Release Notes for 9.7.0
Languages & Frameworks
All supported code Languages & Frameworks versions can be found here.
New Return Code
A new scanning return code has been introduced in the scan log:
56: This new error code indicates that all queries failed during execution.
The existing error code 66 has also been reviewed to ensure it is appropriately returned when not all queries fail during execution.
Queries Deprecation
The following queries for the JavaScript language will be deprecated in the upcoming engine pack 9.7.1:
Query Name | Package Name |
|---|---|
Angular_Improper_Type_Pipe_Usage | JavaScript_Angular |
Client_Privacy_Violation | JavaScript_Medium_Threat |
Frameable_Login_Page | JavaScript_Medium_Threat |
Client_Sandbox_Allows_Scripts_With_Same_Origin | JavaScript_Low_Visibility |
Client_Hardcoded_Domain | JavaScript_Low_Visibility |
Critical Severity
Queries
Warning
To minimize impact on customer policies and pipelines, the inclusion of the Critical severity level in queries has been reverted in version 9.7.0.
While the SAST application is fully prepared to support and display Critical severity results once available, query severities will not be updated to include Critical in this release. Additionally, presets content remains unchanged.
The rollout of the Critical severity level will be gradual. For more details, please refer to the plan.
Application
The SAST application is fully prepared to support and display Critical severity results once they become available as scan results. However, as queries do not currently include Critical severity, you may notice the Critical severity label appearing in the CxSAST application, even though no relevant insights are provided.
For further details, see CxSAST 9.7.0 On-Prem | Critical Support | What to Expect
Renamed Queries
While reviewing query severities, the names of several queries were also updated, resulting in multiple renames in version 9.7.0. View the list of renamed queries here: XLSX; PDF.
Warning
To prevent scan failures due to renamed queries:
Open CxAudit.
Review your custom queries that reference the old query names.
Update them with the new names to ensure they continue running smoothly.
Core
As a prerequisite, installation now requires .NET8 version instead of .NET6 due to .NET6 end of life.
API
Enhanced API /sast/scans/oldScanId/compareResultsTo/NewScanId with new fields:
CweId
SimilarityId (Path Node SimilarityId)
DetectionDate
DeepLink (Result Node deeplink)
PresetId
PresetName
Categories (to get info on OWASP TOP 10 and SANS TOP 25):
CategoryId
CategoryName
CategoryType
CategoryTypeName
Engine Pack Supported Code Languages and Frameworks (9.7.0)
Environment and Primary Languages | Secondary Languages | Framework | File extensions | Additional Information | |
|---|---|---|---|---|---|
|
|
|
| Java can be configured as a unified language with Scala. | |
|
|
|
| ||
|
|
|
| ||
|
| ||||
|
|
| |||
| JavaScript |
|
| ||
|
|
| This is for Salesforce APEX only. | ||
|
|
| |||
|
|
| |||
|
| ||||
|
| ||||
|
|
| |||
|
| ||||
|
| ||||
|
| ||||
|
|
|
| ||
|
|
| |||
|
|
| Scala can be configured as a unified language with Java. | ||
|
|
| |||
|
|
| |||
|
| ||||
|
| ||||
|
|
| |||
|
|
| |||
|
|
Vulnerability Queries 9.7.0
All queries that are executed in version 9.7.0 are available for download - PDF, CSV
New and updated queries in version 9.7.0 are available for download - PDF, CSV
Queries associated with predefined query presets are available for download - PDF, CSV
New and Changed Queries Details - PDF
All Queries by preset list- CSV
9.7.0 Hotfixes
Caution
From HF5, SVN will no longer be supported.
Resolved Issues and Changes
Category | Resolved Issues |
|---|---|
HF13 September 2026 |
|
Category | Resolved Issues |
|---|---|
HF12 July 2026 |
|
Category | Resolved Issues |
|---|---|
HF11 June 2026 |
|
Category | Resolved Issues |
|---|---|
HF10 May 2026 | |
Fixed an issue with OSA results not being shown in the Results Viewer | |
ActiveMQ was upgraded to 5.19.4 | |
REST API Swagger was updated to swagger-ui-dist@5.18.2 | |
Reduced the number of database calls when retrieving scan configurations |
Category | Resolved Issues |
|---|---|
HF9 March 2026 | |
Fixed an error where CxAudit saved accidental changes in CxDefaultQuery | |
Resolved inconsistencies in New\Recurrent\Fixed count when comparing scans. |
Category | Resolved Issues |
|---|---|
HF8 December 2025 | |
Prevented duplicate project names within the same team when creating or updating projects via the Portal UI. | |
Prevented duplicate project names within the same team when creating or updating projects via the REST API. | |
Prevented result comments containing unsupported or forbidden characters from causing errors. | |
Improved scan result retrieval performance by adding missing database indexes. | |
Fixed misleading messages for partial scans where the scan summary did not provide corresponding details. |
Category | Resolved Issues |
|---|---|
HF7 November 2025 | |
Fixed the issue where scans with no findings were not updating statistics. | |
Significant reduction in scan duration when there are non-relevant (excluded) JS files. | |
Scheduled scans no longer ignore “ForceScanWhenNoCodeChanges” rules. | |
Fixed “General Error” error when invalid data is used in UI filters. | |
Removed reference to potentially hazardous file: polyfill.js. | |
Fixed the error in the REST API that occurred when special characters were used in Git credentials. | |
Updated vulnerable ActiveMQ Tomcat libs. |
Category | Resolved Issues |
|---|---|
HF6 November 2025 | |
Fixed an error message in the PUT /projects/{id} API, which happened because the project name was case sensitive. | |
Mitigation steps were applied to fix CVE-2025-3600 for Telerik.Web.UI.dll v2020.1.114.45 | |
Fix for the incremental scan issue when new findings were found without a code change. | |
The following vulnerable libraries were fixed: jquery 1.8.0 was replaced with v3.6.4 handlebars 4.0.5 was replaced with v4.7.8 | |
Resolved the issue where scans were queued for an extended period. | |
Fixed the issue when the CheckBox column was partially hidden. | |
Fixed the issue when entering null characters broke PUT /projects/$ID. |
Category | Resolved Issues |
|---|---|
HF5 September 2025 | |
Fixed an issue where the CxReporting & CxPolicyManagement buttons randomly disappeared from the UI. | |
Fixed a bug where the REST API App timestamp was missing from the logs. | |
Fixed the issue with the beatifying results from an SCM-originated scan | |
HTML tags are now blocked when they are inserted in a result comment. | |
Fixed some parameter descriptions in Swagger. | |
Long CustomFiled names are being properly displayed now. | |
A filter by Severity in the GET/sast/results REST API has been added. | |
The CxSystem service that keeps AC Teams and Users synchronized with the CxSAST App DB is now configurable instead of a fixed 60-second value. | |
SVN support has been removed from CxSAST |
Category | Resolved Issues |
|---|---|
HF4 July 2025 | |
Upgraded Engine Configuration Exporter from .NET6 to .NET8 | |
A query was missing after an import. This happened in a case where the imported file had 2 queries with the same name; now, you can see both. | |
Updated AMQ from v5.18.4 to v5.18.7 |
Category | Resolved Issues |
|---|---|
HF3 May 2025 | |
The following 3-rd party vulnerable libraries were found and fixed in the code:
|
Category | Resolved Issues |
|---|---|
HF2 April 2025 | |
Fixed the compare scan algorithm to work with the new faster method. | |
Fixed the compare scan algorithm to ignore file paths | |
Fixed a duplicated results retrieval in the response of OData, which happened in some cases where there was a mix of private and public scans within the same project | |
Fixed missing SAST configuration keys | |
Fixed /projects/<projectId> API behavior | |
The checkbox column now has a fixed width to ensure visibility and usability. | |
Fixed an issue where checkboxes in the result viewer did not retain their state after an update | |
A configuration was added to control scan behavior when no engine can process it. You can now choose to fail the scan instead of leaving it in the queue indefinitely |
Category | Resolved Issues |
|---|---|
HF1 February 2025 | |
Security Bug Fix: Addressed a critical vulnerability in the access control mechanism, ensuring unauthorized users cannot bypass restrictions and gain access. | |
Fixed a database deadlock when trying to count the number of projects in cases where tens of thousands of projects had been created. | |
Fixed a bug that caused results not to be retrieved via GET results API in cases where a preset used to find those results had been deleted. | |
Fixed database deadlock errors, which happened while many projects were simultaneously created. | |
Resolved an issue in reports where the incorrect branch was displayed. This occurred when the project was edited, and the branch was changed. | |
The data retention process has been improved, and now it cleans orphan scan data. | |
Fixed a bug that caused the loss of a query description. This happened to a customized query with a description while its group was deleted. | |
Fixed a bug that caused results to appear as fixed instead of recurrent, which happened while comparing scans that involved a deleted customized query while its group had been deleted. | |
Fixed a bug that caused the short description to appear incomplete in PHP queries and cases where the scanned code contained <?. | |
Resolved a scan process failure caused by a Policy Management error. This occurred when the policy management key in the database was damaged or removed. | |
Fixed an error where retrieving results via the GET SAST results API received a 500 internal error when the scan had no code change. Now, the results are being retrieved with a 200 success code. | |
Fixed the results retrieval API; it got returned with an error in cases where the results of specific queries had no description. | |
Paged support has been added to the get projects API; now, you can control how many projects are retrieved in each batch, which prevents a failure when the number of projects is large. |
Category | Resolved Issues |
|---|---|
QF1 February 2025 | |
Included in Hotfix 1 Security Bug Fix: Addressed a critical vulnerability in the access control mechanism, ensuring unauthorized users cannot bypass restrictions and gain access. |