UpGuard release notes

Vendor Risk users can now store every third party in UpGuard, whether or not it is being monitored. Low-risk, rejected, retired and not-yet-assessed vendors sit alongside monitored vendors in a single list, so the vendor inventory no longer depends on spreadsheets or procurement systems to be complete. Non-monitored vendors keep their labels, tier, attributes and intake form, and can be promoted to monitored when a full assessment or continuous scanning is needed. Available on all paid plans. To learn more see Vendor Risk non-monitored vendors.

Security Profile assessment scoring improved

The Security Profile assessment rating has been improved to better weigh a vendor’s risks against how many checks they pass and how much evidence they’ve provided. Vendors who share more evidence get credit for the checks they pass, not just a deduction for every risk found. Existing published Security Profile risk assessment reports keep their previous score.

90 new experimental API endpoints

Security teams can now automate more of the UpGuard platform with 90 new API endpoints spanning Vendor Risk, Breach Risk, User Risk, Trust Exchange, and account administration. Highlights include:

• Managing vendor risk waivers and approvals
• Sending custom questionnaires and managing remediation requests
• A change feed across an organization’s monitored vendors
• Threat Monitoring auto-close rules
• Listing UpGuard users and roles for access reviews

These endpoints are currently released as experimental APIs and available upon request, and customer feedback will shape them as they move toward general availability. Customers can contact their Customer Success Manager for access.

Nudge and block counts for applications in User Risk

User Risk administrators can now see how many nudges and blocks an application or a user has triggered in the last 30 days. Open an application to see which of its users received nudges and blocks, then select a user to see the details of each event. The user list shows the same activity for every user.

PHP2Shell incident response questionnaire for vendors

Vendor Risk users can now send a PHP2Shell incident response questionnaire to vendors from the questionnaire library. Scanning identifies which vendors have the vulnerability, then this questionnaire covers where PHP is in use across their own and provider-run systems, the status and timeliness of patching, and whether exploitation could or has affected customer data or credentials. This questionnaire is recommended for all vendors that have the vulnerability, all critical vendors, and all vendors with your organization’s sensitive data.

Assign questions to specific users in Trust Exchange questionnaires

Trust Exchange users can now assign individual questions, or a whole section, to one or more collaborators when completing a questionnaire. Assigning a question to someone who is not yet a collaborator invites them. A new assignee filter in the questionnaire side panel shows each person the questions they own, and assignments appear in the questionnaire timeline. Recipients can also send private messages to each other within a questionnaire and use @mentions in questionnaire messages to tag recipients and senders.

Security Profile views by framework in Trust Exchange

Trust Exchange users can now filter their Security Profile by compliance framework, with ISO 27001:2022 and NIST CSF available, to see which controls their profile covers and where gaps remain.

Other improvements

• Vendor Risk and Breach Risk scans now detect UniFi OS hosts vulnerable to CVE-2026-34908, an improper access control vulnerability that enables unauthenticated remote code execution, together with CVE-2026-34909 (path traversal) and CVE-2026-34910 (improper input validation), which share the same patch. When these are chained together, they can be used to achieve an unauthenticated remote code execution on a host.
• User Risk administrators can now customize the nudge and block text shown to users.
• Trust Center access tables can now be sorted by column on the organisations tab.

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of critical PHP vulnerabilities disclosed this week. They let an unauthenticated attacker run code on a vulnerable web server. The real concern is how far back they go. Every version from PHP 5.4.0, released in 2012, up to 8.2.34 is affected, along with 8.3.0 to 8.3.35, 8.4.0 to 8.4.26 and 8.5.0 to 8.5.11. Fixes are available in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 5.x, 7.x, 8.0 and 8.1 are end-of-life and won’t get a fix, so anything still running those versions needs a major upgrade. Workarounds are circulating, however official advice from PHP is that upgrading is the only reliable fix.

UpGuard has added both CVEs as verified vulnerabilities in Breach Risk and Vendor Risk. Detection is based on the PHP version, so any domain or IP running an affected version gets flagged. Security teams can see where their organization and their vendors are potentially exposed and prioritize patching and remediation requests.

When users mark an exposed credential threat in Threat Monitoring as Remediated or No action needed, they can now close every other open exposed credential threat for the same username and URL at the same time. This removes the need to work through duplicate detections one by one, so the queue stays focused on threats that still need attention.

Other improvements

• The Breach Risk Executive Summary now shows company details (market cap, revenue, employees and location) and includes the industry selector, so changing the industry updates the rating comparison in both the Executive Summary and the Risk Profile.
• Vendor Risk users can now sort onboarding requests by a new Assigned to column. The column also appears in Excel exports and the API.

When a Security Profile answer cites a vendor’s SOC 2 report, the citation can now include the control reference (for example, CC 1.3) alongside the quoted text. Users can go straight to the relevant control in the source document and see which audit principle the evidence relates to. Coverage includes SOC 2 control references and similar numbered control formats.

More vendor evidence added to the Security Profile

Security Profiles now include 385 additional public documents for top monitored vendors. The documents are available as evidence in Vendor Risk and have been pre-scanned against the Security Profile, so users spend less time chasing evidence and can start assessing vendors sooner.

Questionnaire and contact endpoints now generally available in the Vendor Risk API

The List all questionnaires endpoint, together with Add collaborator, Add recipient, and Delete contacts, has moved to general availability. List all questionnaires returns every questionnaire across an organization in one call. Add recipient and Add collaborator invite people to a questionnaire or onboarding request after it has been sent. Delete contact removes a vendor contact, completing the set alongside the Add and Update endpoints so vendor onboarding can run end to end through the API.

Vulnerability detections for three new CVEs

UpGuard has added detections for three vulnerabilities. CVE-2026-35292 is an unauthenticated takeover of Oracle WebLogic Server Console, exploitable over HTTP (CVSS 10.0), affecting versions 14.1.2.0.0 and 15.1.1.0.0. CVE-2026-19490 is an authentication bypass using an alternate path or channel in NetScaler ADC and Gateway, affecting 13.1 builds 63.21 and earlier and 14.1 builds 73.32 and earlier. CVE-2022-27486 is an OS command injection in the FortiDDoS and FortiDDoS-F execute CLI commands that lets an authenticated attacker run shell code as root. Each detection raises a verified vulnerability in Breach Risk for an organization’s own assets and in Vendor Risk for monitored vendors.

Threat Monitoring no longer stops at the individual threat. When a scan and analysis completes, the Security Advisor reads across every triaged signal in Threat Monitoring and produces a Threat Posture brief: a short, executive-ready read on what the activity around an organization adds up to.

The Threat Analyst works signal by signal. The Security Advisor works one level up, surfacing the patterns behind the noise. Each insight follows the same structure: the pattern observed, why it matters, what it implies about the organization’s controls, and what leadership should prioritize. Recommendations are pitched at leadership priorities rather than individual remediation tasks.

The Threat Posture brief appears on the Threat Monitoring feed page and refreshes weekly. Insights are filterable, and each traces back to its underlying threats, so every statement presented to executives links to the evidence behind it.

Faster threat closure in Threat Monitoring

Every threat card and threat details page now has a Manage threat button with the same options in the same order, replacing the three-dot menu. Two options have clearer names: No action needed replaces Risk Accepted for threats that do not warrant work, with an optional note, and False match replaces False positive for findings incorrectly attributed to the organization. Exposed credential threats close with a single quick action, and the confirmation message includes an undo option.

Sanctions and geopolitical risks now affect security ratings

UpGuard’s Sanctions and Geopolitical Risks have had their provisional status removed, meaning they now contribute to both Breach Risk and Vendor Risk customers’ security rating. For more information see Geopolitical Risks.

Vendor search matches any part of the name or domains

Vendor Risk users can now search both monitored and unmonitored vendors by any part of a vendor’s name or domain. For example searching ‘soft’ will bring up ‘Microsoft’.

Attack surface check timeline in the Security Profile

Attack surface checks will now show a timeline of user actions that affect the check such as remediation requests and waiving risks. The timeline for both attack surface and evidence checks also show when notes are added or deleted and when documents are selected or deselected.

Adding applications to User Risk before browser detection

User Risk administrators can now add an application to their app list and set a usage policy for it before the browser extension detects it. For more information see User Risk: Adding Apps Manually.

Mobile app stores are a favorite venue for brand abuse. A convincing lookalike app can sit in a public storefront, carry an organization’s name and branding, and reach its customers directly, without touching any of its infrastructure. Threat Monitoring now scans the Apple App Store and Google Play Store for apps that reference a monitored domain or brand term. Scanning covers the app name, developer name, description, and listing metadata. The AI Analyst automatically dismisses listings it identifies as official. Security teams review only the listings it flags as potential brand impersonation.

Threat Monitoring filtering by event, detection, or alert date

Threat Monitoring users can now choose which date the filter applies to. A toggle above the date range dropdown switches between event date, detection date, and alert date. The selection carries through the rest of the view: chart grouping and the date label on each threat result card both update to match, and the chosen date field is used in exports.

NIST SP 800-171 Rev. 3 in the Security Profile

Vendor Risk users can now select NIST SP 800-171 Rev. 3 in the Security Profile to assess vendors against. Our control library maps directly to all 97 requirements, so assessing against NIST SP 800-171 runs on the same core checks used across all other frameworks in the Security Profile. This framework sets the security requirements for protecting Controlled Unclassified Information (CUI) across US federal and defense supply chains.

Browser extension branding for User Risk

User Risk admins can now customize the User Risk browser extension to reflect their organization. Admins can set a theme, a company logo, an accent color, and a display name so users see extension nudges, blocks, and other messages branded to their organization instead of UpGuard’s default.

Other improvements

• Vendor Risk users can now select multiple additional evidence documents and archive, delete, or download them in a single action.
• Trust Exchange now captures the countersigner’s name when an NDA is countersigned and writes it into the signed NDA document.
• UpGuard now detects Gitea and its version on scanned sites, so vulnerabilities affecting a specific Gitea release appear in risk findings.
• UpGuard now detects two critical Gitea vulnerabilities on scanned hosts: CVE-2026-27771, an authentication bypass where the built-in container registry accepts an anonymous bearer token regardless of repository visibility, allowing unauthenticated attackers to enumerate and pull private container images; and CVE-2026-59774, an improper input validation vulnerability in the Org-mode markup renderer that allows unauthenticated attackers to read arbitrary files on the server.

The check drawer in Security Profile now opens as a whole page, showing which citations contribute to a pass or fail result and an explanation of why. Citations are now more easily excluded and restored giving users more control over the AI Security Profile scan results. A new timeline for evidence checks records every change to a check, including new citations, manual overrides, citation exclusions, and remediation requests, so users can audit the history of the check. The check drawer and citation updates are available now. The new timeline will be available from 27 August. For more information see Work with Controls and Checks.

N-able N-central verified vulnerability detection

We now have improved product detection for N-able N-central. Customers with N-able N-central in their attack surface will now see the product in Breach Risk Detected Products. Breach Risk & Vendor Risk now also include verified vulnerability detection for N-able N-central across 9 CVEs, including CVE-2026-18577 and CVE-2026-18556, authentication bypass vulnerabilities exploited in the wild; CVE-2025-8875, an insecure deserialization vulnerability; and CVE-2025-8876, a command injection vulnerability.

Other improvements

• Trust Center tabs now have direct URLs, allowing Trust Exchange users to easily share a single link directly to their security controls or subprocessor list with Trust Center viewers across both public and signed-in views.
• Importing security questionnaires is now significantly upgraded, delivering up to 10x faster processing to determine column mappings alongside smarter heading detection and enhanced accuracy for multi-sheet files and UpGuard exported workbooks.

Trust Exchange users on the paid tier can now publish their subprocessor list directly on their Trust Center. Subprocessors are the third party vendors that handle customer data on their behalf, such as cloud hosting or payment processing. Prospects and customers can see this list without having to request it, which resolves a common compliance question early in every security review.

General availability for new Trust Exchange and Vendor Risk APIs

Customers can now build against new stable, supported endpoints across Trust Exchange and Vendor Risk, as a set of public APIs moves to general availability. In Vendor Risk, the new APIs cover retrieving vendor classic assessment details, lists, and versions, adding and updating vendor contacts, adding questionnaire comments, and updating questionnaire status. Trust Exchange NDA and Trust Center access management APIs are also generally available, giving users a stable, supported interface to automate their NDA workflows and access management programmatically.

NCA compliance badges on the Trust Center

Trust Exchange customers can now display National Cybersecurity Authority (NCA) compliance badges on their Trust Center for NCA ECC (Essential Cybersecurity Controls) and NCA DCC (Data Cybersecurity Controls). Visitors see which frameworks an organization meets without needing to request them. This matters to buyers in Saudi Arabia, where both frameworks are mandatory for government entities and critical infrastructure operators.

We’ve expanded the security profile template library to include templates for cloud service providers and core infrastructure providers. These map to the Cloud Security Alliance Cloud Controls Matrix (CCM), UK Cyber Essentials, the Center for Internet Security Critical Security Controls (CIS), and NIST Special Publication 800-53 Revision 5. Vendor Risk users can run AI assessments and gap analysis in Security Profile against these standards when reviewing SaaS, PaaS, IaaS, MSP, and data center vendors. For more information see Control Templates.

Remediation requests for Security Profile risks

Vendor Risk users can now request remediation for evidence risks in Security Profile directly from document citations, without sending a questionnaire. Vendors can share supporting evidence as part of the remediation process, and Vendor Risk users can manually mark risks as remediated based on their evidence and responses.

Breach Risk detected products added to detected vendors in Vendor Risk

To help Vendor Risk users more easily surface and manage risk from unknown vendors, we now surface Breach Risk detected products in the Detected tab on the Vendors page. The Detected tab on the Vendors list now shows vendors detected by Breach Risk alongside those detected by User Risk (for Breach Risk and User Risk users respectively), and vendors can be monitored directly from the list.

Automated suppression for inactive account credentials

Breach Risk Threat Monitoring can automatically suppress exposed credential detections for inactive or known-benign accounts, cutting down noise from reposted ULP and combolist data. Organizations can import, as well as manually curate, a list of known inactive accounts so future detections are triaged without manual dismissal.

Detection for the wp2shell WordPress vulnerability chain

Breach Risk and Vendor Risk now detect WordPress installations affected by CVE-2026-60137, a SQL injection vulnerability and CVE-2026-63030, a REST API batch-route confusion vulnerability. Chained together they enable unauthenticated remote code execution, and both are listed in CISA’s Known Exploited Vulnerabilities catalog. Fixes are available in WordPress 7.0.2, 6.9.5, and 6.8.6.

Other improvements

• Breach Risk and Vendor Risk now detect 13 additional high and critical severity CVEs in VMware vCenter Server: CVE-2024-38813, CVE-2024-38812, CVE-2024-37080, CVE-2024-37079, CVE-2024-22274, CVE-2023-34048, CVE-2023-20895, CVE-2023-20894, CVE-2023-20893, CVE-2022-31680, CVE-2022-22982, CVE-2022-22948, and CVE-2021-22049.
• Breach Risk and Vendor Risk now detect two medium severity CVEs in the Jetpack plugin for WordPress, CVE-2024-9926 and CVE-2021-24374.
• Vendor Risk and Breach Risk users can receive an email when a risk waiver is approved or declined and can turn the notification on or off for each product from notification settings.
• Threat Monitoring snippet and image downloads use descriptive filenames built from the post date, content type, source, author, and threat ID.
• UpGuard’s preset control templates in the Security Profile have been renamed with the prefix ‘UpGuard’ (for example ‘UpGuard Core’ instead of ‘Core controls’) to clearly differentiate our recommended templates from external framework templates.

Vendor Risk users can now mark a questionnaire complete while leaving its remediation requests open, giving you more granular status to improve tracking. We’ve added a new setting, Allow changes to completed questionnaires in remediation, giving you the flexibility to define whether vendors can update responses to remediate risks after completion.

Search and filtering for Trust Center access management

Trust Center users can now search and filter the Access logs by name or email, eliminating the need to scroll through long lists. Additionally, denied access requests are now visible, allowing internal team members to track the access requests declined and when.

IRAP badge for Trust Center

Trust Center now displays an IRAP badge, so organizations assessed under the Infosec Registered Assessors Program can show that status to visitors reviewing their security posture.

Exclude Entra guest users from monitoring

User Risk users can now exclude Entra guest users from monitoring through the existing monitoring rules. After each scan or rule change, an audit event records which users were unmonitored.

Multiple approved apps in the browser extension

When User Risk nudges or blocks an app in the browser extension, it now lists all approved alternatives in alphabetical order.

Severity-first sorting for the Threat Monitoring queue

Breach Risk’s Threat Monitoring queue now sorts by severity by default, highest first (Critical to Low), so analysts see the most critical threats before the most recent. Within the same severity, threats fall back to newest first. Users can still change the sort manually.

Company name Transforms now support AI-generated aliases. Each Transform suggests up to two aliases, helping identify legitimate company references while reducing false positives caused by short or ambiguous names. Customers can accept the suggested aliases or request alternatives.

SharePoint vulnerability detection (CVE-2026-32201)

Breach Risk and Vendor Risk now include vulnerability detection for CVE-2026-32201, a remote network spoofing vulnerability with no available mitigation beyond patching. Customers with SharePoint in their attack surface will see this appear in Breach Risk, and Vendor Risk customers will now see this on their vendors where detection confirms exposure.

Excel export for control templates

Vendor Risk administrators can now export any control template to Excel to share it for review when setting up Security Profile control templates. The file lists each check with its domain, control family, control, and the framework mappings selected for that template.

Expiry reminders for shared resource access

Trust Exchange now emails users seven days before their access to shared vendor assets expires. Users can request an extension from the notification itself.

App access automation workflows for User Risk

Security and IT teams can now automate app access requests and usage reviews in User Risk via Risk Automations. Users can request access to an app directly from the User Risk browser extension, and the automation notifies the admins via Microsoft Teams, Slack, or an ITSM ticket. Administrators can survey selected users about their app usage, sending each user a chat message or ticket through the same connected tools to inform app policy decisions.

Detected vendors from app usage

For customers using both User Risk and Vendor Risk, a new Detected vendors tab in Vendor Risk surfaces the vendors behind approved apps that User Risk has detected in use but are not yet monitored. Security teams can quickly spot coverage gaps and decide which vendors to monitor.

FortiBleed exposure detection

Breach Risk and Vendor Risk now flag assets affected by FortiBleed, a credential-exposure campaign targeting internet-facing Fortinet devices. The risk is raised when a customer’s own asset appears on the impacted list, or when a monitored vendor has an asset on it, giving teams fast visibility to prioritize validation and remediation. It is a temporary signal and stays active until 29 July 2026.

We are introducing a temporary risk to respond to the FortiBleed incident. FortiBleed is a credential-exposure campaign affecting internet-facing Fortinet devices, where we believe attackers gained access through a mix of unpatched vulnerabilities and credential-stuffing techniques, then extracted device configuration data and used hashcracking techniques to break credentials into plaintext. Because this can indicate real compromise risk on affected infrastructure, we are adding a short-term detection signal that will remain active until 29 July 2026.

This change adds a new risk that can raise in both products: in Breach Risk, it raises when a customer’s own asset is on the impacted list; in Vendor Risk, it raises when a monitored vendor has an asset on that list. The signal is intended for fast visibility and triage so teams can prioritize validation and remediation on potentially impacted systems.