Skip to content

2025.09

Features & Enhancements

Rapid Response

  • Sangoma FreePBX Authentication Bypass RCE: A new Rapid Response card and test for CVE-2025-57819 was deployed. This vulnerability allows an authentication bypass that leads to unauthenticated remote code execution.
  • Cisco ASA/FTD: New tests for two critical Cisco ASA/FTD vulnerabilities were deployed:
    • CVE-2025-20362 is a vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software that could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication.
    • CVE-2025-20333 is a vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software that could allow an authenticated, remote attacker to execute arbitrary code on an affected device.
  • SonicWall: Strengthened matchers for CVE-2025-40598 to mitigate false positives.

MCP hosted by Horizon3.ai

The NodeZero MCP (Model Context Protocol) Server acts as a natural language bridge between your LLMs and the NodeZero API, enabling AI agents to directly integrate real-world pentesting capabilities into agentic workflows. Now, in addition to supporting the use of an MCP that you host (locally hosted), you can use a Horizon3.ai-hosted MCP Server, which supports OAuth 2.1 authentication, multiple users, and more. For more information, see MCP Server.

AD Tripwires (Early Adopters only)

  • Added a new host resolution error state: "Domain Controller not accessible," which identifies when AD Tripwires cannot reach a domain controller due to host resolution or network problems. For more information, see Troubleshooting.
  • Added a Tripwire column to the Templates page. This column shows the state of tripwires for each pentest, such as Enabled, Eligible, or Ineligible.

EDR feature expansion

  • The EDR feature is now provisioned for all account types including Flex and C+.
  • EDR improvements to filtering on the EDR summary page:
    • Made visuals on Mitre chart filter dropdown easier to read
    • Simplified filter options on the Vendor bar chart

Enhanced asset management

For asset-based users, you can now filter to show only those assets seen in pentests during your current active contract. The filtered results should correspond to the number of assets "scanned" in your subscriptions.

Resolved issues (bug fixes)

  • Bugfix for error when generating an AD utility command for individual tripwire deletion.
  • When configuring an AD Password Audit, the Privileged Domain Credential incorrectly required a username and password even though an auto-injected credential was specified.
  • When only one AD tripwire was deployed, problems with monitoring occurred.
  • MSPs with asset-based SKUs could not create or delete subclients.

Back to Release Notes Index