the agent crash if and only if the system architecture is x86 and only WRS is enabled.
  • Fix agent sometimes could not be upgraded using Trend Vision One version control policies.
  • Resolved system hang issue when AMSP trying to write log.
  • Fix the potential crashing issue during SSL handshake.

• New features
  • Support Red Hat Enterprise Linux 9 (AWS ARM-Based Graviton 2)
• Enhancements
  • Network Engine enhanced its URL checking functionality
• Resolved Issues
  • Adjust the injection flow to avoid network process deadlock issues
  • Adjust the driver unload flow to prevent network process crashes when the driver verifier is enabled
  • Fix UBSAN array-index-out-of-bounds error
  • Fix WRS reset packet issue
  • Improved the handling for agent diagnostic packages to avoid including some incomplete data
  • Fix agent might unexpectedly attempt to stop system services when failing to perform security updates
  • Fix WRS parse error for CONNECT method
  • Fix agent Anti-Malware kernel modules were unable to load into operating system due to incompatible environment tools

• Enhancements
  • Network Engine enhanced its URI checking functionality
• Resolved issues
  • Adjust the injection flow to avoid network process deadlock issues
  • Adjust the driver unload flow to prevent network process crashes when the driver verifier is enabled
  • Fix WRS reset packet issue
  • Fix WRS parse error for CONNECT method
  • Resolve a bug that some AM event registrations are missing after deactivation and reactivation for

• New Features
  • Dynamic Intelligence Mode enables the agent to automatically adjust monitoring levels to optimize security responses based on analyzing detected threats, user behavior, and system context.
  • Deep Security Agent can now trigger the installation of Endpoint Basecamp from Trend Cloud One - Endpoint & Workload Security.
  • Add support for http2 inbound traffic scanning
• Resolved Issues
  • Resolved Linux AM engine may crash when a certain pattern is not loaded into the system.
  • Resolved scheduled scan is triggered on wrong date and at wrong time when "Enable agent to trigger scheduled scans for malware" is enabled

• New features
  • Web Reputation Service now supports the "Trend Micro Toolbar for Enterprise" browser extension for Microsoft Edge and Google Chrome on Windows Server 2025.
  • Dynamic Intelligence Mode enables the agent to automatically adjust monitoring levels to optimize security responses based on analyzing detected threats, user behavior, and system context.
  • Deep Security Agent can now trigger the installation of Endpoint Basecamp from Trend Cloud One - Endpoint & Workload Security.
  • Add support for http2 inbound traffic scanning
• Resolved Issues
  • Resolved an issue that could cause the service process to crash under specific timing conditions
  • Resolved the performance issue in PureStorage solution environment
  • Resolved PowerPoint crashes issue when computer waked up from Hibernate.
  • Avoid corrupted registry causing BSOD issue
• Security updates
  • This release contains security update.

• New Features
  • Version Control Policy: Deep Security Agent now supports Version Control Policy advanced settings, which allows Trend Vision One version control policies to manage kernel support updates for any endpoint with the Trend Micro Endpoint Basecamp (XBC) agent installed. For more information, see https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-security-update-policies
     

    This is currently in pre-release, and is only supported for Trend Vision One - Server & Workload Protection.

     
• Resolved Issues
  • Fix CSV files larger than 4K bytes might be incorrectly classified by SAP Scanner.
  • Fixed performance issues in TLS 1.3 caused by unsupported protocols

• Enhancements
  • This enhancement improves SAP scan performance on Windows platforms by implementing a caching mechanism and reducing unnecessary operations, resulting in faster scan completion times.
  • Introduce a new dsa_scan argument, scanLargeFile, to support scanning files larger than 2GB-1 bytes, allowing users to efficiently manage larger files for smoother operations.
  • Add device control syslog for sending event to syslog server directly by request
• Resolved Issues
  • Fix AMSP service stop or crash issue
  • Fix network driver might be crashed when stopping if the "windows base filtering engine" service is not running.
  • Fix CSV files larger than 4K bytes might be incorrectly classified by SAP Scanner.
  • Fixed performance issues in TLS 1.3 caused by unsupported protocols
  • Fixed the article links issues when certificate-related error events are generated.

• New Features
  • User-based Firewall events: Firewall events now include username whenever possible. This feature is in preview and is only available to certain customers at this time.
• Enhancements
  • Deep Security Agent now queues packets to handle them in sequence, improving performance. DSA-6916
  • Activity Monitoring now includes hypersensitive mode on Linux platforms to provide improved MITRE coverage. DSA-6257
• Resolved Issues
  • Deep Security Agent sometimes had connectivity issues when Advanced TLS Traffic Inspection was enabled. DSA-8577
• Security Updates
  • This release contains updates to third-party libraries. DSA-7696/DSA-7697/DSA-8042

• New Features
  • Windows Server 2025 support: Deep Security Agent 20.0.2-1390 or later now supports Windows Server 2025, including FIPS mode support. This requires Deep Security Manager 20.0.1017 or later.
  • User-based Firewall events: Firewall events now include username whenever possible. This feature is in preview and is only available to certain customers at this time.
• Enhancements
  • Deep Security Agent now queues packets to handle them in sequence, improving performance. DSA-6916
  • Updated Deep Security Agent to improve spyware prevention. PCT-18199/DSA-5889
• Resolved Issues
  • Deep Security Agent sometimes had connectivity issues when Advanced TLS Traffic Inspection was enabled. DSA-8577
• Security Updates
  • This release contains updates to third-party libraries. DSA-7695/DSA-8042