Checkmarx SCA Release Notes March 2026

Checkmarx SCA has introduced a new metric, CxScore, for SCA vulnerabilities. CxScore improves remediation prioritization by providing a composite score that better reflects the actual risk posed by a vulnerable package. The score is calculated using multiple risk factors, including CVSS 3.0 and 4.0 (when available), EPSS score, dependency type (direct or transitive), and the presence of an exploitable path.

CxScore is automatically calculated whenever scans complete or when relevant CVE data changes. The score is now available across SCA views, including Packages, Risks, Risk Details, and Global Inventory. The existing Risk Score (based solely on CVSS) remains available, and users can toggle between Risk Score and CxScore in relevant views. CxScore is also included in exported reports (JSON, XML, and CSV) and can be used in policy rules to define vulnerability thresholds.

By incorporating additional risk intelligence and contextual factors, CxScore provides a more holistic vulnerability prioritization model and improves visibility into application security risk across the organization.

For complete documentation, see CxScore: Risk Prioritization for SCA Vulnerabilities,

Checkmarx SCA now supports dependency resolution for Python 3.14 for scans run in the cloud as well as via SCA Resolver. This enables accurate SCA scanning of Python 3.14 projects, helping to maintain continuous visibility into security and license risk for customers who are adopting the newer Python version.

Checkmarx SCA now supports dependency resolution for .NET 10 (Long-Term Support), enabling teams to scan NuGet dependencies in .NET 10 projects. As an LTS release, .NET 10 is the preferred target for enterprise and production workloads, making reliable SCA coverage essential for maintaining a secure open-source supply chain over its multi-year support lifecycle.

Checkmarx One now supports dependency resolution for Java 25 (Long-Term Support), enabling teams to scan Maven and Gradle dependencies in Java 25 projects. As an LTS release, Java 25 is the preferred target for enterprise and production workloads, making reliable SCA coverage essential for maintaining a secure open-source supply chain over its multi-year support lifecycle.