Press CTRL+K to open search

Product Updates - October 26, 2026

  • 에 게시됨 Oct 25, 2026
  • 6 읽은 시간(초)
Prev Next
This content is currently unavailable in Korean. You are viewing the default (English) version.

New Features & Enhancements

  • Compare Policy Revisions: Review a side-by-side comparison of any two policy revisions before publishing, so you can see exactly what changed and catch unintended modifications.

    • Highlights added, modified, moved, and deleted rules, sections, and fields

    • Compare an unpublished revision against the active policy or any other unpublished revision

    • Available for Internet Firewall, WAN Firewall, and Client Connectivity policies

  • New Android Client v5.7: During the week of Oct. 25, 2026, Android Client version 5.7 will be uploaded to the Google Play Store. From this version, Chromebook devices running ChromeOS are reported as ChromeOS rather than Android.

  • New iOS Client v5.9.3:  During the week of Oct. 25, 2026, iOS Client version 5.9.3 will be available for download from the App Store. This version includes bug fixes, security enhancements, and stability improvements.

  • Microsoft Sentinel Connector via Microsoft’s Marketplace: A new Cato Sentinel integration is available as a certified, marketplace-listed connector built on Microsoft's Codeless Connector Framework (CCF), without giving Cato write permissions in your Azure tenant. Schema updates arrive through standard Sentinel connector updates, so permission changes no longer impact event ingestion.

    • No impact on existing Sentinel integration configurations

  • Category Updates to Apps in the App Catalog: As previously announced, starting October 25, 2026, the category of these applications is changing in the App Catalog. To ensure access and control of these apps continue to meet your requirements, you may need to update your Security, App Control, or Data Protection policies. For more information, see the linked article for each app.

  • Request App Coverage: Submit app coverage requests directly from the CMA. Request additional App Activities actions or tenant control, new App Catalog entries, or support for specific capabilities, such as Interconnected Apps.

  • Improved Bandwidth Usage Visibility for Socket Sites: Assess bandwidth needs and understand traffic usage across your Socket sites with additional capacity and throughput metrics. Usage above licensed capacity is clearly highlighted

  • Simplified Cato Context and Capabilities Integration with Local Agents: Connect supported agents to Cato Remote MCP through a simplified OAuth setup with less manual configuration.

  • Engage Action for Local Agent Policies: Verify user intent for risky agent actions before the session continues. Admins can now select the Engage action in Local Agent policy rules, in addition to Monitor and Block.

    • Reduces the risk of agent drift from the user’s original request

    • Available for Local Agent policy rules

    • AI Security for Users license required

  • Limit Concurrent CMA Sessions per Admin: Control concurrent access to the CMA by setting the maximum number of active sessions an admin can have open (show me the page). Sign-ins that would exceed the limit are denied.

    • By default, this limit is disabled and there is no impact on existing accounts

  • Enhanced Cybersquatting Protection: Within DNS Protection, we enhanced cybersquatting protection with a new detection model that covers more brands and identifies a broader range of techniques.

  • Improved Socket Connectivity Behind NAT: Benefit from faster tunnel recovery and more reliable Socket connectivity to Cato PoPs when upstream NAT devices rewrite tunnel source ports.

    • Supports single and dual WAN deployments

    • No changes to upstream NAT configurations required

  • Updated Cato Terraform to v1.2.0: We uploaded version 1.2.0 of the Terraform module.

    • Manage pooled bandwidth licenses for cato_app_connector: allocate bandwidth when creating a connector, and add, resize, or remove allocations on existing connectors.

    • Full changelog

  • Qoder AI Agent Controls: AI Security supports Qoder controls across all tenants, so you can monitor and govern Qoder usage as part of your existing enforcement.

    • Discover and monitor activity with the Scout tab in the Deployments page (show me), including MCPs and tools

    • Define security policies for Qodex interactions with the Coding Agents Policy and block PII from user messages to the AI agent

    • Requires AI Security for Users license

  • CMA Enhancement - 3rd Party Apps and Plugin Page Renamed to Interconnected Apps:

    • In the Integrations page, 3rd Party Apps has been renamed to Interconnected Apps

    • In the Applications monitoring page, Plugins has been renamed to Interconnected Apps

    • No impact on already configured integrations

Security Updates

  • Apps Catalog    

    View more details about apps in the Apps Catalog.

    • New Apps: 16 new apps: AWS IoT Core, Amazon Cognito, Captana, Chrome Remote Desktop, Firebase Cloud Messaging, FortiEDR, Google Docs, Google Forms, Google Sheets, Google Slides, Google Update, ID Entrance, Microsoft Defender SmartScreen, Microsoft Graph, RemSupp, Windows Push Notification Services

    • Removed Apps: 3 apps: google_docs, google_sheets, google_slides

    • Enhanced Apps:        

      • Amazon            

        • Removed domain amazoncognito.com

      • Apple            

        • Updated app IPs

      • Facetime and iMessage            

        • Updated app domains

      • Firebase            

        • Removed domain fcm.googleapis.com

      • Google Applications            

        • Removed domain edgedl.me.gvt1.com

      • Google Docs Editors (Docs, Sheets, Slides, Forms)            

        • Modified name from Google Docs to Google Docs Editors (Docs, Sheets, Slides, Forms)

      • Microsoft Defender For Endpoint            

        • Updated app domains

      • Questra            

        • Modified name from Questera to Questra

      • Telegram            

        • Signature Updated

        • Updated app IPs

    • Category Changes:        

      • Chat and IM:            

        • Added app: Slack

      • Remote Access:            

        • Added app: Talk2M By Ewon

      • Social:            

        • Removed app: Slack

      • Uncategorized:            

        • Removed apps: Suspicious TLD mov, Suspicious TLD top, Suspicious TLD zip, Suspicious TLDs

    • These are the updates for Socket apps, from Socket v25        

      • Added 1 apps            

        • Wasabi Technologies supported for domains based

      • Modified 3 apps            

        • SharePoint and OneDrive Business - Modified app domains

        • Windows Update - Modified app domains

        • Zoom - Modified app domains

  • IPS Signatures    

    View more details about the IPS signatures and protections in the Threats Catalog.

    • CVE-2024-13985 (New)

    • CVE-2024-8883 (New)

    • CVE-2026-17594 (New)

    • CVE-2026-18963 (New)

    • CVE-2026-30623 (New)

    • CVE-2026-58644 (New)

    • CVE-2026-62893 (Enhancement)

    • CVE-2026-65660 (New)

    • CVE-2026-6826 (New)

    • CVE-2026-69676 (New)

    • CVE-2026-86206 (New)

    • CVE-2026-86207 (New)

    • CVE-2026-86218 (Enhancement)

    • CVE-2026-96940 (New)

  • SAM Signatures    

    These protections were added to the SAM service:

    • AD CS LDAP Reconnaissance (New)

    • Executable File Transfer Over SMB With Impersonated Extension (Enhancement)

  • Application Control Policy    

    • Read.ai - Login (New)

    • Read.ai - Login Third Party (New)

    • Read.ai - Conversation (New)

  • DLP    

    • Support JT file type

  • Device Inventory    

    These are the updates to the Device Inventory detection engine:

    • New Devices: 1 new device        

      • IoT:            

        • VoIP:                

          • Unify

  • XDR Indications of Attack    

    • Threat Prevention        

      • Domain Generation Algorithm (DGA) Communication (New)

      • Security alert from deactivated user (New)

      • Admin Settings Actions from Deactivated User (New)

      • Sensitive Actions from Deactivated User (New)

      • Failed Login from Deactivated User (New)

      • Successful Login from Deactivated User (New)

    • Anomaly Detection        

      • First-time Admin Activity by an Unexpected Department (New)

      • Administrative Activity Anomalies in Organizational Application (New)

      • Significant Activity Anomalies in Organizational Application

      • Low Confidence Abnormal Data Upload Activity Using File Sharing Cloud Storage App

      • Abnormal WANBOUND RDP Activity by User (New)

      • First Occurrence of Quick Assist Activity by User (New)

      • first_seen_quick_assist_application_user (New)

      • AnyDesk outbound First Seen (New)

      • Anomalous ServerActivity / New UserAgent from External Network (New)

  • Application Control Via API and Data Protection API Integrations    

    The enhancements were made for Application Control Via API

    • Claude Enterprise | SaaS Posture (New)        

      • New posture checks for SSO on Claude.ai and Console, SCIM provisioning, admin count, external accounts and admins, invite domains, session length, IP allowlisting, chat retention, external chat sharing, project access, trusted devices, RBAC roles, compliance API key scope, connector approval, the desktop extension allowlist, third-party interactive content, and Claude Code and skill controls.

    • SharePoint | SaaS Posture (New)        

      • New posture checks for external sharing, anyone links, default link scope and permission, guest access and expiration, idle session sign-out, unmanaged device access and sync, legacy authentication, Entra B2B, and infected-file download.

    • Microsoft General | Anomalies (Enhancement)        

      • New detection for a Microsoft Copilot jailbreak attempt.

    • Azure AD | Interconnected Apps (Enhancement)        

      • Application permissions are now shown on interconnected apps.