Combined Vulnerability Response release notes for upgrades from Yokohama to Zurich

Consolidated page of all release notes for Vulnerability Response from Yokohama to Zurich.

How to use this page

To help you prepare for your upgrade, we have combined the cross-family Vulnerability Response release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Yokohama to Zurich.

Tip:

If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release."

Important information for upgrading Vulnerability Response to Zurich

Before you upgrade to Zurich, review these pre- and post-upgrade tasks and complete the tasks as needed.

Release	Release notes
Yokohama	No updates for this release.
Zurich	If you are currently using Vulnerability Response, and you do not intend to upgrade to Unified Security Exposure Management (USEM), install a version below v30.x of Vulnerability Response and for upgrades to supported third-party integration applications. The Missing Assets [sn_vul_wiz_missing_asset] table used for storing assets imported by the backfill integrations for the Vulnerability Response Integration with Wiz is deprecated. If you are currently using the Vulnerability Response with Wiz integrations, after updating to new version 1.1, you must backdate any of your existing Wiz primary integrations by three days and run them. Please review more information about the Wiz integration at SecOps articles on the Security Operations Community. For more information about the released versions of the Vulnerability Response application as well as the third-party and ServiceNow applications that are compatible with the Zurich release, see the Vulnerability Response Compatibility Matrix and Release Schema Changes [KB0856498] article in the Now Support Knowledge Base.

New features

Between your current release family and Zurich, new features were introduced for Vulnerability Response.

Release	Release notes
Yokohama	Identify Wiz Resource Types for import Identify the Resource Types (assets) that are reported by Wiz that you want to import with the Wiz Integration Resource Type configuration page in your ServiceNow AI Platform instance. The Resource Types that you select apply to all the primary Wiz vulnerability and compliance integrations except the Wiz Container Vulnerability Integration. See the Wiz Vulnerability Response Integrations for more information about the vulnerability and compliance integrations. Wiz Backfill Integrations Retrieve and process data stored on the Wiz Missing Assets [sn_vul_wiz_missing_asset] table for assets that were not processed by the primary Host Vulnerability Integration with a specialized Wiz Backfill Integration. The Host Vulnerability Backfill Integration is activated by default. Note: The Wiz Asset Integration and the Wiz Container Vulnerability Integration do not have backfill integrations. The Wiz Asset Integration can discover assets and create and update discovered item records on the Discovered item [sn_sec_cmn_src_ci] table. The Wiz Container Vulnerability Integration imports and processes discovered container image records. Create host remediation tasks manually in the Vulnerability Manager Workspace With the sn_vul.vulnerability_analyst or sn_vul.vulnerability_admin role, you can create host remediation tasks manually by selecting some or all the records in the Host vulnerable items’ lists in the Vulnerability Manager Workspace. These records are grouped into one or more remediation tasks according to the grouping criteria selected while creating host remediation tasks. Create host remediation tasks manually in the IT Remediation Workspace With the sn_vul.remediation_owner role, you can create host remediation tasks manually by selecting desired records in the Host vulnerable items’ lists in the IT Remediation Workspace. These records are grouped into one or more remediation tasks according to the grouping criteria selected while creating host remediation tasks. Questionnaire Support in Exception Management via Smart Assessment Configure advanced questionnaires as part of the exception management process using Smart Assessment. This enhancement allows remediation owners to provide detailed context for exception requests and enables approvers to configure conditional questions to gather information for informed decision making. Collaboration and streamlined approval: Facilitate collaboration between your vulnerability management and remediation teams by streamlining the approval process with clear and complete exception justifications. Mandatory questionnaires: Block the submission of exception requests until mandatory questionnaires are completed. If a questionnaire is marked as mandatory, the test results and its associated remediation tasks remain in the 'Open' state until the questionnaire is completed and submitted. If the questionnaire is incomplete, the state change approval record is saved as 'Draft'. Only after completing the questionnaire can the user submit the exception request, which will then move the test results or remediation tasks to the 'In Review' state. Lookup rules enhancements When you reapply Lookup rules, Discovered items (DIs) that have been inactive for more than 90 days are ignored. These Discovered items (DIs) are also excluded from licensing considerations. Removing them from the lookup logic can improve performance and reduce processing time. Background job enhancements: New fields have been added to help you view successfully evaluate records, the time taken for processing, the time remaining, and an estimated number of records. Improved accuracy for non-CSDM Vulnerability Response users: A system property (sn_sec_cmn.ci_lifecycle_status_source) has been introduced to help users who do not follow Common Service Data Model (CSDM) standards. This property ensures that Discovered items (DIs) and associated VITs are properly marked as Decommissioned and are excluded from the CI Lookup. Additionally, the Retired Configuration Items PA indicator has been updated to accurately reflect CIs based on the decommissioning flags. The scheduled job to create reconcile unmatched discovered items feature is deprecated. You can "Reapply Look up Rules" for selected or filtered items in the discovered items table view. Tenable.cs integrations with the Vulnerability Response and Container Vulnerability Response application The Vulnerability Response Integration with Tenable application now supports data ingestion from Tenable.cs, enabling you to bring in cloud and container vulnerabilities directly into ServiceNow. This integration enhances your ability to prioritize and remediate vulnerabilities identified in Tenable cloud resources and container images. Key capabilities are: Importing vulnerabilities discovered by Tenable.cs in cloud hosts and container images into ServiceNow automatically. Enabling remediation workflows to triage, assign, and resolve the most critical vulnerabilities across cloud-native and containerized environments. Using the Setup Assistant to easily configure credentials and integration parameters—get started with minimal manual setup. Scheduling jobs to run periodically to import findings from Tenable.cs, create vulnerable items (for cloud hosts), create container vulnerable items and associate them with the relevant cloud resources and container image records. Assess vulnerability exposure by publisher Starting with v5.0 of Vulnerability Exposure Assessment, a publisher-based assessment is introduced that enables you to assess the vulnerability impact by vendor. For example, Microsoft, and Red Hat. By focusing on recently disclosed vulnerabilities from critical vendors, you can prioritize remediation and proactively address threats, improving your overall security posture. View risk score details of a vulnerable item in the Work notes section Starting with v25.0.3 of Vulnerability Response, the system property sn_sec_cmn.risk_score_changes_add_worknotes is inactive by default. If you enable it, only then you can see all the changes related to the risk score of a vulnerable item in the Work notes section. Additionally, the work notes are updated only if there’s a change in the risk score. Quick Start Tests for Vulnerability Response After upgrades and deployments of new applications or integrations, run quick start tests to verify that Vulnerability Response works as expected. If you customized Vulnerability Response, copy the quick start tests and configure them for your customizations. Enhancements to exception rules handling Exception rules are reevaluated with nightly scheduled jobs. Vulnerable items that no longer match exception rule conditions are unlinked from remediation tasks. A deferred vulnerable item (VIT) is reopened if it doesn’t match any active exception rules. Exception rules don’t create remediation tasks. VITs are deferred directly and aren’t associated with a remediation task. Tenable's endpoint scanning integration Support for Tenable's endpoint scanning integration to retrieve scan metadata. The integration fetches scan details using the last_schedule_id from existing asset data in Tenable.io. Reopened Count field on vulnerable items Added the Reopened Count field on vulnerable items to track the number of times their states change from 'Closed' to 'Open' or to 'Active'. Out-of-the-box vendor advisories via Common Security Advisory Framework (CSAF) integration The following vendor advisories are configured out-of-the-box and are automatically activated when the Solution Management plugin is enabled: Redhat and Suse.
Zurich	Enhancements to the Wiz Vulnerability Response Integration The Universally Unique Identifier (UUID) that identifies detections for the Wiz Host Vulnerability integration will be mapped to a detection key. Note: This change is supported for new customers only. For existing customers, the detection key for the Wiz Host Vulnerability integration is created using the combination of vulnerability, asset_id, and proof. Added the source_id column to the Container Image Finding table (sn_vul_container_image_findings) and mapped the id attribute from the Wiz import to this field on findings records. You can configure the First parameter for the Wiz Asset Integration to help you resolve 504 errors. You can reduce the page size if you are having memory issues or generating errors. The default value is 500. Enhancements to Detection Key Configurations for Vulnerability Response Introduced configurable detection keys allowing customers to choose between Asset ID and Configuration Item, with validations, UI controls, and enhanced an existing schedule job to update existing detections. Enhancements to the Vulnerability Response Integration with Wiz The Missing Assets [sn_vul_wiz_missing_asset] is deprecated. After updating to version 1.1, you must backdate your existing primary Wiz integrations by three days and run them. The backfill integrations are activated by default. After you backdate and run your primary integrations, the following backfill integrations are no longer required: Host Vulnerability Backfill Integration Test Results Backfill Integration Host Test Results Backfill Integration Issues Backfill Integration Resource types filters are supported on the Host Vulnerability, Host Test Results, Test Results, and Issues tabs on the Wiz Configuration page. Additional attributes imported from Wiz that are not stored in the Discovered items [sn_sec_cmn_src_ci] table are stamped with Asset Attributes in this table. Test results from the Host misconfiguration integration are classified as result type 'host_misconfiguration'. Data for resources that have the validated_at_runtime flag set to 'yes' is imported and populated on detections. The is_ignored column is deprecated on the Host Test Results and Test Results Integrations. This column was replaced by the is_result_ignored column. The CMDB internet-facing field on the discovered item is mapped to Limited Internet Exposure on findings. Column length for the descriptions in the Host Vulnerability import table has been increased. Improved remediation target date handling Remediation target (RT) dates now dynamically recalculate when a finding’s risk rating changes. Administrators can configure how recalculation occurs to ensure RT dates remain accurate and align with the latest risk updates, helping maintain consistent and reliable SLA tracking. Identify Wiz Resource Types for import Identify the Resource Types (assets) that are reported by Wiz that you want to import with the Wiz Integration Resource Type configuration page in your ServiceNow AI Platform instance. The Resource Types that you select apply to all the primary Wiz vulnerability and compliance integrations except the Wiz Container Vulnerability Integration. See the Wiz Vulnerability Response Integrations for more information about the vulnerability and compliance integrations. Wiz Backfill Integrations Retrieve and process data stored on the Wiz Missing Assets [sn_vul_wiz_missing_asset] table for assets that were not processed by the primary Host Vulnerability Integration with a specialized Wiz Backfill Integration. The Host Vulnerability Backfill Integration is activated by default. Note: The Wiz Asset Integration and the Wiz Container Vulnerability Integration do not have backfill integrations. The Wiz Asset Integration can discover assets and create and update discovered item records on the Discovered item [sn_sec_cmn_src_ci] table. The Wiz Container Vulnerability Integration imports and processes discovered container image records. Import host vulnerability data with the Vulnerability Response Integration with Wiz Import host vulnerability findings related to virtual machines and serverless assets in your cloud environment with Wiz’s Host Vulnerability Integration. These findings are mapped to Host Vulnerable Items (VITs) within the Vulnerability Response application to support remediation workflows. Modify the severity for a CVE or TPE Vulnerability managers and vulnerability analysts can now adjust the severity of common vulnerabilities and exposures (CVEs) and third-party entries (TPEs) from the list view in the vulnerability manager workspace. The risk level of the associated vulnerabilities will be recalculated during the scheduled jobs based on the modified severity. You can also reset the severity to its original source value if required. Questionnaire Support in Exception Management via Smart Assessment Configure advanced questionnaires as part of the exception management process using Smart Assessment. This enhancement allows remediation owners to provide detailed context for exception requests and enables approvers to configure conditional questions to gather information for informed decision making. Collaboration and streamlined approval: Facilitate collaboration between your vulnerability management and remediation teams by streamlining the approval process with clear and complete exception justifications. Mandatory questionnaires: Block the submission of exception requests until mandatory questionnaires are completed. If a questionnaire is marked as mandatory, the test results and its associated remediation tasks remain in the 'Open' state until the questionnaire is completed and submitted. If the questionnaire is incomplete, the state change approval record is saved as 'Draft'. Only after completing the questionnaire can the user submit the exception request, which will then move the test results or remediation tasks to the 'In Review' state. Lookup rules enhancements When you reapply Lookup rules, Discovered items (DIs) that have been inactive for more than 90 days are ignored. These Discovered items (DIs) are also excluded from licensing considerations. Removing them from the lookup logic can improve performance and reduce processing time. Background job enhancements: New fields have been added to help you view successfully evaluate records, the time taken for processing, the time remaining, and an estimated number of records. Improved accuracy for non-CSDM Vulnerability Response users: A system property (sn_sec_cmn.ci_lifecycle_status_source) has been introduced to help users who do not follow Common Service Data Model (CSDM) standards. This property ensures that Discovered items (DIs) and associated VITs are properly marked as Decommissioned and are excluded from the CI Lookup. Additionally, the Retired Configuration Items PA indicator has been updated to accurately reflect CIs based on the decommissioning flags. The scheduled job to create reconcile unmatched discovered items feature is deprecated. You can "Reapply Look up Rules" for selected or filtered items in the discovered items table view. Tenable.cs integrations with the Vulnerability Response and Container Vulnerability Response application The Vulnerability Response Integration with Tenable application now supports data ingestion from Tenable.cs, enabling you to bring in cloud and container vulnerabilities directly into ServiceNow. This integration enhances your ability to prioritize and remediate vulnerabilities identified in Tenable cloud resources and container images. Key capabilities are: Importing vulnerabilities discovered by Tenable.cs in cloud hosts and container images into ServiceNow automatically. Enabling remediation workflows to triage, assign, and resolve the most critical vulnerabilities across cloud-native and containerized environments. Using the Setup Assistant to easily configure credentials and integration parameters—get started with minimal manual setup. Scheduling jobs to run periodically to import findings from Tenable.cs, create vulnerable items (for cloud hosts), create container vulnerable items and associate them with the relevant cloud resources and container image records. Assess vulnerability exposure by publisher Starting with v5.0 of Vulnerability Exposure Assessment, a publisher-based assessment is introduced that enables you to assess the vulnerability impact by vendor. For example, Microsoft, and Red Hat. By focusing on recently disclosed vulnerabilities from critical vendors, you can prioritize remediation and proactively address threats, improving your overall security posture. View risk score details of a vulnerable item in the Work notes section Starting with v25.0.3 of Vulnerability Response, the system property sn_sec_cmn.risk_score_changes_add_worknotes is inactive by default. If you enable it, only then you can see all the changes related to the risk score of a vulnerable item in the Work notes section. Additionally, the work notes are updated only if there’s a change in the risk score. Quick Start Tests for Vulnerability Response After upgrades and deployments of new applications or integrations, run quick start tests to verify that Vulnerability Response works as expected. If you customized Vulnerability Response, copy the quick start tests and configure them for your customizations. Enhancements to exception rules handling Exception rules are reevaluated with nightly scheduled jobs. Vulnerable items that no longer match exception rule conditions are unlinked from remediation tasks. A deferred vulnerable item (VIT) is reopened if it doesn’t match any active exception rules. Exception rules don’t create remediation tasks. VITs are deferred directly and aren’t associated with a remediation task. Tenable's endpoint scanning integration Support for Tenable's endpoint scanning integration to retrieve scan metadata. The integration fetches scan details using the last_schedule_id from existing asset data in Tenable.io. Reopened Count field on vulnerable items Added the Reopened Count field on vulnerable items to track the number of times their states change from 'Closed' to 'Open' or to 'Active'. Out-of-the-box vendor advisories via Common Security Advisory Framework (CSAF) integration The following vendor advisories are configured out-of-the-box and are automatically activated when the Solution Management plugin is enabled: Redhat and Suse.

Changes

Between your current release family and Zurich, some changes were made to existing Vulnerability Response features.

Release	Release notes
Yokohama	No updates for this release.
Zurich	Granular VIT creation for Microsoft TVM recommendations You can now configure recommendation as a vulnerability item (VIT) key for Microsoft Threat & Vulnerability Management (TVM). This enhancement enables each recommendation to generate a separate vulnerable item, offering more granular control for tracking, assigning, and managing remediation efforts, especially when different recommendations require actions from different teams. Improved state management for remediation tasks and vulnerable items State management logic for roll down of state from remediation tasks (RTs) to findings and roll up of state from findings to RTs has been refined across all modules. Updates improve accuracy by handling mixed item states (a combination of Deferred and Closed), supporting closure of tasks in sub-states like In-Review, and reopening tasks based on the Assigned To field. The update also improves handling of False Positive state transitions based on scanner results as source of truth. These enhancements reduce manual effort, clarify task ownership, and streamline remediation workflows. Ability to manually cancel Exposure Assessment background jobs Vulnerability Admins and Event Managers can now cancel Exposure Assessment background jobs that were triggered with incorrect parameters or are taking longer than expected. This enhancement reduces downtime by removing the need to wait for the job to complete. Once cancelled, the sub-state is immediately set to User cancelled, and the state updates to Complete after the job is fully terminated; giving you better control and flexibility. Configure maximum rows in related lists To improve readability and performance, you can now limit the number of rows shown in related lists on forms by setting the system property sn_vul_cmn.related_list.set_max_row. Qualys Integration – Detection Splitting Use the Qualys Host Detection Integration to create a separate VIT for each vulnerability instance based on proof. This improves accuracy in vulnerability tracking and supports clearer team ownership during remediation. Activate the QVS score integration Add Qualys-specific risk context to CVEs by importing QVS scores, helping you make more informed prioritization decisions.

Removed

Between your current release family and Zurich, some Vulnerability Response features or functionality were removed.

Release	Release notes
Yokohama	No updates for this release.
Zurich	No updates for this release.

Deprecations

Between your current release family and Zurich, some Vulnerability Response features or functionality were deprecated.

Release	Release notes
Yokohama	No updates for this release.
Zurich	No updates for this release.

Activation information

Review information on how to activate Vulnerability Response.

Release	Release notes
Yokohama	Install Vulnerability Response by requesting it from the ServiceNow Store. Visit the ServiceNow Store website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.
Zurich	Install Vulnerability Response and third-party integrations by requesting them from the ServiceNow Store.

Additional requirements

If any additional requirements were introduced or changed for Vulnerability Response we have noted them here.

Release	Release notes
Yokohama	No updates for this release.
Zurich	No updates for this release.

Browser requirements

If any specific browser requirements were introduced or changed for Vulnerability Response we have noted them here.

Release	Release notes
Yokohama	No updates for this release.
Zurich	No updates for this release.

Accessibility information

Review details on accessibility information for Vulnerability Response, such as specific requirements or compliance levels.

Release	Release notes
Yokohama	No updates for this release.
Zurich	No updates for this release.

Localization information

If there are specific localization considerations for Vulnerability Response we have noted them here.

Release	Release notes
Yokohama	No updates for this release.
Zurich	No updates for this release.

Highlight information

If there are specific highlight considerations for Vulnerability Response we have noted them here.

Release	Release notes
Yokohama	With the sn_vul.vulnerability_analyst or sn_vul.vulnerability_admin role, create host remediation tasks manually in the Vulnerability Manager Workspace. With the sn_vul.remediation_owner role, create host remediation tasks manually in the IT Remediation Workspace. See Vulnerability Response for more information about the Vulnerability Response application. See the Vulnerability Response Compatibility Matrix and Release Schema Changes Knowledge Base article for more information about released Security Operations applications and their version compatibility.
Zurich	If you are currently using Vulnerability Response and you want to upgrade to Unified Security Exposure Management (USEM), see Unified Security Exposure Management release notes for more information about USEM and the Unified Security Exposure Management migration. Import host vulnerability data from the Wiz scanners into Vulnerability Response VITs to help vulnerability managers assess your over-all cloud security posture. With the sn_vul.vulnerability_analyst or sn_vul.vulnerability_admin role, create host remediation tasks manually in the Vulnerability Manager Workspace. With the sn_vul.remediation_owner role, create host remediation tasks manually in the IT Remediation Workspace. See Vulnerability Response for more information.