New Features & Enhancements
Upgraded CMA Admin Experience: To improve admin efficiency by focusing on the pages most relevant to you, we are upgrading the Cato Management Application (CMA) admin experience:
New Filter by Use Case: Only show the CMA pages relevant to your use case
Left Navigation: The navigation menu is located on the left side of the CMA instead of the top bar
No change to RBAC or page links
Navigation Toggle: Enable the toggle to switch to the upgraded experience
The toggle is off by default for a limited time
Enterprise Browser v1.1.0.50: During the week of May 24, 2026, Enterprise Browser version 1.1.0.50 will be available. This version contains:
Enforces Always-On when browsing to ensure that all of your browsing is secure and complies with company policies
Dedicated support page to view connection information and collect logs
Added support for all media codecs
Upgrade to Chromium v148.0.7778.56
Zoom Disconnection Events: For faster troubleshooting of Zoom connectivity, the Experience Monitoring drill-down pages provide visibility into Zoom meeting disconnection events to help correlate them with issues in the network path.
The events are also available in the Events page
The event shows reasons for disconnection
Requires a DEM license and Zoom connector configured with the dashboard_meetings:read:admin scope enabled
Applications Dashboard Displays Sankey Diagram: For increased visibility of how SaaS applications are used in your network, the Applications Dashboard includes a sankey diagram to visualize application usage flow in your network.
Requires a CASB license
Support for DTS SSO and User Provisioning: We added DTS as a provider for SSO authentication for end users and admins, as well as user provisioning with SCIM.
Support for OneWelcome SSO for CMA Admins: We added OneWelcome as a provider for SSO authentication for admins accessing the CMA.
Detailed Visibility of Interconnected Apps - Support for GitHub: View detailed information about third-party apps and plugins connected to GitHub. This visibility helps you understand which external apps are used in your environment and how they interact with core services.
View the Plugins option in the Security > Applications page on the Inventory tab
Requires a CASB license
XOps Stories for Cloud App Activities: XOps includes coverage for App Activities with new stories that alert on anomalous and risky behavior across widely-used SaaS apps.
Producer Type is Generic Incident and Producer Name is the app name
Supported for GitHub, Microsoft 365, Slack, and Google Workspace
Requires XOps and CASB licenses and configuration of App Activities connectors
XOps Stories for Microsoft Email Security Alerts: XOps generates stories for Microsoft Defender for Office 365 alerts for emails, including phishing, malware, and other signals. The stories are enriched with Cato identity, network, and endpoint context.
Stories are generated by the Microsoft Email Security producer
Requires XOps license
Requires Microsoft Defender for Office 365 connector
Enhanced Defender for Endpoint XOps Stories: Defender stories are now aggregated based on Defender incidents and their related alerts, with support for multiple entities per incident. You can also update Defender incidents directly from Cato XOps to streamline investigation and response workflows.
Requires XOps license
Updating Defender incidents requires editing the connector with write permissions
PoP Announcements
The following PoP locations are now available:
Anchorage, US: 199.27.49.0/24
Lisbon, PT: 159.117.242.0/24
The following range is now available:
Madrid, ES: 216.252.188.0/24
The following localized range is now available:
Pakistan: 113.30.129.160/27 (serviced through Dubai)
The following ranges will soon be available:
Los Angeles, US: 199.27.53.0/24
Tokyo, JP: 113.30.138.0/24
Security Updates
Apps Catalog
View more details about apps in the Apps Catalog.
New Apps: 7 new apps: Adobe Updater, Amazon DRS / MGN Services, Brain.fm: Focus & Sleep Music, Dune, Hermes Agent, SiliconExpert, TiFlux
Enhanced Apps:
Cato Management Application
Updated app domains
Cato Networks
Added domains aim.security, catonetworks.club, hakasecurity.com
Comcast Corporation
Added domain comcast.net
Extremereach
Added domain extremereach.io
Infomaniak Network Sa
Added domain swisstransfer.com
Microsoft Copilot
Added domain copilotstudio.preview.microsoft.com
Mist
Added domain mistsys.net
Qiita
Updated app domains
Skilljar
Added domain sj-cdn.net
Telegram Voice and Video Call
Application is now available in Application Control rules
Vicarius
Added domain vicarius-cdn.com
Socket apps, from Socket v25:
Added 1 apps
Adobe Updater supported for domains based
Modified 1 apps
Microsoft Defender For Endpoint - added support for domains based
IPS Signatures
View more details about the IPS signatures and protections in the Threats Catalog.
CVE-2026-1340 (New)
CVE-2026-20079 (New)
CVE-2026-42281 (Enhancement)
Malware - Havoc C2 (New)
Lan IPS signatures:
CVE-2007-3010 (New)
CVE-2014-0130 (New)
CVE-2014-6287 (New)
CVE-2015-2974 (New)
CVE-2016-0752 (New)
CVE-2017-17562 (New)
CVE-2017-6327 (New)
CVE-2017-7615 (New)
CVE-2017-7921 (New)
CVE-2018-1000861 (New)
CVE-2018-11759 (New)
CVE-2018-1207 (New)
CVE-2019-11043 (New)
CVE-2019-12314 (New)
CVE-2019-12725 (New)
CVE-2019-13635 (New)
CVE-2019-19781 (New)
CVE-2019-5127 (New)
CVE-2019-7256 (New)
CVE-2020-0688 (New)
CVE-2020-10580 (New)
CVE-2020-11978 (New)
CVE-2020-14864 (New)
CVE-2020-15148 (New)
CVE-2020-17523 (New)
CVE-2020-25078 (New)
CVE-2020-25506 (New)
CVE-2020-25858 (New)
CVE-2020-28648 (New)
CVE-2020-29166 (New)
CVE-2020-29557 (New)
CVE-2020-3161 (New)
CVE-2020-35476 (New)
CVE-2020-36289 (New)
CVE-2020-8163 (New)
CVE-2020-8193 (New)
CVE-2020-8218 (New)
CVE-2020-9315 (New)
CVE-2020-9496 (New)
CVE-2021-20090 (New)
CVE-2021-21402 (New)
CVE-2021-22873 (New)
CVE-2021-25294 (New)
CVE-2021-26085 (New)
CVE-2021-26827 (New)
CVE-2021-28149 (New)
CVE-2021-28169 (New)
CVE-2021-29442 (New)
CVE-2021-3019 (New)
CVE-2021-31805 (New)
CVE-2021-33503 (New)
CVE-2021-3374 (New)
CVE-2021-34429 (New)
CVE-2021-34467 (New)
CVE-2021-35395 (New)
CVE-2021-39226 (New)
CVE-2021-40378 (New)
CVE-2021-41773 (New)
CVE-2021-43798 (New)
CVE-2021-44077 (New)
CVE-2021-44228 (New)
CVE-2021-45046 (New)
CVE-2021-45105 (New)
CVE-2021-45456 (New)
CVE-2022-21371 (New)
CVE-2022-21907 (New)
CVE-2022-22956 (New)
CVE-2022-24218 (New)
CVE-2022-25077 (New)
CVE-2022-27043 (New)
CVE-2022-27226 (New)
CVE-2022-27924 (New)
CVE-2022-29499 (New)
CVE-2022-29775 (New)
CVE-2022-31268 (New)
CVE-2022-31499 (New)
CVE-2022-32417 (New)
CVE-2022-33891 (New)
CVE-2022-33980 (New)
CVE-2022-36534 (New)
CVE-2022-37299 (New)
CVE-2022-41082 (New)
CVE-2022-44356 (New)
CVE-2023-22047 (New)
CVE-2023-22515 (New)
CVE-2023-2766 (New)
CVE-2023-27997 (New)
CVE-2023-28432 (New)
CVE-2023-29298 (New)
CVE-2023-32315 (New)
CVE-2023-35078 (New)
CVE-2023-35082 (New)
CVE-2023-39143 (New)
CVE-2023-39677 (New)
CVE-2023-4168 (New)
CVE-2023-42793 (New)
CVE-2023-43261 (New)
CVE-2023-46731 (New)
CVE-2023-46805 (New)
CVE-2023-48365 (New)
CVE-2023-49103 (New)
CVE-2023-49785 (New)
CVE-2023-50358 (New)
CVE-2023-6021 (New)
CVE-2024-10486 (New)
CVE-2024-10914 (New)
CVE-2024-21136 (New)
CVE-2024-21887 (New)
CVE-2024-2448 (New)
CVE-2024-24824 (New)
CVE-2024-28000 (New)
CVE-2024-29895 (New)
CVE-2024-32238 (New)
CVE-2024-3272 (New)
CVE-2024-3273 (New)
CVE-2024-36404 (New)
CVE-2024-36991 (New)
CVE-2024-38475 (New)
CVE-2024-41585 (New)
CVE-2024-45195 (New)
CVE-2024-45216 (New)
CVE-2024-51567 (New)
CVE-2024-56145 (New)
CVE-2024-56325 (New)
CVE-2024-57046 (New)
CVE-2024-57727 (New)
CVE-2024-5910 (New)
CVE-2024-6235 (New)
CVE-2025-0108 (New)
CVE-2025-31324 (New)
CVE-2025-4632 (New)
XDR Indications of Attack
Anomaly Detection
Unusual File Renaming Activity (New)
Threat Prevention
Multiple Blocked Upload Attempts
Repeated DLP Violations
Device Inventory
These are the updates to the Device Inventory detection engine:
NETWORKING
Network Appliance
Aruba (New)
Application Control Via API and Data Protection API Integrations
The enhancements were made for Application Control Via API
Google Apps | Anomalies
Google Apps | Anomalies (Enhancement)
Microsoft General | Activity
Microsoft General | Activity (Enhancement) - Added detection of external Teams communications via cross-tenant participant data; expanded event coverage to include ChatCreated and CallParticipantDetail events; improved collaborator name resolution to prefer display names over email addresses; remapped DLP endpoint FileCreated events to file_sharing.create.
Slack | Anomalies
Slack | Anomalies (Enhancement)
Zoom | Experience
Zoom | Experience (Enhancement) - Added new UCAAS Disconnection event type that surfaces non-benign participant disconnection events (network errors, client crashes, time-limit expiry) as dedicated disconnection events.
Note: Content described in this update is gradually rolled out to the Cato PoPs over a two-week period. In addition, new features are gradually activated in the Cato Management Application over the same two-week rollout period as the PoPs. For more information, see this article. See the Cato Status Page for more information about the planned maintenance schedule.