• [SA-16205] Rules: Add new high-confidence rule SPAM_topic_package_delivery_nonreputable_1dayold_link_domain_mismatches_from_domain (ACTIVE by default). This rule improves detection for emails with links to new domains from non-reputable senders.
• [SA-16343] Rules: Add new high-confidence rule PHISHING_topic_invoice_untrusted_nonreputable_cloudmailer_only_inbound (ACTIVE by default). This rule improves detection for invoice phishing from nonreputable cloudmailers.
• [SA-16449] Rules: Add new high-confidence rule BEC_bcc_only_html_short_link_img_files_all_media (ACTIVE by default). This rule improves detection for document-sharing-related phishing typically seen in BEC cases.
• [SA-16461] Rules: Add new high-confidence rule SPAM_untrusted_noauth_sender_is_non_personal_address (ACTIVE by default). This rule improves spam detection for certain kinds of medication-related spam.

Available via upgrade

• [SA-16467] MTA: Fix problem with lingering temp-files when parsing certain ical files.
• [SA-5227] XCC: Allow configuring per-tenant quarantine digest and email notification sender address via config guarded_tenants.yml property tenants[].quarantine.notifications.notificationAddress and tenants[].quarantine.emailReporting.notificationAddress.
• [SA-16090] XCC: The email notifications are now also localized in Spanish.
• [SA-16090] UI: The SSQ web interface now supports the Spanish language.
• [SA-16355] UI: Fix text alignment in attachment table.
• [SA-16356] UI: Fix an issue where the shortcuts stopped working after the first use.
• [SA-16271] UI: Show campaign validation errors and warnings in the detail view.
• [SA-16363] UI: Added a copy button after the breadcrumbs in the list editor to copy the list identifier (listName).
• [SA-16421] UI: Fix a bug that prevented copying the file size in the attachments table.

• [SA-16205] Rules: Add new high-confidence rule SPAM_topic_package_delivery_nonreputable_1dayold_link_domain_mismatches_from_domain (ACTIVE by default). This rule improves detection for emails with links to new domains from non-reputable senders.
• [SA-16209] Rules: Add a new high-confidence rule PHISHING_bcc_only_sender_global_reputation_low_cloud_storage_link (ACTIVE by default). This rule catches phishing that claims to share an important document via a cloud storage link.
• [SA-16261] Rules: Add a new rule BEC_bcc_only_html_short_link_image_small_body (ACTIVE by default). This rule catches BEC cases claiming to share a document.
• [SA-16297] Rules: Improve PHISHING_sender_unknown_never_delivered_cloud_mailer_displayname_popular and PHISHING_unknown_never_delivered_cloudmailer_autogenerated_keywords to avoid FPs.
• [SA-16334] MTA: Fixed a resource leak that could exhaust available ports and cause emails to queue up.
• [SA-16343] Rules: Add new high-confidence rule PHISHING_topic_invoice_untrusted_nonreputable_cloudmailer_only_inbound (ACTIVE by default). This rule improves detection for invoice phishing from nonreputable cloudmailers.
• [SA-16362] Rules: Add new high-confidence rule SPAM_freemail_forged_reply_to_bcc_only_lots_of_money (ACTIVE by default). This rule improves detection for spam promising victims huge sums of money.
• [SA-16449] Rules: Add new high-confidence rule BEC_bcc_only_html_short_link_img_files_all_media (ACTIVE by default). This rule improves detection for document-sharing-related phishing typically seen in BEC cases.
• [SA-16461] Rules: Add new high-confidence rule SPAM_untrusted_noauth_sender_is_non_personal_address (ACTIVE by default). This rule improves spam detection for certain kinds of medication-related spam.

Available via upgrade

• [SA-16271] UI: Show campaign validation errors and warnings in the detail view.
• [SA-16421] UI: Fix a bug that prevented copying the file size in the attachments table.
• [SA-16422] UI: Fix a bug where the the subject rewrite was not displayed correctly for actions with no confidence.

• [SA-16184] Fix detection of the #reportedasjunk, #reportedasnotjunk, and #reportedasphishing tags in setups where a required mail header is missing.
• [SA-16209] Rules: Add a new high-confidence rule PHISHING_bcc_only_sender_global_reputation_low_cloud_storage_link (ACTIVE by default). This rule catches phishing that claims to share an important document via a cloud storage link.
• [SA-16261] Rules: Add a new rule BEC_bcc_only_html_short_link_image_small_body (ACTIVE by default). This rule catches BEC cases claiming to share a document.
• [SA-16297] Rules: Improve PHISHING_sender_unknown_never_delivered_cloud_mailer_displayname_popular and PHISHING_unknown_never_delivered_cloudmailer_autogenerated_keywords to avoid FPs.
• [SA-16362] Rules: Add new high-confidence rule SPAM_freemail_forged_reply_to_bcc_only_lots_of_money (ACTIVE by default). This rule improves detection for spam promising victims huge sums of money.

Available via upgrade

• [SA-16187] MTA: Email processing API service should immediately return a http status code 429 if overloaded.
• [SA-16321] MTA: Add trustedMTA type Border allowing more versatile email routing configurations.
• [SA-16334] MTA: Fixed a resource leak that could exhaust available ports and cause emails to queue up.
• [SA-16410] UI: Prevent skipping messages when using the previous/next message shortcuts in the detail view.
• [SA-16345] XCC: Fix regression where updating a rule list comment would show an error even though changes were persisted.
• [SA-16422] UI: Fix a bug where the the subject rewrite was not displayed correctly for actions with no confidence.
• [SA-16473] XCC: Fix issue leading to a timeout during database backup recovery on large instances.
• [SA-16480] XCC: Fix issue causing errors when searching for messages after a database recovery.

• [SA-16173] Rules: Add new high-confidence rule SPAM_untrusted_domain_only_inbound_matches_popular_service_not_popular_auth (ACTIVE by default). This rule catches more phishy spam, e.g., where the spammer impersonates Galaxus.
• [SA-16305] Rules: Add new high-confidence rule PHISHING_topic_invoice_untrusted_domain_only_inbound_sender_global_reputation_low (ACTIVE by default). This rule catches more invoice-based phishing.
• [SA-16348] Rules: Improve our internal scores for certain payment providers to reduce FP.

Available via upgrade

• [SA-16126] MTA, XCC, Dana: Address issue which causes host upgrades to fail if not enough space is available on the /boot partition.
• [SA-16349] MTA: The ConfigClient is now more resilient against corrupted or otherwise incomplete meta-info files.
• [SA-16268] XCC: Expert config editor prevents invalid roleMapping in auth.yml.

• [SA-16173] Rules: Add new high-confidence rule SPAM_untrusted_domain_only_inbound_matches_popular_service_not_popular_auth (ACTIVE by default). This rule catches more phishy spam, e.g., where the spammer impersonates Galaxus.
• [SA-16236] Rules: Improve PHISHING_untrusted_domain_only_inbound_sender_global_reputation_low_matches_keyword to catch more phishing.
• [SA-16291] Rules: Add new high-confidence rule PHISHING_topic_package_delivery_untrusted_only_inbound_forged_replyto_non_configured_ccsend (ACTIVE by default). This rule improves detection for package delivery phishing.
• [SA-16305] Rules: Add new high-confidence rule PHISHING_topic_invoice_untrusted_domain_only_inbound_sender_global_reputation_low (ACTIVE by default). This rule catches more invoice-based phishing.
• [SA-16348] Rules: Improve our internal scores for certain payment providers to reduce FP.

Available via upgrade

• [SA-16236] Rules: Improve PHISHING_untrusted_domain_only_inbound_sender_global_reputation_low_matches_keyword to catch more phishing.

Available via upgrade

• [SA-16321] Core: Fixed a regression introduced in 11.0.6 that could cause sender authenticity to be evaluated incorrectly, resulting in legitimate senders being marked as unauthentic.
• [SA-16288] UI: Fixed the Abuse Mailbox chart tooltip so it stays above the legend and updates its value correctly when hovering between priority segments.

• [SA-10215] MTA: Introduce trustedMta config option type to better control how and when to trust received-headers.
• [SA-16291] Rules: Add new high-confidence rule PHISHING_topic_package_delivery_untrusted_only_inbound_forged_replyto_non_configured_ccsend (ACTIVE by default). This rule improves detection for package delivery phishing.

Available via upgrade

• [SA-16289] MTA: Address CVE-2026-14266 in 7zip.
• [SA-16170] XCC: Fixed an issue where the sender could appear as unauthenticated in the UI due to inconsistent letter casing.

• [SA-16043] Rules: Add new high-confidence rule PHISHING_untrusted_domain_only_inbound_matches_multiple_delivery_keywords_short_body (ACTIVE by default). This rule enables us to catch more package delivery phishing.
• [SA-16093] Rules: Add new rule BEC_bcc_only_only_media_files_link_subdomain_provider_cloud_storage (ACTIVE by default). This rule improves our ability to catch BEC cases, where the attacker host the payload on a cloud storage provider.
• [SA-16203] Rules: Add new high-confidence rule PHISHING_untrusted_domain_only_inbound_sender_global_reputation_low_matches_keyword (ACTIVE by default). This rule catches more invoice phishing.

Available via upgrade

• [SA-5450] MTA: Add a mta-down-graceful shell utility which first blocks new traffic, drains the queues and then shuts-down the MTA.
• [SA-16094] MTA: Enforced a stricter input size limit for URL extraction to improve resource utilization and prevent timeouts.
• [SA-16106] MTA: Fixed an issue that could cause attachments to be skipped during analysis under certain conditions.
• [SA-16197] UI: Fix a bug where long images were displayed in full size without the ability to scroll them.

• [SA-16043] Rules: Add new high-confidence rule PHISHING_untrusted_domain_only_inbound_matches_multiple_delivery_keywords_short_body (ACTIVE by default). This rule enables us to catch more package delivery phishing.
• [SA-16093] Rules: Add new rule BEC_bcc_only_only_media_files_link_subdomain_provider_cloud_storage (ACTIVE by default). This rule improves our ability to catch BEC cases, where the attacker host the payload on a cloud storage provider.
• [SA-16203] Rules: Add new high-confidence rule PHISHING_untrusted_domain_only_inbound_sender_global_reputation_low_matches_keyword (ACTIVE by default). This rule catches more invoice phishing.

Available via upgrade

Available via upgrade

• [SA-16111] MTA, XCC, Dana: Fix issues with background package management commands interfering with ones running in the foreground.
• [SA-16143] MTA, XCC: Trust "DigiCert Global Root CA", which was recently removed from Mozilla's list of trusted roots. M365 services, notably MTAs require us to still trust this root.
• [SA-16142] MTA: Fix an issue that caused analysis results to be too large to be published to XCC.

Available via upgrade

• [SA-16142] MTA: Fix an issue that caused analysis results to be too large to be published to XCC.
• [SA-16143] MTA, XCC: Trust "DigiCert Global Root CA", which was recently removed from Mozilla's list of trusted roots. M365 services, notably MTAs require us to still trust this root.

• [SA-15996] Rules: Add new high-confidence rule SPAM_ml_only_inbound_non_reputable_link_with_path_no_local_reputation (ACTIVE by default). This rule catches various kinds of spam messages from only-inbound senders.
• [SA-16029] Rules: Add new high-confidence rule SPAM_only_inbound_low_reputation_one_shortened_link (ACTIVE by default). This rule targets mass online pharmacy spam.
• [SA-16086] Rules: Add new high-confidence rule PHISHING_ml_topic_invoice_account_issue_package_delivery_displayname_similar_to_popular (ACTIVE by default). This rule catches phishing attempts where the sender tries to appear to be a renowned service.

Available via upgrade

• [SA-16074] XCC: Fix a mismatch where we had the tag #noauth but the UI showed the sender as authenticated.
• [SA-16087] XCC: Fixed duplication issue that caused three malware entries to display when resolving a case via the dropdown menu.
• [SA-16096] XCC: Resolve an issue where the UI would show a sender as not authenticated, even though the tag #auth is also present.
• [SA-16109] XCC: Fixed bug that prevented users with role xcc_tenant_analyst to use the user interface.
• [SA-16118] XCC: Fixed issue that caused email templates to not to be hot-reloaded.
• [SA-16077] UI: Fixed a bug where, in some cases, both the current message and the empty state were shown in the similar list if the search had no matches.
• [SA-16078] UI: Fixed a regression where clicking on a folders would not collaps/espand it.
• [SA-16119] UI: Fixed issue that prevented the saved search time range to be shown.
• [SA-16052] UI: Fixed a bug that could cause one image to be skipped when using the arrow keys to navigate to the next/previous image.
• [SA-16079] UI: Fixed a layout issue where the reported icon was displayed wrongly in similar list.
• [SA-16095] UI: Fixed an issue causing images to flicker in Firefox in some instances.

• [SA-15996] Rules: Add new high-confidence rule SPAM_ml_only_inbound_non_reputable_link_with_path_no_local_reputation (ACTIVE by default). This rule catches various kinds of spam messages from only-inbound senders.
• [SA-16029] Rules: Add new high-confidence rule SPAM_only_inbound_low_reputation_one_shortened_link (ACTIVE by default). This rule targets mass online pharmacy spam.
• [SA-16086] Rules: Add new high-confidence rule PHISHING_ml_topic_invoice_account_issue_package_delivery_displayname_similar_to_popular (ACTIVE by default). This rule catches phishing attempts where the sender tries to appear to be a renowned service.

Available via upgrade

• [SA-16008] XCC: Restored Europe/Zurich as the default time zone for quarantine digests. Due to a regression, new schedules were incorrectly created in UTC.
• [SA-16064] XCC: Fixed DMARC alignment computation in the UI. Some emails with authenticated senders were incorrectly displayed as failing authentication.
• [SA-16074] XCC: Fix a mismatch where we had the tag #noauth but the UI showed the sender as authenticated.
• [SA-16096] XCC: Resolve an issue where the UI would show a sender as not authenticated, even though the tag #auth is also present.

Available via upgrade

• [SA-15913] Dana: Reduced exposure of potentially sensitive information by no longer logging certain HTTP request headers.
• [SA-16008] XCC: Restored Europe/Zurich as the default time zone for quarantine digests. Due to a regression, new schedules were incorrectly created in UTC.
• [SA-16061] XCC: Fixed an issue introduced with the release 11 upgrade where the first counter lookup always returned 0, causing tags such as #domainfirstcontact to be applied to emails from known senders.
• [SA-16064] XCC: Fixed DMARC alignment computation in the UI. Some emails with authenticated senders were incorrectly displayed as failing authentication.

• [SA-15960] Rules: Disabled spam classifier training during mail imports, as classifiers are shared across tenants.
• [SA-15970] Rules: Improved IBAN detection (see #iban tag).

Available via upgrade

• [SA-16013] Dana: Ensure packages are properly upgraded to prevent startup failures caused by outdated AppArmor profiles.
• [SA-15885] XCC: Ensure proper sanitization of attacker-controlled content in quarantine digests.
• [SA-16017] XCC: Fixed intermittent counter update failures caused by a database constraint violation.

• [SA-5068] UI: Users with self-service quarantine access can now archive quarantined emails to keep their view clean. The archived messages are hidden from the main view but remain accessible at any time.
• [SA-14132] UI: Onboarding a new Microsoft 365 tenant can now start immediately using retrospective email scanning. This feature allows xorlab to scan historical email traffic to initialize relationship scores and reputations right away, reducing the learning period and false positives in early deployment.
• [SA-6123] XCC: Allow lists, block lists, and VIP lists can now be managed programmatically via REST API. All changes done via APIs are scoped, token-authenticated, and audit-logged.

UX improvements and fixes

• [SA-14961] UI: Improved error reporting for case isolation, showing a specific error message when isolation fails because the target mailbox is on-premises, disabled, or deleted.
• [SA-15191] UI: Removed double scrollbars appearing in message lists.
• [SA-15353] UI: Fixed a bug where loading more results after entering an invalid query displayed a page error.
• [SA-15384] UI: Removed the label from the actions column header in the self-service quarantine attachment list.
• [SA-15385] UI: Fixed an inconsistency where two different delete icons were used across the UI.
• [SA-15438] UI: Removed an unnecessary data reload that occurred after closing the unlock message dialog.
• [SA-15755] UI: Improved the attachments table to expand and better fill the available space.
• [SA-15787] UI: Add the ability to open a link on a new tab on sidebar submenus by using the middle button (or Ctrl+Click).
• [SA-15788] UI: Fixed a bug where clicking a dashboard link would reset the selected tenant.
• [SA-15794] UI: Removed the tooltip animation for the open case priorities chart.
• [SA-15840] UI: Fixed a bug where a long mail subject could break the layout.
• [SA-15875] UI: Added missing column padding in blocklist/allowlist dialogs.

Multi-Tenancy improvements

• [SA-12705] XCC: Case isolation can now be configured for multiple tenants.
• [SA-14149] Core: Added per-tenant tuning of several message processing parameters.
• [SA-15237] Core: Added native support for tenant-specific rules and rule profiles.

Detection improvements

• [SA-11086] Core: Improved detection for resource-intensive archives like zip bombs.
• [SA-15131] Rules: Ensure #deliver and #benign tags are set properly on emails with direction external.

Breaking changes

• [SA-14193] MTA: This release removes the internal unbound DNS resolver. This breaking change affects on-prem customers only; SaaS customers are not affected. All DNS requests are now resolved via the DNS server configured on the host. In standard on-prem configurations, no action is required. To verify whether your setup is affected:

  • Open activeguard/core/startup_cfg/unbound.conf in the Expert Editor.
  • If the file does not contain an active forward-zone entry, no action is required.
  • If such an entry exists, compare the configured forward-addr with the host DNS server by running resolvectl status on any MTA and checking Current DNS Server. If it is not the same, contact support@xorlab.com.
• [SA-6123] XCC: Lists exceeding 10'000 entries will now be automatically truncated. If any of your lists is affected, please contact support@xorlab.com to have the maximum limit adjusted and the previous content restored.

• [SA-12205] XCC: When using the M365 Abuse Mailbox, emails reported by users as "Not Junk" will now be auto-resolved as benign (with precedence over campaigns). No report acknowledgment or feedback will be sent to the user for these cases. To revert to the previous behavior, follow the instructions.

  Reported phishing simulation emails are unaffected: they are still auto-resolved and feedback is still sent.

  In addition, xorlab now sets these tags for M365 Abuse Mailbox reports: #reportedasnotjunk, #reportedasjunk, #reportedasphishing.

• [SA-12205] XCC: The tags #simulation and #recipientdropped cannot be used anymore in campaigns. Existing campaigns with those tags will still work as before, but marked as deprecated in the GUI.
• [SA-15254] XCC: Simplification of Auth configuration (auth.yml). Support for multiple file-based data sources in a username-password auth backend has been dropped. With this release, only one file-based data source is supported. By default, the file-based data source is enabled with the users specified in the passwordFile.yml file. No action is required. Existing configuration will be migrated into a conforming state.
• [SA-15293] XCC: The xcc.yml setting frontend.triageDefaultSelection.classification has been removed. No action is required.
• [SA-15119] Rules: The exploit verdict has been merged into malware. As of this release, the exploit verdict and the #exploit tag have been removed. For any cases where the exploit verdict was assigned, xorlab will now fall back to the malware verdict. Similarly, any attachment transformation policies that are configured for exploit will fall back to the configured malware policy.

• [SA-15207] Rules: Removal of the monitoring_mode.properties rule profile

  For setups that are configured to run in Monitoring mode and the monitoring_mode.properties profile is configured in active_guard.yml (under rules → params), the automatic migration will replace it with default_actions.properties. This changes some default decision actions as follows:

  • The medium confidence filter/policy action changes from DELIVER to QUARANTINE
  • The medium confidence impersonation action changes from DELIVER to QUARANTINE
  • The medium confidence VIP fraud action changes from DELIVER to QUARANTINE

Bugfixes and improvements

• [SA-14836] MTA: Prevent Postfix from performing SMTP requests using IPv6 leading to error logs.
• [SA-15003] MTA: Fix "Postfix down" alerts, postfix_exporter now restarts unhealthy log sources.
• [SA-15006] MTA: Address a changed metric label affecting the Postfix queue size alert and the MTA monitoring dashboard.
• [SA-15025] MTA: Improve Postfix SMTP security defaults.
• [SA-15105] MTA: In this release, we disabled additional authentication methods that were not following the DMARC RFC. By default, these methods are now disabled because they caused senders to be authenticated when sent via certain cloud mailer services, even though they should not be considered authenticated under DMARC.
• [SA-15338] MTA: Fix problem where tenant assignment would fail in monitoring mode in certain cases.
• [SA-15458] MTA: Overhauled envelope extraction configuration to switch between inline and monitoring mode.
• [SA-15556] MTA: Adjust rspamd default configuration. Reduce number of retries when querying 3rd party DNS lists.
• [SA-15945] MTA: Fix issue where rspamd would not fully recover after a start or config update if the backend was temporarily unavailable.
• [SA-11966] XCC: Auth now supports TOTP-based multi-factor authentication for users specified in the password file.
• [SA-15284] XCC: Fix redacted subject being visible during PENDING state.
• [SA-15395] XCC: Users with an unknown or no tenant assignment are now able to store some user settings (e.g. the UI theme).
• [SA-15545] XCC: Introduce a new audit trail event audit.xcc_instance_metrics.submitted, which is triggered when the metrics are submitted to xorlab.
• [SA-15717] XCC: Fix issue where pending release requests where not marked as approved if approval was bypassed by an release action.

• [SA-14440] Rules: Add new high-confidence rule PHISHING_topic_account_issue_untrusted_nonreputable_body_matches_multiple_urgency_keywords_popular_service (ACTIVE by default). This rule catches more account issue phishing.
• [SA-15328] Rules: Add a new high-confidence rule PHISHING_unknown_never_delivered_cloudmailer_autogenerated_keywords (ACTIVE by default) to catch phishing sent via abused cloud mailing services.
• [SA-15544] Rules: Add new high confidence rule PHISHING_domain_only_inbound_html_short_link_image_short_body (ACTIVE by default). This rule improves our ability to catch more "account problem" phishing.
• [SA-15754] Rules: Add a new high-confidence rule PHISHING_non_reputable_only_inbound_popular_displayname_guarded_subject (ACTIVE by default). This rule targets phishing disguised as notifications from popular services.
• [SA-15754] Rules: Add a new high-confidence rule SPAM_only_inbound_phishing_keywords_video (ACTIVE by default). This rule targets video-based spam messages.
• [SA-15822] Rules: Add a new high-confidence rule MALWARE_only_inbound_noauth_ole (ACTIVE by default) to catch malware embedded in Office documents.

• [SA-15833] Rules: Add two new high-confidence rules (ACTIVE by default):

  • SPAM_untrusted_very_young_domain_link_count_is_exactly_one: Blocks spam coming from very young sender domains
  • PHISHING_untrusted_freemail_very_young_domain: Blocks phishing coming from very young sender domains
• [SA-15835] Rules: Add a new high-confidence rule PHISHING_untrusted_only_inbound_body_displaytext_document_signature_keyword_link_with_no_reputation (ACTIVE by default). This rule targets document-signing phishing.
• [SA-15835] Rules: Add a new high-confidence rule SPAM_untrusted_noreputation_popular_displayname_link_mismatches_from_domain (ACTIVE by default). This rule targets spam where the sender attempts to impersonate a popular service.
• [SA-15903] Rules: Treat VHD and VHDX disk images as malware.
• [SA-15905] Rules: Add a new high-confidence rule SPAM_only_inbound_obfuscated_text (ACTIVE by default) to catch malicious emails applying various obfuscation techniques.
• [SA-15921] Rules: Update and improve the existing rule EXTORTION_nonreputable_untrusted_match_multiple_keywords. With this change, it catches even more extortion cases.
• [SA-16004] Rules: Add a new high-confidence rule PHISHING_only_inbound_freemail_file_scheme (ACTIVE by default) to catch a wave of credential stealing phishing using the file: URI scheme.

Available via upgrade

• [SA-15556] MTA: Adjust rspamd default configuration. Reduce number of retries when querying 3rd party DNS lists.
• [SA-15945] MTA: Fix issue where rspamd would not fully recover after a start or config update if the backend was temporarily unavailable.
• [SA-15840] UI: Fixed a bug where a long mail subject could break the layout.
• [SA-15871] UI: Fixed tree view item highlighting in Expert Editor.
• [SA-15934] UI: Fixed the formula displayed in the time saved panel.

• [SA-14440] Rules: Add new high-confidence rule PHISHING_topic_account_issue_untrusted_nonreputable_body_matches_multiple_urgency_keywords_popular_service (ACTIVE by default). This rule catches more account issue phishing.
• [SA-15328] Rules: Add a new high-confidence rule PHISHING_unknown_never_delivered_cloudmailer_autogenerated_keywords (ACTIVE by default) to catch phishing sent via abused cloud mailing services.
• [SA-15544] Rules: Add new high confidence rule PHISHING_domain_only_inbound_html_short_link_image_short_body (ACTIVE by default). This rule improves our ability to catch more "account problem" phishing.
• [SA-15754] Rules: Add a new high-confidence rule PHISHING_non_reputable_only_inbound_popular_displayname_guarded_subject (ACTIVE by default). This rule targets phishing disguised as notifications from popular services.
• [SA-15754] Rules: Add a new high-confidence rule SPAM_only_inbound_phishing_keywords_video (ACTIVE by default). This rule targets video-based spam messages.
• [SA-15822] Rules: Add a new high-confidence rule MALWARE_only_inbound_noauth_ole (ACTIVE by default) to catch malware embedded in Office documents.

• [SA-15833] Rules: Add two new high-confidence rules (ACTIVE by default):

  • SPAM_untrusted_very_young_domain_link_count_is_exactly_one: Blocks spam coming from very young sender domains
  • PHISHING_untrusted_freemail_very_young_domain: Blocks phishing coming from very young sender domains
• [SA-15835] Rules: Add a new high-confidence rule PHISHING_untrusted_only_inbound_body_displaytext_document_signature_keyword_link_with_no_reputation (ACTIVE by default). This rule targets document-signing phishing.
• [SA-15835] Rules: Add a new high-confidence rule SPAM_untrusted_noreputation_popular_displayname_link_mismatches_from_domain (ACTIVE by default). This rule targets spam where the sender attempts to impersonate a popular service.
• [SA-15903] Rules: Treat VHD and VHDX disk images as malware.
• [SA-15905] Rules: Add a new high-confidence rule SPAM_only_inbound_obfuscated_text (ACTIVE by default) to catch malicious emails applying various obfuscation techniques.
• [SA-15921] Rules: Update and improve the existing rule EXTORTION_nonreputable_untrusted_match_multiple_keywords. With this change, it catches even more extortion cases.
• [SA-16004] Rules: Add a new high-confidence rule PHISHING_only_inbound_freemail_file_scheme (ACTIVE by default) to catch a wave of credential stealing phishing using the file: URI scheme.

Available via upgrade

• [SA-15491] Rules: Add new high-confidence rule SPAM_untrusted_sender_only_inbound_shortened_short_body (ACTIVE by default). This rules improves our ability to catch spam using shortened links.
• [SA-15687] Rules: Add new high-confidence rule SPAM_untrusted_recipient_is_non_personal_address_address_type_count_high (ACTIVE by default). This rule target mass spam where the spammer has a ton of recipients as TO or CC.

• [SA-15691] Rules: Add two new rules (ACTIVE by default):

  • PHISHING_ml_untrusted_matches_popular_service_link_domain_mismatch: The rule improves our ability to detect phishing attacks impersonating popular services.
  • SPAM_untrusted_sender_only_inbound_body_matches_popular_service_urgency_keyword: The rule improves our ability to detect phishy spam mentioning popular services.
• [SA-15709] Rules: Add new rule MALWARE_cracked_new_domain_doc_link (ACTIVE by default). This rule improves our ability to block malware attacks, where the attacker tries to hide the malware behind an encrypted attachment.
• [SA-15816] Rules: Add new high-confidence rule PHISHING_topic_invoice_untrusted_domain_only_inbound_displaytext_contains_only_caps (ACTIVE by default). This rule enables us to block more invoice phishing attacks.

Available via upgrade

• [SA-15732] MTA: Improved the detection of auto-generated emails.

• [SA-15615] UI: Fixed time range picker issues:

  • Dashboard no longer scrolls to the bottom after selecting a new time range.
  • Picker no longer appears offscreen in the Similar tab.
• [SA-15696] UI: Fixed an issue that caused a text field's background to turn white after selecting an option in the browser autocomplete popup.
• [SA-15717] XCC: Fixed an issue where pending release requests were not marked as approved if approval was bypassed by a release action.

• [SA-15491] Rules: Add new high-confidence rule SPAM_untrusted_sender_only_inbound_shortened_short_body (ACTIVE by default). This rules improves our ability to catch spam using shortened links.
• [SA-15687] Rules: Add new high-confidence rule SPAM_untrusted_recipient_is_non_personal_address_address_type_count_high (ACTIVE by default). This rule target mass spam where the spammer has a ton of recipients as TO or CC.

• [SA-15691] Rules: Add two new rules (ACTIVE by default):

  • PHISHING_ml_untrusted_matches_popular_service_link_domain_mismatch: The rule improves our ability to detect phishing attacks impersonating popular services.
  • SPAM_untrusted_sender_only_inbound_body_matches_popular_service_urgency_keyword: The rule improves our ability to detect phishy spam mentioning popular services.
• [SA-15709] Rules: Add new rule MALWARE_cracked_new_domain_doc_link (ACTIVE by default). This rule improves our ability to block malware attacks, where the attacker tries to hide the malware behind an encrypted attachment.
• [SA-15816] Rules: Add new high-confidence rule PHISHING_topic_invoice_untrusted_domain_only_inbound_displaytext_contains_only_caps (ACTIVE by default). This rule enables us to block more invoice phishing attacks.

Available via upgrade

• [SA-15732] MTA: Improve the detection of auto-generated emails.

• [SA-15333] Rules: Add new high-confidence rules (ACTIVE by default):

  • PHISHING_only_inbound_displayname_matches_keyword_subject_urgent addresses phishing cases that create a sense of urgency.
  • PHISHING_only_inbound_non_reputable_displayname_matches_partner_link_mismatch catches phishing cases with mismatched links in the name of a partner organization.
  • PHISHING_topic_invoice_only_inbound_non_reputable_displayname_popular_or_partner_or_guarded addresses invoice phishing in the name of partner organizations.
• [SA-15393] Rules: Add new high-confidence rule SPAM_nonreputable_young_domain_new_link_dangerous_file_type_subject_phishing_keyword (ACTIVE by default). This rule improves spam detection for emails from non-reputable senders with dubious links.
• [SA-15444] Rules: Add new high-confidence rules PHISHING_topic_invoice_only_inbound_display_text_phishing_keywords and SPAM_freemail_only_inbound_calendar_file_suspicious_link (ACTIVE by default). The rules catch cases of invoice phishing and calendar invite spam.
• [SA-15526] Rules: Add a new high-confidence rule SPAM_topic_invoice_only_inbound_non_reputable_public_suffix_no_reputation (ACTIVE by default). This rule targets unwanted mails inquiring about the status of an invoice.

• [SA-15569] Rules: Add a set of new rules (all ACTIVE by default)

  • PHISHING_ml_matches_guarded_name_file: Targets phishing attacks impersonating a guarded sender.
  • SPAM_topic_invoice_untrusted_sender_only_inbound_link_count_suspicious_is_exactly_one: Targets link-based phishy spam talking about invoices.
  • PHISHING_body_matches_popular_service_urgency_invoice: Targets invoice phishing attacks impersonating a popular service.
  • EXTORTION_untrusted_sender_only_inbound_multiple_extortion_keywords_not_file_not_link: Targets extortion attacks where there's no link or attachment.
• [SA-15702] Rules: Add new high-confidence rule SPAM_untrusted_only_inbound_replyto_not_from_displayname_matches_popular_service_non_configured_ccsend (ACTIVE by default). This rule improves spam detection for ccsend abusers.

Available via upgrade

• [SA-15445] UI: Fix a bug that prevented to perform bulk actions to the current message in the similar tab.
• [SA-15550] MTA, XCC: Fix issue where mails would be stuck in publishing because of excessively large message-id mail headers.
• [SA-15554] XCC: Remove the non-functional auto completion suggestion file.type:mail.
• [SA-15647] UI: Fix the search in the Actions page.

• [SA-13856] Rules: Improved newsletter detection heuristics.

• [SA-15333] Rules: Add new high-confidence rules (ACTIVE by default):

  • PHISHING_only_inbound_displayname_matches_keyword_subject_urgent addresses phishing cases that create a sense of urgency.
  • PHISHING_only_inbound_non_reputable_displayname_matches_partner_link_mismatch catches phishing cases with mismatched links in the name of a partner organization.
  • PHISHING_topic_invoice_only_inbound_non_reputable_displayname_popular_or_partner_or_guarded addresses invoice phishing in the name of partner organizations.
• [SA-15393] Rules: Add new high-confidence rule SPAM_nonreputable_young_domain_new_link_dangerous_file_type_subject_phishing_keyword (ACTIVE by default). This rule improves spam detection for emails from non-reputable senders with dubious links.
• [SA-15444] Rules: Add new high-confidence rules PHISHING_topic_invoice_only_inbound_display_text_phishing_keywords and SPAM_freemail_only_inbound_calendar_file_suspicious_link (ACTIVE by default). The rules catch cases of invoice phishing and calendar invite spam.
• [SA-15462] Rules: Add new high-confidence rule SPAM_cloudmailer_only_inbound_non_reputable_reply_to_not_from (ACTIVE by default). This rule addresses spam emails attachments of forged catalogs for used cars and machines.
• [SA-15508] Rules: Add new high-confidence rule PHISHING_topic_account_issue_invoice_marketing_non_reputable_reply_to_not_from (ACTIVE by default). This rule addresses phishing cases that are sent through marketing cloud mailers.
• [SA-15526] Rules: Add a new high-confidence rule SPAM_topic_invoice_only_inbound_non_reputable_public_suffix_no_reputation (ACTIVE by default). This rule targets unwanted mails inquiring about the status of an invoice.

• [SA-15569] Rules: Add a set of new rules (all ACTIVE by default)

  • PHISHING_ml_matches_guarded_name_file: Targets phishing attacks impersonating a guarded sender.
  • SPAM_topic_invoice_untrusted_sender_only_inbound_link_count_suspicious_is_exactly_one: Targets link-based phishy spam talking about invoices.
  • PHISHING_body_matches_popular_service_urgency_invoice: Targets invoice phishing attacks impersonating a popular service.
  • EXTORTION_untrusted_sender_only_inbound_multiple_extortion_keywords_not_file_not_link: Targets extortion attacks where there's no link or attachment.
• [SA-15702] Rules: Add new high-confidence rule SPAM_untrusted_only_inbound_replyto_not_from_displayname_matches_popular_service_non_configured_ccsend (ACTIVE by default). This rule improves spam detection for ccsend abusers.

Available via upgrade

• [SA-13856] Rules: Improved newsletter detection heuristics.
• [SA-15462] Rules: Add new high-confidence rule SPAM_cloudmailer_only_inbound_non_reputable_reply_to_not_from (ACTIVE by default). This rule addresses spam emails attachments of forged catalogs for used cars and machines.
• [SA-15508] Rules: Add new high-confidence rule PHISHING_topic_account_issue_invoice_marketing_non_reputable_reply_to_not_from (ACTIVE by default). This rule addresses phishing cases that are sent through marketing cloud mailers.

Available via upgrade

[SA-15506] XCC: Fix permission issue during auto host migration which prevented the upgrade from versions prior to 10.0.8.

• [SA-14856] Rules: Improved newsletter detection heuristics.
• [SA-15107] Rules: Add new high-confidence rule SPAM_ml_popular_displayname (ACTIVE by default). This rule catches spam sent in the name of popular brands.
• [SA-15258] Rules: Add new high-confidence rule PHISHING_untrusted_only_inbound_non_reputable_sender_contains_guarded_doc_link (ACTIVE by default). This rule improves our ability to block phishing emails, where the attachment contains a document phishing link.
• [SA-15340] Rules: Detect MS Office vulnerability CVE-2026-21509 with a new YARA rule YARA_cve_2026_21509 (ACTIVE by default). Matches can be found by searching for the tag #cve_2026_21509 after the upgrade. This rule catches documents that might exploit CVE-2026-21509.
• [SA-15364] Rules: Add new high-confidence rule PHISHING_topic_package_delivery_only_inbound_non_reputable_reply_to_not_from (ACTIVE by default). This rule catches package-delivery phishing with reply-to address mismatches.
• [SA-15456] Rules: Add new high-confidence rule PHISHING_cloud_mailer_non_reputable_only_inbound_display_text_signature_keyword (ACTIVE by default). This rule catches document review and document signing phishing.
• [SA-15475] Rules: Mark the rule BEC_html_with_script_small_phishy_body_and_subject as PASSIVE to avoid false positives.

Available via upgrade

• [SA-15408] MTA: Lower log level when email address parsing fails in specific cases when running in monitoring mode.
• [SA-15409] XCC: Fix issue causing the upgrade script to fail attempting to commit configuration changes.
• [SA-15353] UI: Fix a bug where a page error is displayed when trying to load more results and an invalid query was typed.

• [SA-14856] Rules: Improved newsletter detection heuristics.
• [SA-15107] Rules: Add new high-confidence rule SPAM_ml_popular_displayname (ACTIVE by default). This rule catches spam sent in the name of popular brands.
• [SA-15258] Rules: Add new high-confidence rule PHISHING_untrusted_only_inbound_non_reputable_sender_contains_guarded_doc_link (ACTIVE by default). This rule improves our ability to block phishing emails, where the attachment contains a document phishing link.
• [SA-15340] Rules: Detect MS Office vulnerability CVE-2026-21509 with a new YARA rule YARA_cve_2026_21509 (ACTIVE by default). Matches can be found by searching for the tag #cve_2026_21509 after the upgrade. This rule catches documents that might exploit CVE-2026-21509.
• [SA-15364] Rules: Add new high-confidence rule PHISHING_topic_package_delivery_only_inbound_non_reputable_reply_to_not_from (ACTIVE by default). This rule catches package-delivery phishing with reply-to address mismatches.
• [SA-15456] Rules: Add new high-confidence rule PHISHING_cloud_mailer_non_reputable_only_inbound_display_text_signature_keyword (ACTIVE by default). This rule catches document review and document signing phishing.
• [SA-15475] Rules: Mark the rule BEC_html_with_script_small_phishy_body_and_subject as PASSIVE to avoid false positives.

Available via upgrade

• [SA-15353] UI: Fix a bug where a page error is displayed when trying to load more results and an invalid query was typed.

• [SA-15251] Rules: Add new high confidence rules (ACTIVE by default):

  • SPAM_ml_calendar_file for catching attacks based on calendar invites.
  • PHISHING_only_inbound_non_reputable_qr_code_link_and_keywords_html_body_with_data_url for catching QR code phishing attacks.
  • PHISHING_only_inbound_non_reputable_voicemail_keywords for catching voicemail phishing attacks.
  • PHISHING_topic_account_issue_only_inbound_non_reputable_in_file for catching account issue phishing attacks.

Available via upgrade

• [SA-15338] MTA: Fix issue where recipient-based tenant assignment would not honor the recipientRetrievalStrategy configuration.
• [SA-15293] UI: Fixed issue causing setting wrong classification and template selection data when resolving cases and creating campaigns.
• [SA-15372] UI: Fixed issue which caused wrong number formatting on Firefox.
• [SA-15356] XCC: Standardized timezone handling. The xcc_backend container now uses UTC by default, which may affect log timestamps.

• [SA-15251] Rules: Add new high confidence rules (ACTIVE by default):

  • SPAM_ml_calendar_file for catching attacks based on calendar invites.
  • PHISHING_only_inbound_non_reputable_qr_code_link_and_keywords_html_body_with_data_url for catching QR code phishing attacks.
  • PHISHING_only_inbound_non_reputable_voicemail_keywords for catching voicemail phishing attacks.
  • PHISHING_topic_account_issue_only_inbound_non_reputable_in_file for catching account issue phishing attacks.

Available via upgrade

• [SA-14255] Rules: Fixed a bug where senders added to the medium/high trust list while using a cloud mailer were still incorrectly treated as low-trusted.
• [SA-15161] Rules: Add new high-confidence rule PHISHING_topic_account_issue_package_delivery_cloudmailer_replyto_freemail (ACTIVE by default). This rule catches phishing attempts claiming an issue with the target's account.

• [SA-15209] Rules: Add two new high-confidence rules (ACTIVE by default). The rules block popular service impersonations and document signing phishing:

  • SPAM_untrusted_only_inbound_displayname_popular_suspicious_link_with_path_part
  • PHISHING_untrusted_non_reputable_document_signature_keywords_with_data_url

Available via upgrade

• [SA-15007] MTA: Fix Postfix exporter label format in alerts for monitored_mta:

  • The values for the metrics label le were changed from integral to decimal numbers. For example, the value 10 was changed to 10.0. This prevents previous value selectors, such as le="10" from matching any value. It has to be migrated to le="10.0".
  • An automatic migration will update these values in the file /monitored_mta/prometheus/alert/activeguard_alerts.yml.
  • However, if your instance has manual modifications in this file, then manual updates might be required. The migration only modifies values that were shipped with the original installation.
• [SA-15204] MTA: Fix issue where yaml files in expert editor path /shared/email_templates/style/ where not properly validated.
• [SA-15255] MTA: Fix issue where a software module was initialized too late. This would lead to unexpected problem when recovering unfinished messages from before a shutdown.
• [SA-15241] UI: Fix a bug where a saved search could not show the checkboxes in some cases.
• [SA-15282] UI: Fix issue that prevented to show current set action for a campaign and that accidentally sent feedbacks even if set otherwise.
• [SA-15284] XCC: Fix an issue which led to errors, when an analyst tried to bulk release a message for which user already requested a release.

• [SA-14255] Rules: Fixed a bug where senders added to the medium/high trust list while using a cloud mailer were still incorrectly treated as low-trusted.
• [SA-15161] Rules: Add new high-confidence rule PHISHING_topic_account_issue_package_delivery_cloudmailer_replyto_freemail (ACTIVE by default). This rule catches phishing attempts claiming an issue with the target's account.

• [SA-15209] Rules: Add two new high-confidence rules (ACTIVE by default). The rules block popular service impersonations and document signing phishing:

  • SPAM_untrusted_only_inbound_displayname_popular_suspicious_link_with_path_part
  • PHISHING_untrusted_non_reputable_document_signature_keywords_with_data_url

Available via upgrade

• [SA-15241] UI: Fix a bug where a saved search could not show the checkboxes in some cases.

• [SA-14745] Rules: Add new high-confidence rules PHISHING_topic_account_issue_invoice_only_inbound_displayname_popular and PHISHING_only_inbound_non_reputable_links_popular_displayname (ACTIVE by default) to catch new phishing waves using forged notification emails in the name of popular services.
• [SA-15159] Rules: Add new high-confidence rule SPAM_only_inbound_bcc_only_forwarded_reply_to (ACTIVE by default). This rule blocks spam mails forwarded through another service, such as Gmail.
• [SA-15227] Rules: Add new high-confidence rule PHISHING_popular_auth_bcc_only_env_from_non_configured_m365_domain (ACTIVE by default). This rule blocks phishing mails forwarded through Microsoft infrastructure.

Available via upgrade

• [SA-15116] MTA, XCC: Fix issue where a configuration change in monitoring would not cause a hot-reload of the configuration.
• [SA-15180] MTA: Fix problem where results are not properly published in case a tenant was deleted while processing a message.
• [SA-15250] MTA, XCC: Address multiple CVEs in OpenSSL, such as CVE-2025-15467.
• [SA-15144] UI: Change the Release icon in the Quarantine portal, which was the old icon used for Releasing a message.

• [SA-14745] Rules: Add new high-confidence rules PHISHING_topic_account_issue_invoice_only_inbound_displayname_popular and PHISHING_only_inbound_non_reputable_links_popular_displayname (ACTIVE by default) to catch new phishing waves using forged notification emails in the name of popular services.
• [SA-15159] Rules: Add new high-confidence rule SPAM_only_inbound_bcc_only_forwarded_reply_to (ACTIVE by default). This rule blocks spam mails forwarded through another service, such as Gmail.
• [SA-15227] Rules: Add new high-confidence rule PHISHING_popular_auth_bcc_only_env_from_non_configured_m365_domain (ACTIVE by default). This rule blocks phishing mails forwarded through Microsoft infrastructure.

Available via upgrade

• [SA-15250] MTA, XCC: Address multiple CVEs in OpenSSL, such as CVE-2025-15467.

• [SA-15055] Rules: Add a new high-confidence rule PHISHING_only_inbound_cloudmailer_high_to_address_count_replyto_not_from (ACTIVE by default). This rule addresses a wave of phishing delivered through reputable cloud mailers.

• [SA-15068] Rules: Add 2 new high confidence rules (ACTIVE by default). Both rules target phishing, where the attacker misused cloud mailer infrastructure:

  • PHISHING_topic_account_issue_package_delivery_replyto_domain_not_equal_from_domain_cloudmailer
  • PHISHING_untrusted_replyto_domain_not_equal_from_domain_sender_account_name_character_count_gt_25
• [SA-15022][SA-15108] Rules: Add new high-confidence BEC rules BEC_cloudstorage_new_domain_multiple_document_signature_keywords and BEC_bcc_only_document_signature_keywords_all_caps_displaytext (ACTIVE by default). Both rules address attacks sent from compromised accounts.
• [SA-15134] Rules: Add a new high-confidence rule PHISHING_no_auth_no_reputable_link_displayname_or_subject_popular_or_guarded_urgency_keywords (ACTIVE by default). This rule addresses phishing from unauthenticated senders that try to appear as a popular service or an organization-internal sender.
• [SA-15155][SA-14991] Rules: Add new high-confidence rule PHISHING_topic_invoice_untrusted_domain_only_inbound_to_address_type_count_large (ACTIVE by default). This rule improves our ability to detect and block invoice phishing.

Available via upgrade

• [SA-14916] MTA: Do not send encrypted attachments to the text extraction service.
• [SA-15003] MTA: Fix "Postfix down" alerts, postfix_exporter now restarts unhealthy log sources.
• [SA-15074] UI: Fixed wrong update of the URL parameters when removing the last active search filter.
• [SA-14906] XCC: Fix issue which prevented the proxy configuration from being applied in m365GraphApi.
• [SA-15071] XCC: Fix for missing updates to counters and models when a quarantine release request gets approved.

• [SA-15055] Rules: Add a new high-confidence rule PHISHING_only_inbound_cloudmailer_high_to_address_count_replyto_not_from (ACTIVE by default). This rule addresses a wave of phishing delivered through reputable cloud mailers.

• [SA-15068] Rules: Add 2 new high confidence rules (ACTIVE by default). Both rules target phishing, where the attacker misused cloud mailer infrastructure:

  • PHISHING_topic_account_issue_package_delivery_replyto_domain_not_equal_from_domain_cloudmailer
  • PHISHING_untrusted_replyto_domain_not_equal_from_domain_sender_account_name_character_count_gt_25
• [SA-15022][SA-15108] Rules: Add new high-confidence BEC rules BEC_cloudstorage_new_domain_multiple_document_signature_keywords and BEC_bcc_only_document_signature_keywords_all_caps_displaytext (ACTIVE by default). Both rules address attacks sent from compromised accounts.
• [SA-15134] Rules: Add a new high-confidence rule PHISHING_no_auth_no_reputable_link_displayname_or_subject_popular_or_guarded_urgency_keywords (ACTIVE by default). This rule addresses phishing from unauthenticated senders that try to appear as a popular service or an organization-internal sender.
• [SA-15155][SA-14991] Rules: Add new high-confidence rule PHISHING_topic_invoice_untrusted_domain_only_inbound_to_address_type_count_large (ACTIVE by default). This rule improves our ability to detect and block invoice phishing.

Available via upgrade

• [SA-14916] MTA: Do not send encrypted attachments to the text extraction service.
• [SA-14906] XCC: Fix issue which prevented the proxy configuration from being applied in m365GraphApi.
• [SA-15071] XCC: Fix for missing updates to counters and models when a quarantine release request gets approved.

• [SA-14993] Rules: Add new high-confidence rule PHISHING_untrusted_only_inbound_cloud_mailer_subject_guarded_document_signature_keywords (ACTIVE by default) to catch phishing attempts claiming to share an internal document.
• [SA-14997] Rules: Add new high-confidence rule PHISHING_no_auth_new_domain_phishy_displayname (ACTIVE by default) to catch more phishing sent by unauthenticated senders.
• [SA-15018] Rules: Add new high-confidence rule PHISHING_untrusted_common_phishing_link_displayname_popular_phishing_keywords (ACTIVE by default) to block emails that promise a free gift in the name of a popular brand.
• [SA-15026] Rules: Add new high-confidence rule PHISHING_untrusted_only_inbound_subject_guarded_multiple_keywords (ACTIVE by default) to address more phishing cases that claim to share an internal document.
• [SA-15056] Rules: Add new high-confidence rule PHISHING_google_application_integration (ACTIVE by default). This rule blocks a new attack, coming from an authenticated Google Application Integration service.
• [SA-15064] Rules: Add new high-confidence rule PHISHING_only_inbound_html_mostly_image_test_subject (ACTIVE by default). This rule blocks a wave of AI-translated Swiss German phishing cases.
• [SA-15070] Rules: Require an untrusted sender for the rule PHISHING_nonreputable_sender_unknown_never_delivered_urgency_keywords_suspicious_link to trigger. Adding a specific sender to the low-trusted sender list now prevents this rule from triggering.

Available via upgrade

• [SA-14782] UI: Fix a bug where the filters could change position when adding a new filter.
• [SA-14878] UI: Fix an issue where the selected tenant resets when navigating to specific configuration in the admin section.
• [SA-14971] UI: Improve the Expert Editor dialogs by avoiding scrollbars for long filenames.
• [SA-14926] UI: Disable similar content filter menu item when the suggested filter is present.
• [SA-14998] UI: The verdicts and status search fields are now auto-focused when opening the filter.
• [SA-15029] UI: Fix a bug where the comment was sent even if "No Feedback" option was selected in resolve dialog.
• [SA-14746] XCC: Prevent error log in case of insufficient permissions while using auto-login links.
• [SA-14795] XCC: Improvements around the DB queries for messages scheduled for deletion.
• [SA-15003] MTA: Fix mail log rotation to avoid postfix down alerts.
• [SA-15091] MTA: Fix out of bounds access when processing sudomain provider lists.

• [SA-14993] Rules: Add new high-confidence rule PHISHING_untrusted_only_inbound_cloud_mailer_subject_guarded_document_signature_keywords (ACTIVE by default) to catch phishing attempts claiming to share an internal document.
• [SA-14997] Rules: Add new high-confidence rule PHISHING_no_auth_new_domain_phishy_displayname (ACTIVE by default) to catch more phishing sent by unauthenticated senders.
• [SA-15018] Rules: Add new high-confidence rule PHISHING_untrusted_common_phishing_link_displayname_popular_phishing_keywords (ACTIVE by default) to block emails that promise a free gift in the name of a popular brand.
• [SA-15026] Rules: Add new high-confidence rule PHISHING_untrusted_only_inbound_subject_guarded_multiple_keywords (ACTIVE by default) to address more phishing cases that claim to share an internal document.
• [SA-15056] Rules: Add new high-confidence rule PHISHING_google_application_integration (ACTIVE by default). This rule blocks a new attack, coming from an authenticated Google Application Integration service.
• [SA-15064] Rules: Add new high-confidence rule PHISHING_only_inbound_html_mostly_image_test_subject (ACTIVE by default). This rule blocks a wave of AI-translated Swiss German phishing cases.
• [SA-15070] Rules: Require an untrusted sender for the rule PHISHING_nonreputable_sender_unknown_never_delivered_urgency_keywords_suspicious_link to trigger. Adding a specific sender to the low-trusted sender list now prevents this rule from triggering.

Available via upgrade

• [SA-14746] XCC: Prevent error log in case of insufficient permissions while using auto-login links.
• [SA-14795] XCC: Improvements around the DB queries for messages scheduled for deletion.
• [SA-15091] MTA: Fix out of bounds access when processing sudomain provider lists.

Warning

Update recommended

We recommend to update to 9.0.7 (or any 10.0.X version) as soon as possible due to SA-15030. This fixes a critical vulnerability in a third party library (Tika) that is used on the MTA.

Rolled out via xCloud

• [SA-14399] Rules: Add new PHISHING_untrusted_only_inbound_document_signature_keywords_link_with_no_reputation (ACTIVE by default). This rule will catch more document signature phishing.
• [SA-14855] Rules: Add new high-confidence rule SPAM_ml_untrusted_only_inbound_non_reputable_link (ACTIVE by default) to block more spam.
• [SA-14932] Rules: Add high confidence rule PHISHING_topic_invoice_matches_office_interaction_document_signature_keyword (ACTIVE by default). This rule blocks more invoice phishing, where the attack is attached as an office document.
• [SA-14944] Rules: Add new high-confidence rule PHISHING_sender_unknown_never_delivered_cloud_mailer_displayname_popular (ACTIVE by default) to block phishing mails sent through reputable cloud services.
• [SA-14959] Rules: Add new high-confidence rule PHISHING_sender_unknown_never_delivered_cloud_mailer_displayname_popular (ACTIVE by default) to block phishing mails disguised as bounce messages.
• [SA-15005] Rules: Add new high-confidence rule PHISHING_untrusted_nonreputable_body_matches_voicemail_password_popular_guarded_email (ACTIVE by default). The rule catches more voice mail phishing impersonating popular services.
• [SA-15024] Rules: Fix for a missing space in default subject rewrites. An earlier update introduced a bug where subject rewrites were missing the space between the prefix and the subject. E.g., the subject would become [SPAM]Subject instead of [SPAM] Subject.

Available via upgrade

• [SA-15006] MTA: Address changed metric label, affecting the Postfix queue size alert and the MTA monitoring dashboard.
• [SA-15030] MTA: Address critical CVEs (CVE-2025-54988, CVE-2025-66516) in Tika.
• [SA-13868] XCC: Avoid updating the relationship score when a campaign is set up to deliver the message with a malicious verdict. This avoids the build-up of trust for campaigns that, e.g., only do a subject rewrite instead of quarantining the messages.
• [SA-14864] XCC: Prevent error log on case isolation when repeatedly trying to isolate a message.

• [SA-14399] Rules: Add new PHISHING_untrusted_only_inbound_document_signature_keywords_link_with_no_reputation (ACTIVE by default). This rule will catch more document signature phishing.
• [SA-14855] Rules: Add new high-confidence rule SPAM_ml_untrusted_only_inbound_non_reputable_link (ACTIVE by default) to block more spam.
• [SA-14932] Rules: Add high confidence rule PHISHING_topic_invoice_matches_office_interaction_document_signature_keyword (ACTIVE by default). This rule blocks more invoice phishing, where the attack is attached as an office document.
• [SA-14944] Rules: Add new high-confidence rule PHISHING_sender_unknown_never_delivered_cloud_mailer_displayname_popular (ACTIVE by default) to block phishing mails sent through reputable cloud services.
• [SA-14959] Rules: Add new high-confidence rule PHISHING_sender_unknown_never_delivered_cloud_mailer_displayname_popular (ACTIVE by default) to block phishing mails disguised as bounce messages.
• [SA-15005] Rules: Add new high-confidence rule PHISHING_untrusted_nonreputable_body_matches_voicemail_password_popular_guarded_email (ACTIVE by default). The rule catches more voice mail phishing impersonating popular services.
• [SA-15024] Rules: Fix for a missing space in default subject rewrites. An earlier update introduced a bug where subject rewrites were missing the space between the prefix and the subject. E.g., the subject would become [SPAM]Subject instead of [SPAM] Subject.

Available via upgrade

• [SA-14999] MTA: Prepare MTAs for the upcoming release-11 trust model changes.
• [SA-15006] MTA: Address changed metric label, affecting the Postfix queue size alert and the MTA monitoring dashboard.
• [SA-12808] XCC: Mail header additions triggered via rules are now mentioned in the detail view in tab Classifiers & Rules.
• [SA-14864] XCC: Prevent error log on case isolation when repeatedly trying to isolate a message.
• [SA-13868] XCC: Avoid updating the relationship score when a campaign is set up to deliver the message with a malicious verdict. This avoids the build-up of trust for campaigns that, e.g., only do a subject rewrite instead of quarantining the messages.
• [SA-14864] XCC: Improve error message when quarantine release fails in SSQ portal.

• [SA-12158] Rules: Add new high-confidence rules SPAM_topic_sexual_content_package_delivery_non_reputable_links and SPAM_ml_adult_keywords_non_reputable_links_state (ACTIVE by default). Additionally, broaden the existing SPAM_ml_topic_sexual_content rule and improve ADAPT_spam_confidence_low_image_only. These changes help with catching ongoing spam waves that promote adult products.
• [SA-14155] Rules: Add new high-confidence rule PHISHING_reputable_freemail_forged_reply_to_shortened_embedded_link (ACTIVE by default) to catch more phishing sent via reputable services.
• [SA-14443] Rules: Add new high-confidence rule SPAM_untrusted_non_reputable_only_inbound_very_young_sender (ACTIVE by default) to block spam from newly registered domains.
• [SA-14443] Rules: Disable PHISHING_common_domains as it is redundant with other rules.
• [SA-14778] Rules: Add new high-confidence rule PHISHING_topic_package_delivery_untrusted_sender_only_inbound_one_suspicious_link (ACTIVE by default). This rule improves our ability to block package delivery phishing.
• [SA-14847] Rules: Add new high-confidence rule PHISHING_address_parsing_error_matches_phishing_keyword_no_auth (ACTIVE by default). The rule blocks more unauthenticated phishing.
• [SA-14868] Rules: Add new high-confidence rule PHISHING_sender_is_social_network_subject_matches_urgency_multiple_phishing_keywords (ACTIVE by default). This rule improves our ability to block phishing attacks sent from legit Meta infrastructure.
• [SA-14903] Rules: Add new high-confidence rule SPAM_untrusted_non_reputable_domain_only_inbound_link_without_dns (ACTIVE by default). The rule catches spam waves that attempt to evade detection by making the link domain resolve only after delivery.

Available via upgrade

• [SA-14850] XCC: Intermediate validation errors in auth.yml triggered via expert configuration editor should not be logged as ERROR.
• [SA-14852] MTA: Extract a few more relevant properties from iCalendar files. With the additional properties, we can better detect calendar invite impersonation.
• [SA-14904] MTA: Add attribute pipeline to audit log message types: trace.msg_analysis.start, trace.msg_analysis.resume, trace.msg_analysis.complete, trace.msg_verdict.
• [SA-14907] MTA, XCC: Upgrade containerd to address runC vulnerability CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881.
• [SA-14561] UI: In the authentication status next to the FROM address, avoid showing failed or passed checks that did not directly contribute to the authentication status of the FROM address. The previous behavior lead to confusion about the exact reason why the FROM is considered authenticated or not.
• [SA-14885] UI: Fix an issue that automatically unticked the Rerpot Misclassification checkbox when writing a comment in the resolve dialog.
• [SA-14913] UI: Fix issue that made the time range selection date-picker to be mis-placed when choosing a custom date.
• [SA-14946] UI: Fix an issue where the empty state in Abuse mailbox card was not centered.

• [SA-12158] Rules: Add new high-confidence rules SPAM_topic_sexual_content_package_delivery_non_reputable_links and SPAM_ml_adult_keywords_non_reputable_links_state (ACTIVE by default). Additionally, broaden the existing SPAM_ml_topic_sexual_content rule and improve ADAPT_spam_confidence_low_image_only. These changes help with catching ongoing spam waves that promote adult products.
• [SA-14155] Rules: Add new high-confidence rule PHISHING_reputable_freemail_forged_reply_to_shortened_embedded_link (ACTIVE by default) to catch more phishing sent via reputable services.
• [SA-14443] Rules: Add new high-confidence rule SPAM_untrusted_non_reputable_only_inbound_very_young_sender (ACTIVE by default) to block spam from newly registered domains.
• [SA-14443] Rules: Disable PHISHING_common_domains as it is redundant with other rules.
• [SA-14778] Rules: Add new high-confidence rule PHISHING_topic_package_delivery_untrusted_sender_only_inbound_one_suspicious_link (ACTIVE by default). This rule improves our ability to block package delivery phishing.
• [SA-14847] Rules: Add new high-confidence rule PHISHING_address_parsing_error_matches_phishing_keyword_no_auth (ACTIVE by default). The rule blocks more unauthenticated phishing.
• [SA-14868] Rules: Add new high-confidence rule PHISHING_sender_is_social_network_subject_matches_urgency_multiple_phishing_keywords (ACTIVE by default). This rule improves our ability to block phishing attacks sent from legit Meta infrastructure.
• [SA-14903] Rules: Add new high-confidence rule SPAM_untrusted_non_reputable_domain_only_inbound_link_without_dns (ACTIVE by default). The rule catches spam waves that attempt to evade detection by making the link domain resolve only after delivery.

Available via upgrade

• [SA-14850] XCC: Intermediate validation errors in auth.yml triggered via expert configuration editor should not be logged as ERROR.
• [SA-14561] UI: In the authentication status next to the FROM address, avoid showing failed or passed checks that did not directly contribute to the authentication status of the FROM address. The previous behavior lead to confusion about the exact reason why the FROM is considered authenticated or not.
• [SA-14907] MTA, XCC: Upgrade containerd to address runC vulnerability CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881.

• [SA-11326] Rules: Add new PHISHING_ml_sender_account_name_character_count_large_document_signature_keyword (ACTIVE by default). This rule will catch more document signature phishing.
• [SA-11326] Rules: Update SPAM_ml_young_sender to catch even more spam from young senders.
• [SA-14839] Rules: Re-enable #malware and #exploit for use in campaigns.

Available via upgrade

• [SA-14800] XCC: Fix issue where messages with recipients containing = characters would end up in state SMTP ERROR even though they were delivered successfully.
• [SA-14802] XCC: Fix issue which prevented users with global analyst permissions to see quarantines specified outside of the tenant they are belonging to.
• [SA-14813] XCC: Fixed issue that moved signed received headers at the top of the headers list.
• [SA-14786] MTA: Fix issue when calculating result_publish_latency while changing the time zone offset (daylight saving time). When applied, this bugfix may cause the metric to temporarily spike..
• [SA-14792] MTA, XCC: Fix issue preventing us from displaying rDNS information when it would be available.
• [SA-14820] MTA: Fix issue where a special payload could trigger an out of memory situation, forcing Core to restart.
• [SA-14832] MTA, XCC: Upgrade Docker Compose to address CVE-2025-62725.
• [SA-14835] MTA: Fix issue where lengthy pipeline repository init fails leaving the system with no working scan pipelines.
• [SA-14827] MTA: Improve error handling fo results in case of an abrupt shutdown.
• [SA-14843] MTA: Improve error handling for results which can not be published to xcc.