---
sourceDocument: brazil Combined Product Files
sourceDocumentLink: https://www.servicenow.com/docs/r/delta-australia-brazil

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - brazil Combined Product Files

ft:clusterId :

    - delta3ba

bundleId :

    - delta3ba


---

# Combined Vulnerability Response release notes for upgrades from Australia to Brazil

# Combined Vulnerability Response release notes for upgrades from Australia to Brazil {#ariaid-title1}

Release version: Brazil  
Updated October 8, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 13 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Combined Vulnerability Response Release Notes for Upgrades from Australia to Brazil

This consolidated guide covers key updates, new features, changes, and important upgrade information for ServiceNow Vulnerability Response from the Australia release through to Brazil.
It is designed to help ServiceNow customers prepare for and smoothly transition their Vulnerability Response capabilities to the Brazil release, ensuring they leverage new functionalities and remain aligned with best practices in vulnerability and security exposure management.
Show full answer Show less  

## Important Upgrade Information

* **Now Assist Deprecation:** Starting with Australia Patch 5, Now Assist for Vulnerability Response is being deprecated and replaced by **ServiceNow Otto for Unified Security Exposure Management (USEM)**. Existing entitlements remain unchanged.
* **Patch Deployment Fields:** Deprecated single-value Patch update and Collection fields are replaced by multi-value fields supporting multiple patches and collections in one deployment; existing data is migrated automatically during upgrade.
* **Security Support Common Plugin:** Activated automatically with main Security Operations apps including Vulnerability Response, starting with Brazil.
* **Activation:** Vulnerability Response and third-party integrations must be installed or requested via the ServiceNow Store.

## Key New Features and Enhancements

* **Patch Deployment via Change Request Approval:** Schedule and route patch deployments through Change Request approvals for Microsoft SCCM and HCL BigFix integrations, aligning patching with organizational change management.
* **Bulk Risk Rating Modification:** Vulnerability Admins can modify risk ratings directly on single or multiple findings or remediation tasks without an approval workflow; Remediation Owners can do so with approval routing.
* **Automatic Re-Evaluation of Remediation Tasks:** Vulnerable items are automatically regrouped when preferred solutions change, reducing manual task cleanup.
* **Auto-Creation of Vulnerable Items During Assessment:** Vulnerability assessments can now automatically create vulnerable items and application vulnerable items, streamlining workflows and enabling external systems to trigger assessments via the new CVE Exposure Assessment REST API.
* **Microsoft SCCM JDBC Integration:** Direct database queries via JDBC reduce the need to open firewall ports for WMI RPCs during data ingestion; WMI remains required for patch deployment.
* **Invicti Platform Integration:** New integration jobs import application data, scans, and vulnerability findings, with automatic lifecycle management of applications and vulnerabilities for accuracy.
* **Wiz Integration Improvements:** Asset integration is optional and can be configured to import specific resource types, simplifying setup and focusing data ingestion on relevant assets.
* **Configuration Item Lookup Rule Enhancements:** Added "Applies to" field to distinguish between Application Vulnerability Response and Vulnerability Response rules, preventing conflicts during background job processing.
* **AWS Integration for Security Exposure Management:** Supports importing vulnerabilities and misconfigurations from AWS Inspector and AWS Security Hub, enhancing cloud security visibility.
* **Unified Microsoft Defender Integration:** Consolidates previous Defender plugins into a single plugin supporting container image vulnerabilities and provides a guided migration path.
* **Optimized Tenable.io Compliance Ingestion:** Compliance results ingestion is now status-based, improving performance and scalability for large datasets.
* **Qualys API Enhancements:** Supports newer API versions and ingests richer data fields including authentication status and cloud metadata for improved visibility.
* **Central Vulnerability Database (CVDB):** Introduces a unified, source-agnostic vulnerability data layer consolidating multiple sources with configurable priority rules, comprehensive traceability, and enriched contextual data for more accurate and actionable vulnerability management.

## Changes to Existing Features

* **Risk Rating Management:** Risk rating changes are no longer available via exception or deferral requests. Instead, use dedicated Modify Risk or Request Risk Modification workflows.
* **Assignment Rules:** The system property for rerunning assignment rules was renamed and must be activated to function.
* **Vulnerability Assessment Workflow Enhancements:** Includes CI filtering, business application data on application vulnerable items, priority roll-down from assessments, and choice of remediation task rule execution modes (Match First or Match All).
* **Compensatory Controls:** New vulnerable items inherit reduced risk ratings automatically when linked to remediation tasks with approved compensating controls.

## Removed and Deprecated Features

No features or functionalities were removed or deprecated between the Australia and Brazil releases.

## Practical Benefits for ServiceNow Customers

* Streamlines vulnerability management by integrating patch deployment with change approvals and automating risk rating modifications.
* Improves accuracy and efficiency through automatic reassessment of remediation tasks and auto-creation of vulnerable items.
* Enhances integration capabilities with leading security tools (AWS, Microsoft Defender, Invicti, Tenable, Qualys, Wiz), ensuring comprehensive vulnerability visibility.
* Centralizes vulnerability data into a single authoritative source (CVDB) to reduce noise, improve prioritization, and enable better decision-making.
* Simplifies administration via configurable background  
Consolidated page of all release notes for Vulnerability Response from Australia to Brazil.

## How to use this page

To help you prepare for your upgrade, we have combined the cross-family Vulnerability Response release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Australia to Brazil.  
Tip:  
If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release."

## Important information for upgrading Vulnerability Response to Brazil

Before you upgrade to Brazil, review these pre- and post-upgrade tasks and complete the tasks as needed.  
{#dfrn3-vulnerabilityresponse-summary__entry__2}

| Release | Release notes |
|-|-|
| Australia | Upgrade information :   Starting with Australia Patch 5, Now Assist for Vulnerability Response is being prepared for future deprecation. It will be hidden and no longer installed on new instances but will continue to be supported. For details, see the [Deprecation Process \[KB0867184\]](https://support.servicenow.com/kb_view.do?sysparm_article=KB0867184) article in the Now Support Knowledge Base. ServiceNow Otto® is the new AI experience brand. This change is reflected in the name of ServiceNow products, including the Now Assist for Vulnerability Response product name, which will be replaced with ServiceNow Otto for Unified Security Exposure Management. Your product entitlements remain unchanged. Check your entitlements to determine your access to specific features. If you're currently using Vulnerability Response, and you do not intend to upgrade to Unified Security Exposure Management (USEM), install a version below v30.x of Vulnerability Response and for upgrades to supported third-party integration applications. For more information about the released versions of the Vulnerability Response application as well as the third-party and ServiceNow applications that are compatible with the Australia release, see the [Vulnerability Response Compatibility Matrix and Release Schema Changes \[KB0856498\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0856498) article in the Now Support Knowledge Base Starting with the Australia release, the Patch update and Collection fields on patch deployment records for the Microsoft SCCM and HCL BigFix Patch Orchestration integrations are deprecated in favor of new multi-value Patch updates and Collections fields, which support deploying more than one patch to more than one collection or computer group in a single deployment. Existing values in the deprecated fields are automatically migrated to the new fields during the upgrade. The deprecated fields remain on the form but are no longer used to create new deployments. |
| Brazil | No updates for this release. |
[ ]

## New features

Between your current release family and Brazil, new features were introduced for Vulnerability Response.  
{#dfrn3-vulnerabilityresponse-summary__entry__8}

| Release | Release notes |
|-|-|
| Australia | [Schedule patch deployments through Change Request approval](https://www.servicenow.com/docs/access?context=vr-ws-patch-schedule-change-request&family=australia&ft:locale=en-US) :   Route patch deployments scheduled from remediation tasks through Change Request approval for Microsoft SCCM and HCL BigFix integrations. This lets you align patch deployment for critical vulnerabilities with your organization's change management approval process, and optionally deploy the patch automatically once the change is approved. [Modify risk rating in bulk](https://www.servicenow.com/docs/access?context=sem-modify-risk&family=australia&ft:locale=en-US) :   Vulnerability Admins can now modify risk rating directly on individual or bulk findings across host, application, or container vulnerable item, or on a remediation task without an approval workflow. Remediation Owners can also modify risk ratings, with changes routed through a change approval process. Associating a compensating control with the change is optional for all roles. [Automatic re-evaluation of remediation tasks on preferred solution change](https://www.servicenow.com/docs/access?context=vulnerability-groups&family=australia&ft:locale=en-US) :   Remediation tasks can now automatically re-evaluate vulnerable items when their Preferred solution changes, so items are regrouped into the appropriate remediation task without manual intervention. This helps keep remediation tasks accurate and reduces manual cleanup. [Automatically create vulnerable items and application vulnerable items during assessment](https://www.servicenow.com/docs/access?context=vr-va-ws-cve-exposure-assessment-api&family=australia&ft:locale=en-US) :   Vulnerability assessments now support an Auto-create VITs/AVITs option that automatically creates vulnerable items and application vulnerable items for their affected configuration items and products, removing the need for a separate manual create step. The new CVE Exposure Assessment REST API lets external systems set this option when creating a vulnerability assessment record, or trigger a CVE exposure assessment independently. [Streamline Microsoft SCCM data ingestion with JDBC](https://www.servicenow.com/docs/access?context=mspatch-integration&family=australia&ft:locale=en-US) :   Connect to Microsoft SCCM using JDBC (Java Database Connectivity) to query the SCCM database directly for collection, device, patch update, and deployment status data. Opening a firewall port for WMI (Windows Management Instrumentation) RPCs (remote procedure calls) is no longer required for these queries. A WMI connection remains required to deploy patches, because patch deployment continues to use the Microsoft SCCM API over WMI. [Enhancements to the Invicti Vulnerability Integration](https://www.servicenow.com/docs/access?context=invicti-vuln-integration&family=australia&ft:locale=en-US) :   Added the Invicti Platform Integration. Support for the Invicti Platform APIs introduces three new integration jobs that connect directly to the Invicti Platform cloud service: * Application Integration --- Imports the list of applications being scanned in Invicti Platform into your ServiceNow AI Platform® instance as discovered applications. * Scan Integration --- Pulls scan records from Invicti Platform, providing scan metadata to correlate with vulnerability findings. * Vulnerability Integration --- Imports application vulnerability findings from Invicti Platform and creates or updates application vulnerable items in Vulnerability Response in your ServiceNow AI Platform®. Enhancements to Application life-cycle management: When an application is deleted or decommissioned in Invicti Platform, your ServiceNow AI Platform® automatically deactivates the corresponding discovered application and closes all associated application vulnerable items (AVITs), keeping your vulnerability inventory accurate without manual cleanup. [Activate the Wiz Asset Integration and identify resource types for import](https://www.servicenow.com/docs/access?context=wiz-assets-resources-tab&family=australia&ft:locale=en-US) :   Enhancements to the Wiz integration include: * Starting with version 32.1 (USEM) and version 4.1 (non-USEM), the Asset integration is deactivated by default and is not a mandatory prerequisite for the other Wiz integration imports. If you choose to activate it, the Asset integration will retrieve assets for all resource types if you don't specify the ones you want on the Asset Integration Configuration tab. To avoid importing vulnerability data you don't need, identify only the resources (assets) that you want to import with this integration. * Resource Type is no longer a mandatory field for configuring the Vulnerability Response Integration with Wiz. You can now save Wiz configurations for the integrations without specifying a Resource Type, simplifying setup for use cases where specifying a Resource Type isn't appropriate. [Enhancement to Vulnerability Response CI lookup rule configuration](https://www.servicenow.com/docs/access?context=create-ci-identifier-rules&family=australia&ft:locale=en-US) :   The Applies to field is added to Configuration (CI) lookup rule records. For third-party and ServiceNow® integrations that support both Application Vulnerability Response (AVR) and Vulnerability Response (VR) lookup rules, like the Vulnerability Response Integration with Wiz, for example, select one for a rule: * Discovered Application for Application Vulnerability Response lookup rules. * Discovered Item for Vulnerability Response lookup rules. Note: The field is left empty by default. If you leave this field empty for lookup rules that support both VR and AVR integrations, background jobs for both applications apply changes on the same set of lookup rules. This state might cause a conflict and set the reapply flag incorrectly. With this distinction set, after the respective background jobs for AVR and VR are completed, the system resets the flag only for the lookup rules for the background job that was run. [AWS Integration for Security Exposure Management](https://www.servicenow.com/docs/access?context=aws-integration-for-security-exposure-management-overview&family=australia&ft:locale=en-US) :   The AWS Integration for Security Exposure Management supports integrations with the following AWS services: * AWS Inspector is an automated vulnerability management service that continuously scans EC2 instances, ECR container images, and Lambda functions for software vulnerabilities (CVEs) and unintended network exposure. The Vulnerability Response integration with AWS Inspector imports host and container vulnerability findings from AWS Inspector. * AWS Security Hub is a security service that is used to centralize and update security checks across AWS accounts. It provides a unified view of security alerts and compliance status by integrating with various AWS services. The Vulnerability Response integration with AWS Security Hub imports host, container vulnerabilities, and misconfigurations from AWS Security Hub. [Unified Microsoft Defender Integration for Security Exposure Management](https://www.servicenow.com/docs/access?context=ms-defender-sem&family=australia&ft:locale=en-US) :   The Microsoft Defender for Cloud and Microsoft Defender Threat and Vulnerability Management (MS TVM) plugins are now consolidated into a single plugin: Microsoft Defender Integration for Security Exposure Management. This consolidation deprecates the standalone Microsoft Defender for Cloud plugin. The unified plugin also introduces container image vulnerability ingestion from Microsoft Defender for Cloud, creating Container Vulnerable Items on your instance. A guided migration path is available to transfer existing data from the deprecated applications to the unified plugin. [Optimized Tenable.io Compliance Results ingestion](https://www.servicenow.com/docs/access?context=tenableIntegration&family=australia&ft:locale=en-US) :   Starting with v 6.1.3, the Tenable.io Compliance Results Integration is replaced by the Tenable.io Fixed Compliance Results Integration and Tenable.io Open Compliance Results Integration. Compliance results are now imported based on their status, optimizing ingestion performance and scalability for environments with large volumes of compliance data while keeping remediation and compliance tracking aligned with the current state of findings. [Qualys Integration -- API enhancements](https://www.servicenow.com/docs/access?context=c_QualysVulnIntegration&family=australia&ft:locale=en-US) :   The Qualys Vulnerability Integration has been upgraded to support newer Qualys API versions across Host Detection, Host List, Knowledgebase, PC Controls, PC Policies, and PCRS integrations. The integrations now ingest additional data fields, including vulnerability detection source, authentication privilege status, active status for controls and policies, and cloud metadata, giving you better visibility into your vulnerability and compliance data. Use the new `posture_api_version` integration instance parameter to choose between the default v2.0 APIs or the newer v5.0 streaming APIs for the PCRS Policy Host and PCRS Test Results integrations. [Vulnerability Data Management with Central Vulnerability Database (CVDB)](https://www.servicenow.com/docs/access?context=cvd-overview&family=australia&ft:locale=en-US) :   The Central Vulnerability Database (CVDB) introduces a unified, source-agnostic vulnerability data layer that consolidates data from multiple sources into a single authoritative record, improving accuracy, consistency, and traceability. Key capabilities include: * Unified vulnerability record: Correlates vulnerability data from multiple sources, supports sources including National Vulnerability Database (NVD), scanner intelligence, European Union Vulnerability Database, Japanese Vulnerability Database, and vulnerability intelligence feeds. * Priority-based data reconciliation configuration: * Field-level priority: Ensures each attribute (e.g., CVSS, remediation, exploit status) can be configured from the most reliable provider. * Source-level priority: Applies a global ranking when field-level rules are not defined. * Hybrid model: Field-level rules take precedence, with source-level fallback; all source data is preserved for full traceability. * Source attribution and traceability: Maintains detailed source metadata, timestamps, and change history to ensure full auditability and transparency. * Data enrichment: Combines CVSS scores, exploit intelligence, and remediation guidance to provide a richer and more actionable vulnerability context. |
| Brazil | [Schedule patch deployments through Change Request approval](https://www.servicenow.com/docs/access?context=vr-ws-patch-schedule-change-request&family=brazil&ft:locale=en-US) :   Route patch deployments scheduled from remediation tasks through Change Request approval for Microsoft SCCM and HCL BigFix integrations. This lets you align patch deployment for critical vulnerabilities with your organization's change management approval process, and optionally deploy the patch automatically once the change is approved. [Modify risk rating in bulk](https://www.servicenow.com/docs/access?context=sem-modify-risk&family=brazil&ft:locale=en-US) :   Vulnerability Admins can now modify risk rating directly on individual or bulk findings across host, application, or container vulnerable item, or on a remediation task without an approval workflow. Remediation Owners can also modify risk ratings, with changes routed through a change approval process. Associating a compensating control with the change is optional for all roles. [Automatic re-evaluation of remediation tasks on preferred solution change](https://www.servicenow.com/docs/access?context=vulnerability-groups&family=brazil&ft:locale=en-US) :   Remediation tasks can now automatically re-evaluate vulnerable items when their Preferred solution changes, so items are regrouped into the appropriate remediation task without manual intervention. This helps keep remediation tasks accurate and reduces manual cleanup. |
[ ]

## Changes

Between your current release family and Brazil, some changes were made to existing Vulnerability Response features.  
{#dfrn3-vulnerabilityresponse-summary__entry__14}

| Release | Release notes |
|-|-|
| Australia | Risk rating options are no longer part of exception or deferral requests :   Changing a risk rating is no longer available from the Request Exception dialog, or from the Bulk Edit dialog by selecting Mitigating Control in Place as a deferral reason. Risk rating and compensating control fields have been removed from both. Use Modify risk or Request risk modification, according to your role, to change a risk rating instead for individual records or in bulk. [Vulnerability Response assignment rules](https://www.servicenow.com/docs/access?context=vr-assignment-rules&family=australia&ft:locale=en-US) :   The sn_vul.rerun_task_rules system property for rerunning assignment rules was changed to sn_sec_rem.rerun_task_rules. Users must activate this property (set to 'true') to rerun assignment rules. [Improved vulnerability assessment workflows](https://www.servicenow.com/docs/access?context=vr-ws-vuln-assessment&family=australia&ft:locale=en-US) : * CI filtering for vulnerability assessments: You can now filter which configuration items are included in a vulnerability assessment using a condition builder. * Business Application population on AVITs: AVITs created from SBOM assessment results now include Business Application information, helping you understand application impact and prioritize remediation. * Priority roll‑down from vulnerability assessments: Updates to the priority of a vulnerability assessment now automatically roll down to associated VITs and AVITs, ensuring consistent prioritization based on the highest severity. [Remediation task rule execution mode](https://www.servicenow.com/docs/access?context=sem-grouping-multiple-findings-remediation-tasks-processing&family=australia&ft:locale=en-US) :   You can now choose how remediation task rules are evaluated during ingestion. The new Match First execution mode evaluates rules sequentially and applies only the first matching rule, assigning each finding to exactly one remediation task. The default Match All mode continues to evaluate all applicable rules. [Enhanced Compensatory controls](https://www.servicenow.com/docs/access?context=requesting-approving-risk-reduction&family=australia&ft:locale=en-US) :   When new vulnerable items are ingested and associated with a remediation task that already has an approved compensating control, the reduced risk rating is now automatically inherited by those new vulnerable items. |
| Brazil | Risk rating options are no longer part of exception or deferral requests :   Changing a risk rating is no longer available from the Request Exception dialog, or from the Bulk Edit dialog by selecting Mitigating Control in Place as a deferral reason. Risk rating and compensating control fields have been removed from both. Use Modify risk or Request risk modification, according to your role, to change a risk rating instead for individual records or in bulk. |
[ ]

## Removed

Between your current release family and Brazil, some Vulnerability Response features or functionality were removed.  
{#dfrn3-vulnerabilityresponse-summary__entry__20}

| Release | Release notes |
|-|-|
| Australia | No updates for this release. |
| Brazil | No updates for this release. |
[ ]

## Deprecations

Between your current release family and Brazil, some Vulnerability Response features or functionality were deprecated.  
{#dfrn3-vulnerabilityresponse-summary__entry__26}

| Release | Release notes |
|-|-|
| Australia | No updates for this release. |
| Brazil | No updates for this release. |
[ ]

## Activation information

Review information on how to activate Vulnerability Response.  
{#dfrn3-vulnerabilityresponse-summary__entry__32}

| Release | Release notes |
|-|-|
| Australia | Activation information :   Install Vulnerability Response and supported third-party integrations by requesting them from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) to view all the available apps, and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=australia&ft:locale=en-US). Important: Vulnerability Response is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. |
| Brazil | Activation information :   Install Vulnerability Response and supported third-party integrations by requesting them from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) to view all the available apps, and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=brazil&ft:locale=en-US). |
[ ]

## Additional requirements

If any additional requirements were introduced or changed for Vulnerability Response we have noted them here.  
{#dfrn3-vulnerabilityresponse-summary__entry__38}

| Release | Release notes |
|-|-|
| Australia | No updates for this release. |
| Brazil | Additional requirements :   The Security Support Common plugin is activated automatically when any of the plugins for the main Security Operations applications are activated. These applications include Vulnerability Response, Security Incident Response, Threat Intelligence, and Configuration Compliance. |
[ ]

## Browser requirements

If any specific browser requirements were introduced or changed for Vulnerability Response we have noted them here.  
{#dfrn3-vulnerabilityresponse-summary__entry__44}

| Release | Release notes |
|-|-|
| Australia | No updates for this release. |
| Brazil | No updates for this release. |
[ ]

## Accessibility information

Review details on accessibility information for Vulnerability Response, such as specific requirements or compliance levels.  
{#dfrn3-vulnerabilityresponse-summary__entry__50}

| Release | Release notes |
|-|-|
| Australia | No updates for this release. |
| Brazil | No updates for this release. |
[ ]

## Localization information

If there are specific localization considerations for Vulnerability Response we have noted them here.  
{#dfrn3-vulnerabilityresponse-summary__entry__56}

| Release | Release notes |
|-|-|
| Australia | No updates for this release. |
| Brazil | No updates for this release. |
[ ]

## Highlight information

If there are specific highlight considerations for Vulnerability Response we have noted them here.  
{#dfrn3-vulnerabilityresponse-summary__entry__62}

| Release | Release notes |
|-|-|
| Australia | * The AWS Integration for Security Exposure Management supports integrations with AWS Inspector and AWS Security Hub. * The Central Vulnerability Database (CVDB) introduces a source-agnostic vulnerability data layer that consolidates data from multiple sources, improving accuracy and traceability. * Define the number of background jobs that run concurrently to reduce system resource consumption, with a new Background Job Configuration tile available in the Vulnerability Manager Workspace Admin console under the Others section. See [Vulnerability Response](https://www.servicenow.com/docs/access?context=vuln-landing-page&family=australia&ft:locale=en-US) for more information. |
| Brazil | * Remediate your most critical vulnerabilities quickly and efficiently by connecting security and IT teams. * Consolidate vulnerability data from multiple sources into a single authoritative record with the Central Vulnerability Database (CVDB). * Filter, group, and assign vulnerable items to remediation tasks based on configurable rules. * Configure background jobs and other administration settings directly from the Vulnerability Response Workspace. See [Vulnerability Response](https://www.servicenow.com/docs/access?context=vuln-landing-page&family=brazil&ft:locale=en-US) for more information. |
[ ]