---
sourceDocument: australia Combined Product Files
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/delta-xanadu-australia

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - australia Combined Product Files

ft:clusterId :

    - delta3ax

bundleId :

    - delta3ax


---

# Combined Vulnerability Response release notes for upgrades from Xanadu to Australia

# Combined Vulnerability Response release notes for upgrades from Xanadu to Australia {#ariaid-title1}

Release version: Australia  
Updated October 8, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 39 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Combined Vulnerability Response Release Notes for Upgrades from Xanadu to Australia

This consolidated guide provides ServiceNow customers with essential information on upgrading the Vulnerability Response (VR) application from Xanadu through Australia releases.
It covers new features, important upgrade considerations, deprecated elements, removals, and activation instructions to help ensure a smooth transition and effective use of VR capabilities.
Show full answer Show less  

## Important Upgrade Information

* Starting Zurich Patch 12 and continuing in Australia Patch 5, **Now Assist for Vulnerability Response** is being deprecated; it will be hidden and no longer installed on new instances but remains supported. It is rebranded as **ServiceNow Otto for Unified Security Exposure Management (USEM)**.
* If you do not plan to upgrade to USEM, install Vulnerability Response versions below v30.x and ensure compatible third-party integrations.
* Multiple integrations including Microsoft SCCM, HCL BigFix, Tenable, Qualys, Wiz, and AWS Inspector/Security Hub have been enhanced or consolidated to improve ingestion, remediation workflows, and integration management.
* Patch deployment integrations with Microsoft SCCM and HCL BigFix now support multi-value patch updates and collections for more efficient deployments.
* Backfill integrations for Wiz have been updated, and the deprecated Missing Assets table requires backdating existing integrations by three days post-upgrade.

## Key Features Introduced

* **Enhanced Integrations:** Support for Tenable.cs cloud and container vulnerabilities, unified Microsoft Defender plugin, enhanced Qualys API support, Invicti Platform integration, and AWS Inspector/Security Hub integrations.
* **Improved Vulnerability Management:**
  * Ability to identify and import specific Wiz resource types.
  * Creation of vulnerable items (VITs) and application vulnerable items (AVITs) automatically during vulnerability assessments.
  * Granular control over CVE severity adjustments and risk rating modifications, including bulk updates.
  * Splitting detections from Tenable and Microsoft TVM scanners to assign remediation tasks to multiple teams.
  * Publisher-based vulnerability exposure assessment to prioritize remediation by key vendors.
* **Workspace and UI Enhancements:**
  * New Properties module for easier system property management.
  * Improved navigation to Vulnerability Manager and IT Remediation Workspaces with role-based access.
  * Automatic refresh options for dashboards and list page enhancements.
  * Dark theme option introduced with the Coral theme for improved user experience.
* **Exception and Remediation Enhancements:**
  * Advanced exception management with Smart Assessment questionnaires requiring mandatory completion prior to exception approval.
  * Automatic re-evaluation of remediation tasks when preferred solutions change or exception rules update.
  * Remediation task rule execution modes allowing sequential or comprehensive rule matching.
* **Performance and Data Management:**
  * Multithreaded processing for faster roll-up of vulnerable item values.
  * Central Vulnerability Database (CVDB) providing a unified, source-agnostic vulnerability data record with detailed source attribution and traceability.
  * Background job enhancements for visibility into processing status and improved CI lifecycle status accuracy.

## Changes and Deprecations

* Privileges for deleting vulnerable items and source records have been moved to granular roles.
* The Close button for remediation tasks was removed from the Classic UI and workspaces.
* The scheduled job to create reconcile unmatched discovered items was deprecated in favor of reapplying lookup rules.
* Deprecated fields and integrations replaced with enhanced or consolidated versions, such as the Microsoft Defender standalone plugin and the Missing Assets table in Wiz integrations.

## Activation and Additional Information

* Vulnerability Response and third-party integrations must be requested and installed from the ServiceNow Store.
* Quick Start Tests are recommended after upgrades or new integrations to validate proper functionality.
* System properties and configuration options are available to tailor behavior around remediation, risk scoring, exception management, and data ingestion.
* Browser and accessibility requirements remain consistent, with new dark theme options improving UI usability.

## Benefits for ServiceNow Customers

Upgrading to the Australia release of Vulnerability Response enables customers to:

* Leverage enhanced integrations for comprehensive vulnerability ingestion across cloud, container, and endpoint environments.
* Improve remediation workflows with granular control and automation, reducing manual effort and increasing accuracy.
* Gain better visibility and prioritization through improved risk scoring, exposure assessments, and vendor-specific evaluations.
* Enjoy a modernized, user-friendly interface with workspace improvements and customizable settings.
* Maintain compliance and data integrity with centralized vulnerability data management and traceability.

These enhancements collectively  
Consolidated page of all release notes for Vulnerability Response from Xanadu to Australia.

## How to use this page

To help you prepare for your upgrade, we have combined the cross-family Vulnerability Response release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Xanadu to Australia.  
Tip:  
If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release."

## Important information for upgrading Vulnerability Response to Australia

Before you upgrade to Australia, review these pre- and post-upgrade tasks and complete the tasks as needed.  
{#dfrn3-vulnerabilityresponse-summary__entry__2}

| Release | Release notes |
|-|-|
| Xanadu | No updates for this release. |
| Yokohama | No updates for this release. |
| Zurich | Upgrade information :   Starting with Zurich, Patch 12, Now Assist for Vulnerability Response is being prepared for future deprecation. It will be hidden and no longer installed on new instances but will continue to be supported. For details, see the [Deprecation Process \[KB0867184\]](https://support.servicenow.com/kb_view.do?sysparm_article=KB0867184) article in the Now Support Knowledge Base. The change is reflected in the name of ServiceNow® products, including Now Assist for Vulnerability Response which is called ServiceNow Otto for Unified Security Exposure Management with these enhancements for the new AI experience. See [ServiceNow Otto for Unified Security Exposure Management](https://www.servicenow.com/docs/access?context=now-assist-for-usem-landing-ties&family=zurich&ft:locale=en-US) for more information. If you're currently using Vulnerability Response, and you do not intend to upgrade to Unified Security Exposure Management (USEM), install a version below v30.x of Vulnerability Response and for upgrades to supported third-party integration applications. The Missing Assets \[sn_vul_wiz_missing_asset\] table used for storing assets imported by the backfill integrations for the [Vulnerability Response Integration with Wiz](https://www.servicenow.com/docs/access?context=vr-wiz-exploring-host-cf&family=zurich&ft:locale=en-US) is deprecated. If you're currently using the Vulnerability Response with Wiz integrations, after updating to new version 1.1, backdate any of your existing Wiz primary integrations by three days and run them. Review more information about the Wiz integration at [SecOps articles on the Security Operations Community](https://www.servicenow.com/community/secops-articles/announcement-wiz-integration-with-servicenow-secops/ta-p/3325055). For more information about the released versions of the Vulnerability Response application and the third-party and ServiceNow applications that are compatible with the Zurich release, see the [Vulnerability Response Compatibility Matrix and Release Schema Changes \[KB0856498\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0856498) article in the Now Support Knowledge Base. |
| Australia | Upgrade information :   Starting with Australia Patch 5, Now Assist for Vulnerability Response is being prepared for future deprecation. It will be hidden and no longer installed on new instances but will continue to be supported. For details, see the [Deprecation Process \[KB0867184\]](https://support.servicenow.com/kb_view.do?sysparm_article=KB0867184) article in the Now Support Knowledge Base. ServiceNow Otto® is the new AI experience brand. This change is reflected in the name of ServiceNow products, including the Now Assist for Vulnerability Response product name, which will be replaced with ServiceNow Otto for Unified Security Exposure Management. Your product entitlements remain unchanged. Check your entitlements to determine your access to specific features. If you're currently using Vulnerability Response, and you do not intend to upgrade to Unified Security Exposure Management (USEM), install a version below v30.x of Vulnerability Response and for upgrades to supported third-party integration applications. For more information about the released versions of the Vulnerability Response application as well as the third-party and ServiceNow applications that are compatible with the Australia release, see the [Vulnerability Response Compatibility Matrix and Release Schema Changes \[KB0856498\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0856498) article in the Now Support Knowledge Base Starting with the Australia release, the Patch update and Collection fields on patch deployment records for the Microsoft SCCM and HCL BigFix Patch Orchestration integrations are deprecated in favor of new multi-value Patch updates and Collections fields, which support deploying more than one patch to more than one collection or computer group in a single deployment. Existing values in the deprecated fields are automatically migrated to the new fields during the upgrade. The deprecated fields remain on the form but are no longer used to create new deployments. |
[ ]

## New features

Between your current release family and Australia, new features were introduced for Vulnerability Response.  
{#dfrn3-vulnerabilityresponse-summary__entry__12}

| Release | Release notes |
|-|-|
| Xanadu | [Identify Wiz Resource Types for import](https://www.servicenow.com/docs/access?context=wiz-assets-resources-tab&family=xanadu&ft:locale=en-US) :   Identify the Resource Types (assets) that are reported by Wiz that you want to import with the Wiz Integration Resource Type configuration page in your ServiceNow AI Platform instance. The Resource Types that you select apply to all the primary Wiz vulnerability and compliance integrations except the Wiz Container Vulnerability Integration. See the [Wiz Vulnerability Response Integrations](https://www.servicenow.com/docs/access?context=vr-wiz-exploring-host-cf&family=xanadu&ft:locale=en-US) for more information about the vulnerability and compliance integrations. [Wiz Backfill Integrations](https://www.servicenow.com/docs/access?context=wiz-backfill&family=xanadu&ft:locale=en-US) :   Retrieve and process data stored on the Wiz Missing Assets \[sn_vul_wiz_missing_asset\] table for assets that were not processed by the primary Host Vulnerability Integration with a specialized Wiz Backfill Integration. The Host Vulnerability Backfill Integration is activated by default. Note: The Wiz Asset Integration and the Wiz Container Vulnerability Integration do not have backfill integrations. The Wiz Asset Integration can discover assets and create and update discovered item records on the Discovered item \[sn_sec_cmn_src_ci\] table. The Wiz Container Vulnerability Integration imports and processes discovered container image records. [Create solutions from scanners](https://www.servicenow.com/docs/access?context=vuln-solution-mgmt&family=xanadu&ft:locale=en-US) :   Starting with v24.0.6 of Vulnerability Response, solution records can now be configured to be created from scanners such as Tenable, Qualys, and Microsoft Threat and Vulnerability Management (MS TVM). These solutions are set as preferred in the absence of options from software vendors. [Activate or deactivate CVEs for exposure assessment](https://www.servicenow.com/docs/access?context=vr-ws-activate-deactivate-cves&family=xanadu&ft:locale=en-US) :   Starting with version 4.0.1 of Vulnerability Exposure Assessment, if a Common Vulnerability Entry (CVE) has not been updated or had vulnerable items (VITs) created in the past 30 days, the exposure assessment record for that CVE is automatically marked as inactive. However, you can manually activate or deactivate these records. Additionally, the scheduled job Check potential vulnerability exposure regularly scans for such CVEs to designate them as inactive. If there is an update, it marks them as active. [Split detections from Tenable and Microsoft TVM scanners](https://www.servicenow.com/docs/access?context=vuln_integrations&family=xanadu&ft:locale=en-US) :   Starting with v24.0.6 of Vulnerability Response, you can split the detections from Tenable and Microsoft Threat and Vulnerability Management (MS TVM) scanners, enabling the creation of a unique vulnerable item (VIT) for each detected vulnerability instance. This split enables the assignment of VITs to various remediation teams, enhancing the management and tracking of vulnerabilities. [New Properties module](https://www.servicenow.com/docs/access?context=installed-with-vr&family=xanadu&ft:locale=en-US) :   Starting with v24.0.6 of Vulnerability Response, a new Properties module has been added to the navigation menu under the Administration section. This module enables direct modification of the values, offering a user-friendly method to manage and update system properties directly from the interface. [Deletion of classification rules and application on discovered items](https://www.servicenow.com/docs/access?context=delete-vulnerability-classification-rule&family=xanadu&ft:locale=en-US) :   Starting with v24.0.6 of Vulnerability Response, if a classification rule is deleted or deactivated, it's no longer applied to the discovered item and the data in the Classification and Classification_type fields get cleared. [Exceptions for CI creation](https://www.servicenow.com/docs/access?context=ci-creation-using-IRE&family=xanadu&ft:locale=en-US) :   Starting with v24.0.6 of Vulnerability Response, if Identification and Reconciliation engine (IRE) encounters exceptions that prevent the creation of configuration items (CIs), the specifics of these exceptions are recorded in the Additional Information field. [View configuration item history](https://www.servicenow.com/docs/access?context=reapply-discovered-items-ci-changes&family=xanadu&ft:locale=en-US) :   Starting with v24.0.6 of Vulnerability Response, you can view the updates to a CI in the Discovered Item table. Information including the previous CI, the updated CI, and the user who made the changes is documented in the Audit History related list. [Customize the calculation of Age and Age closed values of a vulnerable item](https://www.servicenow.com/docs/access?context=vulnerable-item-fields&family=xanadu&ft:locale=en-US) :   Starting with v24.0.6 of Vulnerability Response, the Age and Age Closed durations of a Vulnerable Item can be configured to be calculated from the date in the Created, Opened, or First Found fields. Open the search results in the [Vulnerability Manager Workspace](https://www.servicenow.com/docs/access?context=vmws-change-app-scope-search&family=xanadu&ft:locale=en-US) or [IT Remediation Workspace](https://www.servicenow.com/docs/access?context=itr-ws-change-app-scope-search&family=xanadu&ft:locale=en-US) rather than the Classic UI :   Starting with v24.0.6 of Vulnerability Response, automatically open your search results in the Vulnerability Manager Workspace or IT Remediation Workspace rather than the Classic UI, by adjusting the application scope in the unified navigation bar to Vulnerability Manager Workspace or IT Remediation Workspace respectively. These application scopes are available to you based on your assigned role. [Vulnerability Manager Workspace access to the sn_vul.read_all role](https://www.servicenow.com/docs/access?context=installed-with-vr&family=xanadu&ft:locale=en-US) :   Starting with v24.0.6 of Vulnerability Response, as a user with the sn_vul.read_all role, you can view the host vulnerable items in the Vulnerability Manager Workspace. [IT Remediation Workspace access to the sn_vul.read_assigned role](https://www.servicenow.com/docs/access?context=installed-with-vr&family=xanadu&ft:locale=en-US) :   Starting with v24.0.6 of Vulnerability Response, as a user with the sn_vul.read_assigned role, you can view the host vulnerable items assigned to you and your assignment groups in the IT Remediation Workspace and remediate them. Navigate to the List page in the [Vulnerability Manager Workspace](https://www.servicenow.com/docs/access?context=vmws-list-page&family=xanadu&ft:locale=en-US) or [IT Remediation Workspace](https://www.servicenow.com/docs/access?context=itr-ws-list-page&family=xanadu&ft:locale=en-US) by selecting the links from the All menu :   Starting with v24.0.6 of Vulnerability Response, when you enable the 'sn_vul_cmn_ws.navigate_to_workspace' system property, selecting predefined filter links in the Vulnerability Response module from the 'All' menu will automatically open these links in the List page in the Vulnerability Manager Workspace or IT Remediation Workspace based on your role. Hide the record count on the Host Vulnerable Items list in the [Vulnerability Manager Workspace](https://www.servicenow.com/docs/access?context=vmws-list-page&family=xanadu&ft:locale=en-US) and [IT Remediation Workspace](https://www.servicenow.com/docs/access?context=itr-ws-list-page&family=xanadu&ft:locale=en-US) :   Starting with v24.0.6 of Vulnerability Response, you can hide the record count on the lists in the List page of the Vulnerability Manager Workspace and IT Remediation Workspace by adding the table names to the glide.ui.list.seismic.omit.count system property. [Enable automatic refresh for the Home page dashboard in the Vulnerability Manager Workspace](https://www.servicenow.com/docs/access?context=vmws-home-page-create-filter&family=xanadu&ft:locale=en-US) :   Starting with v24.0.6 of Vulnerability Response, when creating and editing filters in the Host Vulnerabilities tab on the Home page of the Vulnerability Manager Workspace, you can configure the widgets to refresh automatically. Otherwise, you can manually refresh the widgets by selecting the Refresh button on the Host Vulnerabilities tab. [Re-evaluating remediation properties for all records in the Vulnerability Manager Workspace](https://www.servicenow.com/docs/access?context=vmws-reevaluate-remediation-parameters&family=xanadu&ft:locale=en-US) :   Starting with v24.0.6 of Vulnerability Response, you can evaluate the remediation properties for all the Vulnerable Items from the Host Vulnerable Items list by selecting the All items option in the Record selection field of the Re-evaluate remediation properties modal in the Vulnerability Manager Workspace. [Reevaluate the remediation properties for vulnerable items in the Vulnerability Manager Workspace](https://www.servicenow.com/docs/access?context=vmws-reevaluate-remediation-parameters&family=xanadu&ft:locale=en-US) :   Select the vulnerable items conditionally for reevaluating the following remediation properties in the Vulnerability Manager Workspace: * Assignments * Remediation tasks * Remediation target date * Exceptions (Vulnerability Response v24.0.6) * Risk score [Navigate to the Exposure Assessment page in workspaces from the All menu](https://www.servicenow.com/docs/access?context=vr_sw_expsure_task&family=xanadu&ft:locale=en-US) :   With the Vulnerability Response Pro or Enterprise subscription, you're redirected to the Exposure Assessment page in the Vulnerability Manager Workspace or Vulnerability Assessment Workspace based on your role, on selecting the Exposure Assessment link in the All menu. [Common Security Advisory Framework (CSAF) scanner mapping is optional](https://www.servicenow.com/docs/access?context=import-csaf-file&family=xanadu&ft:locale=en-US) :   The Scanner mapping field is now optional for the following Common Security Advisory Framework (CSAF) import methods: * File import * Advisories * CSAF URL [Multiple vendors supported for CSAF through Rolie feed](https://www.servicenow.com/docs/access?context=import-csaf-url&family=xanadu&ft:locale=en-US) :   Import vulnerability solutions from CSAF aggregators or trusted providers via URL import supporting Resource-Oriented Lightweight Information Exchange (ROLIE) feed. These vulnerability solutions are automatically mapped to the correct vendor and vulnerable items (VITs) based on the Common Vulnerabilities and Exposures (CVEs). [Enhanced processing performance of scheduled job](https://www.servicenow.com/docs/access?context=installed-with-vr&family=xanadu&ft:locale=en-US) :   The Rollup vulnerable item values to vulnerability and group scheduled job is enhanced to create background jobs with multithreading capabilities. This upgrade involves segmenting the job into several smaller child jobs, which are executed either in parallel or concurrently. This modification enables processing of multiple records simultaneously, thus significantly speeding up the overall task. [Workflow deprecation and replacement by flow designer](https://www.servicenow.com/docs/access?context=cj-common-vuln-tasks&family=xanadu&ft:locale=en-US) :   The following workflows have been deprecated and replaced by the flow designer: * Exception Rule State Approval * Remediation Task State Approval * Vulnerability Response - Scan Vulnerability * Vulnerable Item State Approval * Vulnerability Response - Scan Vulnerable Item . [Risk score updates in the Notes section](https://www.servicenow.com/docs/access?context=vuln-calculators-rules&family=xanadu&ft:locale=en-US) :   Access information on how an item's risk score is adjusted according to modifications in the vulnerability calculators. These details are available in the Notes section and include: * Calculator group name * Calculator name * Field values along with their weightage and impact on the risk score * Final risk score [Vulnerability Crisis Management (VCM) is available as a separate subscription in the store](https://www.servicenow.com/docs/access?context=vulnerability-crisis-management&family=xanadu&ft:locale=en-US) :   Starting with v1.0.1 of Vulnerability Crisis Management, the application is available as a separate subscription in the store. You can access Vulnerability Crisis Management from the Vulnerability Assessment workspace only if you have fine- grained entitlement or have installed the application from the store. Previously, Vulnerability Crisis Management was included with the Vulnerability Emergency Response plugin. [Vulnerability Exposure Response is renamed as Vulnerability Exposure Assessment](https://www.servicenow.com/docs/access?context=vr-ws-exposure-assessment&family=xanadu&ft:locale=en-US) :   Starting with v3.2.2, the Vulnerability Emergency Response plugin has been renamed as Vulnerability Exposure Assessment. |
| Yokohama | [Identify Wiz Resource Types for import](https://www.servicenow.com/docs/access?context=wiz-assets-resources-tab&family=yokohama&ft:locale=en-US) :   Identify the Resource Types (assets) that are reported by Wiz that you want to import with the Wiz Integration Resource Type configuration page in your ServiceNow AI Platform instance. The Resource Types that you select apply to all the primary Wiz vulnerability and compliance integrations except the Wiz Container Vulnerability Integration. See the [Wiz Vulnerability Response Integrations](https://www.servicenow.com/docs/access?context=vr-wiz-exploring-host-cf&family=yokohama&ft:locale=en-US) for more information about the vulnerability and compliance integrations. [Wiz Backfill Integrations](https://www.servicenow.com/docs/access?context=wiz-backfill&family=yokohama&ft:locale=en-US) :   Retrieve and process data stored on the Wiz Missing Assets \[sn_vul_wiz_missing_asset\] table for assets that were not processed by the primary Host Vulnerability Integration with a specialized Wiz Backfill Integration. The Host Vulnerability Backfill Integration is activated by default. Note: The Wiz Asset Integration and the Wiz Container Vulnerability Integration do not have backfill integrations. The Wiz Asset Integration can discover assets and create and update discovered item records on the Discovered item \[sn_sec_cmn_src_ci\] table. The Wiz Container Vulnerability Integration imports and processes discovered container image records. [Create host remediation tasks manually in the Vulnerability Manager Workspace](https://www.servicenow.com/docs/access?context=vmws-create-remediation-task&family=yokohama&ft:locale=en-US) :   With the sn_vul.vulnerability_analyst or sn_vul.vulnerability_admin role, you can create host remediation tasks manually by selecting some or all the records in the Host vulnerable items' lists in the Vulnerability Manager Workspace. These records are grouped into one or more remediation tasks according to the grouping criteria selected while creating host remediation tasks. [Create host remediation tasks manually in the IT Remediation Workspace](https://www.servicenow.com/docs/access?context=itr-ws-create-remediation-task&family=yokohama&ft:locale=en-US) :   With the sn_vul.remediation_owner role, you can create host remediation tasks manually by selecting desired records in the Host vulnerable items' lists in the IT Remediation Workspace. These records are grouped into one or more remediation tasks according to the grouping criteria selected while creating host remediation tasks. [Questionnaire Support in Exception Management via Smart Assessment](https://www.servicenow.com/docs/access?context=vr-exception-management-smart-assessment&family=yokohama&ft:locale=en-US) :   Configure advanced questionnaires as part of the exception management process using Smart Assessment. This enhancement allows remediation owners to provide detailed context for exception requests and enables approvers to configure conditional questions to gather information for informed decision making. * Collaboration and streamlined approval: Facilitate collaboration between your vulnerability management and remediation teams by streamlining the approval process with clear and complete exception justifications. * Mandatory questionnaires: Block the submission of exception requests until mandatory questionnaires are completed. If a questionnaire is marked as mandatory, the test results and its associated remediation tasks remain in the 'Open' state until the questionnaire is completed and submitted. * If the questionnaire is incomplete, the state change approval record is saved as 'Draft'. Only after completing the questionnaire can the user submit the exception request, which will then move the test results or remediation tasks to the 'In Review' state. [Lookup rules enhancements](https://www.servicenow.com/docs/access?context=working-unmatched-cis&family=yokohama&ft:locale=en-US) :   When you reapply Lookup rules, Discovered items (DIs) that have been inactive for more than 90 days are ignored. These Discovered items (DIs) are also excluded from licensing considerations. Removing them from the lookup logic can improve performance and reduce processing time. * Background job enhancements: New fields have been added to help you view successfully evaluate records, the time taken for processing, the time remaining, and an estimated number of records. * Improved accuracy for non-CSDM Vulnerability Response users: A system property (sn_sec_cmn.ci_lifecycle_status_source) has been introduced to help users who do not follow Common Service Data Model (CSDM) standards. This property ensures that Discovered items (DIs) and associated VITs are properly marked as Decommissioned and are excluded from the CI Lookup. Additionally, the Retired Configuration Items PA indicator has been updated to accurately reflect CIs based on the decommissioning flags. * The scheduled job to create reconcile unmatched discovered items feature is deprecated. You can "Reapply Look up Rules" for selected or filtered items in the discovered items table view. [Tenable.cs integrations with the Vulnerability Response and Container Vulnerability Response application](https://www.servicenow.com/docs/access?context=tenable-cs-integrations-list&family=yokohama&ft:locale=en-US) :   The Vulnerability Response Integration with Tenable application now supports data ingestion from Tenable.cs, enabling you to bring in cloud and container vulnerabilities directly into ServiceNow. This integration enhances your ability to prioritize and remediate vulnerabilities identified in Tenable cloud resources and container images. Key capabilities are: * Importing vulnerabilities discovered by Tenable.cs in cloud hosts and container images into ServiceNow automatically. * Enabling remediation workflows to triage, assign, and resolve the most critical vulnerabilities across cloud-native and containerized environments. * Using the Setup Assistant to easily configure credentials and integration parameters---get started with minimal manual setup. * Scheduling jobs to run periodically to import findings from Tenable.cs, create vulnerable items (for cloud hosts), create container vulnerable items and associate them with the relevant cloud resources and container image records. [Assess vulnerability exposure by publisher](https://www.servicenow.com/docs/access?context=vr-ws-exposure-publisher&family=yokohama&ft:locale=en-US) :   Starting with v5.0 of Vulnerability Exposure Assessment, a publisher-based assessment is introduced that enables you to assess the vulnerability impact by vendor. For example, Microsoft, and Red Hat. By focusing on recently disclosed vulnerabilities from critical vendors, you can prioritize remediation and proactively address threats, improving your overall security posture. [View risk score details of a vulnerable item in the Work notes section](https://www.servicenow.com/docs/access?context=vuln-calculators-rules&family=yokohama&ft:locale=en-US) :   Starting with v25.0.3 of Vulnerability Response, the system property sn_sec_cmn.risk_score_changes_add_worknotes is inactive by default. If you enable it, only then you can see all the changes related to the risk score of a vulnerable item in the Work notes section. Additionally, the work notes are updated only if there's a change in the risk score. [Quick Start Tests for Vulnerability Response](https://www.servicenow.com/docs/access?context=available-quick-start-tests&family=yokohama&ft:locale=en-US) :   After upgrades and deployments of new applications or integrations, run quick start tests to verify that Vulnerability Response works as expected. If you customized Vulnerability Response, copy the quick start tests and configure them for your customizations. [Enhancements to exception rules handling](https://www.servicenow.com/docs/access?context=direct-deferral-of-vits-by-exception-rules-without-remediation-task-creation&family=yokohama&ft:locale=en-US) : * Exception rules are reevaluated with nightly scheduled jobs. * Vulnerable items that no longer match exception rule conditions are unlinked from remediation tasks. * A deferred vulnerable item (VIT) is reopened if it doesn't match any active exception rules. * Exception rules don't create remediation tasks. VITs are deferred directly and aren't associated with a remediation task. [Tenable's endpoint scanning integration](https://www.servicenow.com/docs/access?context=tenable-io-integrations-list&family=yokohama&ft:locale=en-US) :   Support for Tenable's endpoint scanning integration to retrieve scan metadata. The integration fetches scan details using the last_schedule_id from existing asset data in Tenable.io. Reopened Count field on vulnerable items :   Added the Reopened Count field on vulnerable items to track the number of times their states change from 'Closed' to 'Open' or to 'Active'. [Out-of-the-box vendor advisories via Common Security Advisory Framework (CSAF) integration](https://www.servicenow.com/docs/access?context=vuln-solution-mgmt&family=yokohama&ft:locale=en-US) :   The following vendor advisories are configured out-of-the-box and are automatically activated when the Solution Management plugin is enabled: Redhat and Suse. |
| Zurich | [Remediation task rule execution mode](https://www.servicenow.com/docs/access?context=sem-grouping-multiple-findings-remediation-tasks-processing&family=zurich&ft:locale=en-US) :   You can now choose how remediation task rules are evaluated during ingestion. The new Match First execution mode evaluates rules sequentially and applies only the first matching rule, assigning each finding to exactly one remediation task. The default Match All mode continues to evaluate all applicable rules. [Unified Microsoft Defender Integration for Security Exposure Management](https://www.servicenow.com/docs/access?context=mstvm-integration&family=zurich&ft:locale=en-US) :   The Microsoft Defender for Cloud and Microsoft Threat and Vulnerability Management (MS TVM) integrations are now consolidated into a single plugin, Microsoft Defender Integration for Security Exposure Management. the standalone Microsoft Defender for Cloud Integration application is deprecated. The unified plugin also introduces container image vulnerability ingestion from Microsoft Defender for Cloud, creating Container Vulnerable items on your instance. The deprecated application are supported through a guided migration path to transfer existing data to the unified plugin. [Optimized Tenable.io Compliance Results ingestion](https://www.servicenow.com/docs/access?context=tenable-io-integrations-list&family=zurich&ft:locale=en-US) :   Starting with v 6.1.3, the Tenable.io Compliance Results Integration is replaced by the Tenable.io Fixed Compliance Results Integration and Tenable.io Open Compliance Results Integration. Compliance results are now imported based on their status, optimizing ingestion performance and scalability for environments with large volumes of compliance data while keeping remediation and compliance tracking aligned with the current state of findings. [Improved vulnerability assessment workflows](https://www.servicenow.com/docs/access?context=vr-ws-vuln-assessment&family=zurich&ft:locale=en-US) : * CI filtering for vulnerability assessments: You can now filter which configuration items are included in a vulnerability assessment using a condition builder. * Business Application population on AVITs: AVITs created from SBOM assessment results now include Business Application information, helping you understand application impact and prioritize remediation. * Priority roll‑down from vulnerability assessments: Updates to the priority of a vulnerability assessment now automatically roll down to associated VITs and AVITs, ensuring consistent prioritization based on the highest severity. [Enhanced Compensatory controls](https://www.servicenow.com/docs/access?context=requesting-approving-risk-reduction&family=zurich&ft:locale=en-US) :   When new vulnerable items are ingested and associated with a remediation task that already has an approved compensating control, the reduced risk rating is now automatically inherited by those new vulnerable items. [Qualys Integration -- API enhancements](https://www.servicenow.com/docs/access?context=qualys-rest-messages&family=zurich&ft:locale=en-US) :   Qualys Integration has been upgraded to support newer Qualys API versions across Host Detection, Host List, Knowledgebase, PC Controls, PC Policies, and PCRS integrations. The integrations now ingest additional data fields, including vulnerability detection source, authentication privilege status, active status for controls and policies, and cloud metadata, giving you better visibility into your vulnerability and compliance data. [Enhancements to the Wiz Vulnerability Response Integration](https://www.servicenow.com/docs/access?context=vr-wiz-exploring-host-cf&family=zurich&ft:locale=en-US) : * The Universally Unique Identifier (UUID) that identifies detections for the Wiz Host Vulnerability integration will be mapped to a detection key. Note: This enhancement is supported for new customers only. For existing customers, the detection key for the Wiz Host Vulnerability integration is created using the combination of vulnerability, asset_id, and proof. * You can configure the First parameter for the Wiz Asset Integration to help you resolve 504 errors. You can reduce the page size if you're having memory issues or generating errors. The default value is 500. [Enhancements to the Vulnerability Response Integration with Wiz](https://www.servicenow.com/docs/access?context=vr-wiz-exploring-host-cf&family=zurich&ft:locale=en-US) :   The Missing Assets \[sn_vul_wiz_missing_asset\] is deprecated. After updating to version 1.1, you must backdate your existing primary Wiz integrations by three days and run them. The backfill integrations are activated by default. After you backdate and run your primary integrations, the following backfill integrations are no longer required: * Host Vulnerability Backfill Integration * Test Results Backfill Integration * Host Test Results Backfill Integration * Issues Backfill Integration Resource types filters are supported on the Host Vulnerability, Host Test Results, Test Results, and Issues tabs on the Wiz Configuration page. Additional attributes imported from Wiz that are not stored in the Discovered items \[sn_sec_cmn_src_ci\] table are stamped with Asset Attributes in this table. Test results from the Host misconfiguration integration are classified as result type 'host_misconfiguration'. Data for resources that have the validated_at_runtime flag set to 'yes' is imported and populated on detections. The is_ignored column is deprecated on the Host Test Results and Test Results Integrations. This column was replaced by the is_result_ignored column. The CMDB internet-facing field on the discovered item is mapped to Limited Internet Exposure on findings. Column length for the descriptions in the Host Vulnerability import table has been increased. [Improved remediation target date handling](https://www.servicenow.com/docs/access?context=sem-recalculate-rt-date&family=zurich&ft:locale=en-US) :   Remediation target (RT) dates now dynamically recalculate when a finding's risk rating changes. Administrators can configure how recalculation occurs to verify RT dates remain accurate and align with the latest risk updates, helping maintain consistent and reliable SLA tracking. [Identify Wiz Resource Types for import](https://www.servicenow.com/docs/access?context=wiz-assets-resources-tab&family=zurich&ft:locale=en-US) :   Identify the Resource Types (assets) that are reported by Wiz that you want to import with the Wiz Integration Resource Type configuration page in your ServiceNow AI Platform instance. The Resource Types that you select apply to all the primary Wiz vulnerability and compliance integrations except the Wiz Container Vulnerability Integration. See the [Wiz Vulnerability Response Integrations](https://www.servicenow.com/docs/access?context=vr-wiz-exploring-host-cf&family=zurich&ft:locale=en-US) for more information about the vulnerability and compliance integrations. [Wiz Backfill Integrations](https://www.servicenow.com/docs/access?context=wiz-backfill&family=zurich&ft:locale=en-US) :   Retrieve and process data stored on the Wiz Missing Assets \[sn_vul_wiz_missing_asset\] table for assets that were not processed by the primary Host Vulnerability Integration with a specialized Wiz Backfill Integration. The Host Vulnerability Backfill Integration is activated by default. Note: The Wiz Asset Integration and the Wiz Container Vulnerability Integration do not have backfill integrations. The Wiz Asset Integration can discover assets and create and update discovered item records on the Discovered item \[sn_sec_cmn_src_ci\] table. The Wiz Container Vulnerability Integration imports and processes discovered container image records. [Enhancements to Detection Key Configurations for Vulnerability Response](https://www.servicenow.com/docs/access?context=detection-key-configurations-for-vr&family=zurich&ft:locale=en-US) :   Introduced configurable detection keys that enable you to choose between Asset ID and Configuration Item, with validations, UI controls. Enhanced an existing schedule job to update existing detections. [Import host vulnerability data with the Vulnerability Response Integration with Wiz](https://www.servicenow.com/docs/access?context=vr-wiz-exploring-host-cf&family=zurich&ft:locale=en-US) :   Import host vulnerability findings related to virtual machines and serverless assets in your cloud environment with the Wiz Host Vulnerability Integration. These findings are mapped to Host Vulnerable Items (VITs) within the Vulnerability Response application to support remediation workflows. [Modify the severity for a CVE or TPE](https://www.servicenow.com/docs/access?context=vmws-modify-reset-severity&family=zurich&ft:locale=en-US) :   Vulnerability managers and vulnerability analysts can now adjust the severity of common vulnerabilities and exposures (CVEs) and third-party entries (TPEs) from the list view in the vulnerability manager workspace. The risk level of the associated vulnerabilities will be recalculated during the scheduled jobs based on the modified severity. You can also reset the severity to its original source value if required. [Questionnaire Support in Exception Management via Smart Assessment](https://www.servicenow.com/docs/access?context=vr-exception-management-smart-assessment&family=zurich&ft:locale=en-US) :   Configure advanced questionnaires as part of the exception management process using Smart Assessment. This enhancement enables remediation owners to provide detailed context for exception requests and enables approvers to configure conditional questions to gather information for informed decision making. * Collaboration and streamlined approval: Facilitate collaboration between your vulnerability management and remediation teams by streamlining the approval process with clear and complete exception justifications. * Mandatory questionnaires: Block the submission of exception requests until mandatory questionnaires are completed. If a questionnaire is marked as mandatory, the test results and its associated remediation tasks remain in the 'Open' state until the questionnaire is completed and submitted. * If the questionnaire is incomplete, the state change approval record is saved as 'Draft'. Only after completing the questionnaire can the user submit the exception request, which will then move the test results or remediation tasks to the 'In Review' state. [Lookup rules enhancements](https://www.servicenow.com/docs/access?context=working-unmatched-cis&family=zurich&ft:locale=en-US) :   When you reapply Lookup rules, Discovered items (DIs) that have been inactive for more than 90 days are ignored. These Discovered items (DIs) are also excluded from licensing considerations. Removing them from the lookup logic can improve performance and reduce processing time. * Background job enhancements: New fields have been added to help you view successfully evaluate records, the time taken for processing, the time remaining, and an estimated number of records. * Improved accuracy for non-CSDM Vulnerability Response users: A system property (sn_sec_cmn.ci_lifecycle_status_source) has been introduced to help users who do not follow Common Service Data Model (CSDM) standards. This property verifies that Discovered items (DIs) and associated VITs are properly marked as Decommissioned and are excluded from the CI Lookup. Additionally, the Retired Configuration Items PA indicator has been updated to accurately reflect CIs based on the decommissioning flags. * The scheduled job to create reconcile unmatched discovered items feature is deprecated. You can "Reapply Look up Rules" for selected or filtered items in the discovered items table view. [Tenable.cs integrations with the Vulnerability Response and Container Vulnerability Response application](https://www.servicenow.com/docs/access?context=tenable-cs-integrations-list&family=zurich&ft:locale=en-US) :   The Vulnerability Response Integration with Tenable application now supports data ingestion from Tenable.cs, enabling you to bring in cloud and container vulnerabilities directly into ServiceNow. This integration enhances your ability to prioritize and remediate vulnerabilities identified in Tenable cloud resources and container images. Key capabilities are: * Importing vulnerabilities discovered by Tenable.cs in cloud hosts and container images into ServiceNow automatically. * Enabling remediation workflows to triage, assign, and resolve the most critical vulnerabilities across cloud-native and containerized environments. * Using the Setup Assistant to easily configure credentials and integration parameters---get started with minimal manual setup. * Scheduling jobs to run periodically to import findings from Tenable.cs, create vulnerable items (for cloud hosts), create container vulnerable items and associate them with the relevant cloud resources and container image records. [Assess vulnerability exposure by publisher](https://www.servicenow.com/docs/access?context=vr-ws-exposure-publisher&family=zurich&ft:locale=en-US) :   Starting with v5.0 of Vulnerability Exposure Assessment, a publisher-based assessment is introduced that enables you to assess the vulnerability impact by vendor. For example, Microsoft, and Red Hat. By focusing on recently disclosed vulnerabilities from critical vendors, you can prioritize remediation and proactively address threats, improving your overall security posture. [View risk score details of a vulnerable item in the Work notes section](https://www.servicenow.com/docs/access?context=vuln-calculators-rules&family=zurich&ft:locale=en-US) :   Starting with v25.0.3 of Vulnerability Response, the system property sn_sec_cmn.risk_score_changes_add_worknotes is inactive by default. If you enable it, only then you can see all the changes related to the risk score of a vulnerable item in the Work notes section. Additionally, the work notes are updated only if there's a change in the risk score. [Quick Start Tests for Vulnerability Response](https://www.servicenow.com/docs/access?context=available-quick-start-tests&family=zurich&ft:locale=en-US) :   After upgrades and deployments of new applications or integrations, run quick start tests to verify that Vulnerability Response works as expected. If you customized Vulnerability Response, copy the quick start tests and configure them for your customizations. [Enhancements to exception rules handling](https://www.servicenow.com/docs/access?context=direct-deferral-of-vits-by-exception-rules-without-remediation-task-creation&family=zurich&ft:locale=en-US) : * Exception rules are reevaluated with nightly scheduled jobs. * Vulnerable items that no longer match exception rule conditions are unlinked from remediation tasks. * A deferred vulnerable item (VIT) is reopened if it doesn't match any active exception rules. * Exception rules don't create remediation tasks. VITs are deferred directly and aren't associated with a remediation task. [Tenable's endpoint scanning integration](https://www.servicenow.com/docs/access?context=tenable-io-integrations-list&family=zurich&ft:locale=en-US) :   Support for Tenable's endpoint scanning integration to retrieve scan metadata. The integration fetches scan details using the last_schedule_id from existing asset data in Tenable.io. Reopened Count field on vulnerable items :   Added the Reopened Count field on vulnerable items to track the number of times their states change from 'Closed' to 'Open' or to 'Active'. [Out-of-the-box vendor advisories via Common Security Advisory Framework (CSAF) integration](https://www.servicenow.com/docs/access?context=vuln-solution-mgmt&family=zurich&ft:locale=en-US) :   The following vendor advisories are configured by default and are automatically activated when the Solution Management plugin is enabled: Redhat and Suse. |
| Australia | [Schedule patch deployments through Change Request approval](https://www.servicenow.com/docs/access?context=vr-ws-patch-schedule-change-request&family=australia&ft:locale=en-US) :   Route patch deployments scheduled from remediation tasks through Change Request approval for Microsoft SCCM and HCL BigFix integrations. This lets you align patch deployment for critical vulnerabilities with your organization's change management approval process, and optionally deploy the patch automatically once the change is approved. [Modify risk rating in bulk](https://www.servicenow.com/docs/access?context=sem-modify-risk&family=australia&ft:locale=en-US) :   Vulnerability Admins can now modify risk rating directly on individual or bulk findings across host, application, or container vulnerable item, or on a remediation task without an approval workflow. Remediation Owners can also modify risk ratings, with changes routed through a change approval process. Associating a compensating control with the change is optional for all roles. [Automatic re-evaluation of remediation tasks on preferred solution change](https://www.servicenow.com/docs/access?context=vulnerability-groups&family=australia&ft:locale=en-US) :   Remediation tasks can now automatically re-evaluate vulnerable items when their Preferred solution changes, so items are regrouped into the appropriate remediation task without manual intervention. This helps keep remediation tasks accurate and reduces manual cleanup. [Automatically create vulnerable items and application vulnerable items during assessment](https://www.servicenow.com/docs/access?context=vr-va-ws-cve-exposure-assessment-api&family=australia&ft:locale=en-US) :   Vulnerability assessments now support an Auto-create VITs/AVITs option that automatically creates vulnerable items and application vulnerable items for their affected configuration items and products, removing the need for a separate manual create step. The new CVE Exposure Assessment REST API lets external systems set this option when creating a vulnerability assessment record, or trigger a CVE exposure assessment independently. [Streamline Microsoft SCCM data ingestion with JDBC](https://www.servicenow.com/docs/access?context=mspatch-integration&family=australia&ft:locale=en-US) :   Connect to Microsoft SCCM using JDBC (Java Database Connectivity) to query the SCCM database directly for collection, device, patch update, and deployment status data. Opening a firewall port for WMI (Windows Management Instrumentation) RPCs (remote procedure calls) is no longer required for these queries. A WMI connection remains required to deploy patches, because patch deployment continues to use the Microsoft SCCM API over WMI. [Enhancements to the Invicti Vulnerability Integration](https://www.servicenow.com/docs/access?context=invicti-vuln-integration&family=australia&ft:locale=en-US) :   Added the Invicti Platform Integration. Support for the Invicti Platform APIs introduces three new integration jobs that connect directly to the Invicti Platform cloud service: * Application Integration --- Imports the list of applications being scanned in Invicti Platform into your ServiceNow AI Platform® instance as discovered applications. * Scan Integration --- Pulls scan records from Invicti Platform, providing scan metadata to correlate with vulnerability findings. * Vulnerability Integration --- Imports application vulnerability findings from Invicti Platform and creates or updates application vulnerable items in Vulnerability Response in your ServiceNow AI Platform®. Enhancements to Application life-cycle management: When an application is deleted or decommissioned in Invicti Platform, your ServiceNow AI Platform® automatically deactivates the corresponding discovered application and closes all associated application vulnerable items (AVITs), keeping your vulnerability inventory accurate without manual cleanup. [Activate the Wiz Asset Integration and identify resource types for import](https://www.servicenow.com/docs/access?context=wiz-assets-resources-tab&family=australia&ft:locale=en-US) :   Enhancements to the Wiz integration include: * Starting with version 32.1 (USEM) and version 4.1 (non-USEM), the Asset integration is deactivated by default and is not a mandatory prerequisite for the other Wiz integration imports. If you choose to activate it, the Asset integration will retrieve assets for all resource types if you don't specify the ones you want on the Asset Integration Configuration tab. To avoid importing vulnerability data you don't need, identify only the resources (assets) that you want to import with this integration. * Resource Type is no longer a mandatory field for configuring the Vulnerability Response Integration with Wiz. You can now save Wiz configurations for the integrations without specifying a Resource Type, simplifying setup for use cases where specifying a Resource Type isn't appropriate. [Enhancement to Vulnerability Response CI lookup rule configuration](https://www.servicenow.com/docs/access?context=create-ci-identifier-rules&family=australia&ft:locale=en-US) :   The Applies to field is added to Configuration (CI) lookup rule records. For third-party and ServiceNow® integrations that support both Application Vulnerability Response (AVR) and Vulnerability Response (VR) lookup rules, like the Vulnerability Response Integration with Wiz, for example, select one for a rule: * Discovered Application for Application Vulnerability Response lookup rules. * Discovered Item for Vulnerability Response lookup rules. Note: The field is left empty by default. If you leave this field empty for lookup rules that support both VR and AVR integrations, background jobs for both applications apply changes on the same set of lookup rules. This state might cause a conflict and set the reapply flag incorrectly. With this distinction set, after the respective background jobs for AVR and VR are completed, the system resets the flag only for the lookup rules for the background job that was run. [AWS Integration for Security Exposure Management](https://www.servicenow.com/docs/access?context=aws-integration-for-security-exposure-management-overview&family=australia&ft:locale=en-US) :   The AWS Integration for Security Exposure Management supports integrations with the following AWS services: * AWS Inspector is an automated vulnerability management service that continuously scans EC2 instances, ECR container images, and Lambda functions for software vulnerabilities (CVEs) and unintended network exposure. The Vulnerability Response integration with AWS Inspector imports host and container vulnerability findings from AWS Inspector. * AWS Security Hub is a security service that is used to centralize and update security checks across AWS accounts. It provides a unified view of security alerts and compliance status by integrating with various AWS services. The Vulnerability Response integration with AWS Security Hub imports host, container vulnerabilities, and misconfigurations from AWS Security Hub. [Unified Microsoft Defender Integration for Security Exposure Management](https://www.servicenow.com/docs/access?context=ms-defender-sem&family=australia&ft:locale=en-US) :   The Microsoft Defender for Cloud and Microsoft Defender Threat and Vulnerability Management (MS TVM) plugins are now consolidated into a single plugin: Microsoft Defender Integration for Security Exposure Management. This consolidation deprecates the standalone Microsoft Defender for Cloud plugin. The unified plugin also introduces container image vulnerability ingestion from Microsoft Defender for Cloud, creating Container Vulnerable Items on your instance. A guided migration path is available to transfer existing data from the deprecated applications to the unified plugin. [Optimized Tenable.io Compliance Results ingestion](https://www.servicenow.com/docs/access?context=tenableIntegration&family=australia&ft:locale=en-US) :   Starting with v 6.1.3, the Tenable.io Compliance Results Integration is replaced by the Tenable.io Fixed Compliance Results Integration and Tenable.io Open Compliance Results Integration. Compliance results are now imported based on their status, optimizing ingestion performance and scalability for environments with large volumes of compliance data while keeping remediation and compliance tracking aligned with the current state of findings. [Qualys Integration -- API enhancements](https://www.servicenow.com/docs/access?context=c_QualysVulnIntegration&family=australia&ft:locale=en-US) :   The Qualys Vulnerability Integration has been upgraded to support newer Qualys API versions across Host Detection, Host List, Knowledgebase, PC Controls, PC Policies, and PCRS integrations. The integrations now ingest additional data fields, including vulnerability detection source, authentication privilege status, active status for controls and policies, and cloud metadata, giving you better visibility into your vulnerability and compliance data. Use the new `posture_api_version` integration instance parameter to choose between the default v2.0 APIs or the newer v5.0 streaming APIs for the PCRS Policy Host and PCRS Test Results integrations. [Vulnerability Data Management with Central Vulnerability Database (CVDB)](https://www.servicenow.com/docs/access?context=cvd-overview&family=australia&ft:locale=en-US) :   The Central Vulnerability Database (CVDB) introduces a unified, source-agnostic vulnerability data layer that consolidates data from multiple sources into a single authoritative record, improving accuracy, consistency, and traceability. Key capabilities include: * Unified vulnerability record: Correlates vulnerability data from multiple sources, supports sources including National Vulnerability Database (NVD), scanner intelligence, European Union Vulnerability Database, Japanese Vulnerability Database, and vulnerability intelligence feeds. * Priority-based data reconciliation configuration: * Field-level priority: Ensures each attribute (e.g., CVSS, remediation, exploit status) can be configured from the most reliable provider. * Source-level priority: Applies a global ranking when field-level rules are not defined. * Hybrid model: Field-level rules take precedence, with source-level fallback; all source data is preserved for full traceability. * Source attribution and traceability: Maintains detailed source metadata, timestamps, and change history to ensure full auditability and transparency. * Data enrichment: Combines CVSS scores, exploit intelligence, and remediation guidance to provide a richer and more actionable vulnerability context. |
[ ]

## Changes

Between your current release family and Australia, some changes were made to existing Vulnerability Response features.  
{#dfrn3-vulnerabilityresponse-summary__entry__22}

| Release | Release notes |
|-|-|
| Xanadu | [Deprecated the privilege to delete a vulnerable item for the Admin role](https://www.servicenow.com/docs/access?context=installed-with-vr&family=xanadu&ft:locale=en-US) :   As a vulnerability admin \[sn_vul.vulnerability_admin\], you can't delete a vulnerable item. This privilege is now given to the sn_vul.delete granular role. [Deprecated the privilege to delete source records for the sn_vul.admin and sn_vul.admin_solutions roles](https://www.servicenow.com/docs/access?context=installed-with-vr&family=xanadu&ft:locale=en-US) :   The privilege to delete the source records has been deprecated for the sn_vul.admin and sn_vul.admin_solutions roles. This privilege is given to the sn_vul_cmn.delete granular role. |
| Yokohama | No updates for this release. |
| Zurich | Coral theme :   Coral is now the default theme for new portal, web, and mobile experiences with Next Experience or Core UI enabled. This theme provides a fresh look and feel, featuring brand-neutral illustrations to enhance your user experience. A dark theme option is available for web and mobile experiences. [Enhanced UI experience in workspaces when reassigning vulnerable items](https://www.servicenow.com/docs/access?context=using-vulnerability-manager-workspace&family=zurich&ft:locale=en-US) :   When you reassign a record (VIT, AVIT, CVIT, or CTR) in workspace to a group you're not a member of, the system now confirms the reassignment and displays a clearer message explaining why the record is no longer visible. This helps you understand that access is now limited to the new assignment group, reducing confusion. [Granular VIT creation for Microsoft TVM recommendations](https://www.servicenow.com/docs/access?context=vr-configure-vi-key&family=zurich&ft:locale=en-US) :   You can now configure recommendation as a vulnerability item (VIT) key for Microsoft Threat \& Vulnerability Management (TVM). This enhancement enables each recommendation to generate a separate vulnerable item, offering more granular control for tracking, assigning, and managing remediation efforts, especially when different recommendations require actions from different teams. [Improved state management for remediation tasks and vulnerable items](https://www.servicenow.com/docs/access?context=vr-rt-states&family=zurich&ft:locale=en-US) :   State management logic for roll down of state from remediation tasks (RTs) to findings and roll up of state from findings to RTs has been refined across all modules. Updates improve accuracy by handling mixed item states (a combination of Deferred and Closed), supporting closure of tasks in sub-states like In-Review, and reopening tasks based on the Assigned To field. The update also improves handling of False Positive state transitions based on scanner results as source of truth. These enhancements reduce manual effort, clarify task ownership, and streamline remediation workflows. [Ability to manually cancel Exposure Assessment background jobs](https://www.servicenow.com/docs/access?context=vr-ws-exposure-assessment&family=zurich&ft:locale=en-US) :   Vulnerability Admins and Event Managers can now cancel Exposure Assessment background jobs that were triggered with incorrect parameters or are taking longer than expected. This enhancement reduces downtime by removing the need to wait for the job to complete. After the job is cancelled, the substate is immediately set to User cancelled, and the state updates to Complete after the job is fully terminated; giving you better control and flexibility. [Configure maximum rows in related lists](https://www.servicenow.com/docs/access?context=vr-max-rows-rel-list&family=zurich&ft:locale=en-US) :   To improve readability and performance, you can now limit the number of rows shown in related lists on forms by setting the system property sn_vul_cmn.related_list.set_max_row. [Qualys Integration -- Detection Splitting](https://www.servicenow.com/docs/access?context=split-qualys-detections&family=zurich&ft:locale=en-US) :   Use the Qualys Host Detection Integration to create a separate VIT for each vulnerability instance based on proof. This improves accuracy in vulnerability tracking and supports clearer team ownership during remediation. [Activate the QVS score integration](https://www.servicenow.com/docs/access?context=enable-qualys-qvs-score&family=zurich&ft:locale=en-US) :   Add risk context specific to Qualys to CVEs by importing QVS scores, helping you make more informed prioritization decisions. |
| Australia | Risk rating options are no longer part of exception or deferral requests :   Changing a risk rating is no longer available from the Request Exception dialog, or from the Bulk Edit dialog by selecting Mitigating Control in Place as a deferral reason. Risk rating and compensating control fields have been removed from both. Use Modify risk or Request risk modification, according to your role, to change a risk rating instead for individual records or in bulk. [Vulnerability Response assignment rules](https://www.servicenow.com/docs/access?context=vr-assignment-rules&family=australia&ft:locale=en-US) :   The sn_vul.rerun_task_rules system property for rerunning assignment rules was changed to sn_sec_rem.rerun_task_rules. Users must activate this property (set to 'true') to rerun assignment rules. [Improved vulnerability assessment workflows](https://www.servicenow.com/docs/access?context=vr-ws-vuln-assessment&family=australia&ft:locale=en-US) : * CI filtering for vulnerability assessments: You can now filter which configuration items are included in a vulnerability assessment using a condition builder. * Business Application population on AVITs: AVITs created from SBOM assessment results now include Business Application information, helping you understand application impact and prioritize remediation. * Priority roll‑down from vulnerability assessments: Updates to the priority of a vulnerability assessment now automatically roll down to associated VITs and AVITs, ensuring consistent prioritization based on the highest severity. [Remediation task rule execution mode](https://www.servicenow.com/docs/access?context=sem-grouping-multiple-findings-remediation-tasks-processing&family=australia&ft:locale=en-US) :   You can now choose how remediation task rules are evaluated during ingestion. The new Match First execution mode evaluates rules sequentially and applies only the first matching rule, assigning each finding to exactly one remediation task. The default Match All mode continues to evaluate all applicable rules. [Enhanced Compensatory controls](https://www.servicenow.com/docs/access?context=requesting-approving-risk-reduction&family=australia&ft:locale=en-US) :   When new vulnerable items are ingested and associated with a remediation task that already has an approved compensating control, the reduced risk rating is now automatically inherited by those new vulnerable items. |
[ ]

## Removed

Between your current release family and Australia, some Vulnerability Response features or functionality were removed.  
{#dfrn3-vulnerabilityresponse-summary__entry__32}

| Release | Release notes |
|-|-|
| Xanadu | The Close button has been removed for a remediation task in the Classic UI, Vulnerability Manager Workspace, and IT Remediation Workspace. |
| Yokohama | No updates for this release. |
| Zurich | No updates for this release. |
| Australia | No updates for this release. |
[ ]

## Deprecations

Between your current release family and Australia, some Vulnerability Response features or functionality were deprecated.  
{#dfrn3-vulnerabilityresponse-summary__entry__42}

| Release | Release notes |
|-|-|
| Xanadu | No updates for this release. |
| Yokohama | No updates for this release. |
| Zurich | No updates for this release. |
| Australia | No updates for this release. |
[ ]

## Activation information

Review information on how to activate Vulnerability Response.  
{#dfrn3-vulnerabilityresponse-summary__entry__52}

| Release | Release notes |
|-|-|
| Xanadu | No updates for this release. |
| Yokohama | Activation information :   Install Vulnerability Response by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=yokohama&ft:locale=en-US). Important: Vulnerability Response is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. |
| Zurich | Activation information :   Install Vulnerability Response and third-party integrations by requesting them from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=zurich&ft:locale=en-US). Important: Vulnerability Response is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. |
| Australia | Activation information :   Install Vulnerability Response and supported third-party integrations by requesting them from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) to view all the available apps, and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=australia&ft:locale=en-US). Important: Vulnerability Response is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. |
[ ]

## Additional requirements

If any additional requirements were introduced or changed for Vulnerability Response we have noted them here.  
{#dfrn3-vulnerabilityresponse-summary__entry__62}

| Release | Release notes |
|-|-|
| Xanadu | No updates for this release. |
| Yokohama | No updates for this release. |
| Zurich | No updates for this release. |
| Australia | No updates for this release. |
[ ]

## Browser requirements

If any specific browser requirements were introduced or changed for Vulnerability Response we have noted them here.  
{#dfrn3-vulnerabilityresponse-summary__entry__72}

| Release | Release notes |
|-|-|
| Xanadu | No updates for this release. |
| Yokohama | No updates for this release. |
| Zurich | No updates for this release. |
| Australia | No updates for this release. |
[ ]

## Accessibility information

Review details on accessibility information for Vulnerability Response, such as specific requirements or compliance levels.  
{#dfrn3-vulnerabilityresponse-summary__entry__82}

| Release | Release notes |
|-|-|
| Xanadu | No updates for this release. |
| Yokohama | No updates for this release. |
| Zurich | Accessibility information : Dark theme :   The new Coral theme includes a dark theme option for web and mobile experiences. This option is commonly used to alleviate eye strain and improve readability. |
| Australia | No updates for this release. |
[ ]

## Localization information

If there are specific localization considerations for Vulnerability Response we have noted them here.  
{#dfrn3-vulnerabilityresponse-summary__entry__92}

| Release | Release notes |
|-|-|
| Xanadu | No updates for this release. |
| Yokohama | No updates for this release. |
| Zurich | No updates for this release. |
| Australia | No updates for this release. |
[ ]

## Highlight information

If there are specific highlight considerations for Vulnerability Response we have noted them here.  
{#dfrn3-vulnerabilityresponse-summary__entry__102}

| Release | Release notes |
|-|-|
| Xanadu | * Reevaluate the risk score, assignments, remediation target date, exceptions, and remediation task for a set of vulnerable items in the Vulnerability Manager Workspace. * Reassess the vulnerable item records from the workspace. * Navigate to the Exposure Assessment page in the Vulnerability Manager Workspace or Vulnerability Assessment Workspace from the All menu with the Vulnerability Response Pro or Enterprise subscription. * View risk rating-related changes in the Work notes section. * Access information on how an item's risk score is adjusted according to modifications in the vulnerability calculators. See [Vulnerability Response](https://www.servicenow.com/docs/access?context=vuln-landing-page&family=xanadu&ft:locale=en-US) for more information about Vulnerability Response. See the [Vulnerability Response Compatibility Matrix and Release Schema Changes](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0856498) Knowledge Base article for more information about released Security Operations applications and their version compatibility. |
| Yokohama | * With the sn_vul.vulnerability_analyst or sn_vul.vulnerability_admin role, create host remediation tasks manually in the Vulnerability Manager Workspace. * With the sn_vul.remediation_owner role, create host remediation tasks manually in the IT Remediation Workspace. See [Vulnerability Response](https://www.servicenow.com/docs/access?context=vuln-landing-page&family=yokohama&ft:locale=en-US) for more information about the Vulnerability Response application. See the [Vulnerability Response Compatibility Matrix and Release Schema Changes](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0856498) Knowledge Base article for more information about released Security Operations applications and their version compatibility. |
| Zurich | * If you're currently using Vulnerability Response and you want to upgrade to Unified Security Exposure Management (USEM), see [Unified Security Exposure Management release notes](https://www.servicenow.com/docs/access?context=secops-sem-rn&family=zurich&ft:locale=en-US) for more information about USEM and the Unified Security Exposure Management migration. * Import host vulnerability data from the Wiz scanners into Vulnerability Response VITs to help vulnerability managers assess your over-all cloud security posture. * With the sn_vul.vulnerability_analyst or sn_vul.vulnerability_admin role, create host remediation tasks manually in the Vulnerability Manager Workspace. * With the sn_vul.remediation_owner role, create host remediation tasks manually in the IT Remediation Workspace. See [Vulnerability Response](https://www.servicenow.com/docs/access?context=vuln-landing-page&family=zurich&ft:locale=en-US) for more information. |
| Australia | * The AWS Integration for Security Exposure Management supports integrations with AWS Inspector and AWS Security Hub. * The Central Vulnerability Database (CVDB) introduces a source-agnostic vulnerability data layer that consolidates data from multiple sources, improving accuracy and traceability. * Define the number of background jobs that run concurrently to reduce system resource consumption, with a new Background Job Configuration tile available in the Vulnerability Manager Workspace Admin console under the Others section. See [Vulnerability Response](https://www.servicenow.com/docs/access?context=vuln-landing-page&family=australia&ft:locale=en-US) for more information. |
[ ]