Version 3.63 | July 26, 2026

Organization-level configuration is now available in Checkmarx One for Code Repository Integration projects, giving account administrators the ability to define scanner and integration settings that apply across all projects within a connected organization. A new Organizations tab in Account Settings, shows each connected SCM organization with a summary of its current configuration.

From the Organization Settings panel, administrators can enable or disable individual scanners and features. Each setting includes an Allow Override option that determines whether individual projects can deviate from the organization default. Settings that are locked at the organization level appear as disabled in Project Settings, with a tooltip indicating that they are controlled at the account level. Settings that allow override remain editable at the project level. Organization-level configuration reduces manual setup overhead across large repository fleets and gives administrators consistent, enforceable control over scanning policy for Code Repository Integration projects while preserving flexibility where needed.

For more information, see Organization-Level Configuration for Code Repository Integrations.

Checkmarx One now supports allowedLevel and unableToBlockOverride attributes on settings metadata, giving platform administrators greater control over where settings can be configured and how override behavior is enforced across levels.

Administrators can now restrict specific settings to either the tenant or project level, preventing misconfiguration by ensuring settings are only accessible and modifiable at their intended scope.

For settings marked as unable to block override, the override option is always enforced regardless of any value provided in a request, ensuring consistent resolution behavior across all levels.

These enhancements reduce the risk of misconfiguration in complex multi-tenant environments and provide a more predictable, enforceable settings hierarchy.

The Checkmarx One MCP Server now supports Container Security scanning, extending MCP coverage to include container risk detection alongside the existing SAST, SCA, IaC, and Secrets integrations.

Access to this functionality is subject to the applicable license and role-based permissions, consistent with other engine integrations.

Scan results stay consistent across scans by preventing vulnerabilities from being marked as fixed when scan configurations change or when vulnerabilities have not been tested or are newly introduced. This leads to reliable scan results across different runs and keeps your feedback loops fast and your developer workflow accurate and predictable.

Bring Your Own Results (BYOR) data is now included in the risk summary views across the Checkmarx One platform, ensuring that projects using imported scan results are accurately represented. The Applications view, including the Overview and Projects tab, also reflects accurate totals that incorporate BYOR results, covering total vulnerabilities, results by scanner type, results by state, and other relevant summary fields.

This update ensures a complete and consistent picture of security risk across all projects, regardless of how scan results were ingested.

The Checkmarx One Analytics Dashboard now supports CSV export for the Fixed Vulnerabilities drill-down table.

This makes it easier to use fixed vulnerability data for external reporting and compliance purposes.

A new AI Usage toggle is now available in Global Settings, giving organizations a single control to instantly disable all AI-driven capabilities across the Checkmarx One platform. When disabled, both user-facing and backend AI-powered features are turned off, and any future AI capabilities will also be governed by this setting. Disabling the toggle triggers a confirmation prompt before taking effect.

This provides enterprises with a reliable governance mechanism to enforce compliance, respond to policy changes, or mitigate risk without requiring per-feature configuration.

API Security triage actions are now recorded in the Checkmarx One Audit Trail, giving security and compliance teams full visibility into result state and severity changes. Each audit event captures the user who performed the action, the timestamp, and the before and after values, including an indication of whether the change was applied individually or in bulk, and whether it was triggered by Similarity or Attack Vector ID logic.

Events are accessible via the Audit Trail API.

Policy Management now supports state-based exemption rules, letting teams define which vulnerability states are excluded from build-break enforcement. Findings that match an exemption rule are skipped during enforcement evaluation but remain fully visible and tracked. All other findings are evaluated against enforcement rules as normal, consistently across pull requests, builds, and CI/CD pipelines.

This allows teams to honour approved exception workflows and proceed with releases without disabling enforcement or misclassifying vulnerabilities.

We improved the initial load times for showing results on the SCA Global Inventory screen.

SCA now supports dependency resolution using pnpm-lock.yaml, extending lockfile-based analysis to projects managed with PNPM.

When a pnpm-lock.yaml file is detected in a project, it is used as the authoritative source for resolving both direct and transitive dependencies, reflecting the exact versions installed by PNPM. For projects without a pnpm-lock.yaml, existing NPM-based resolution behavior is unchanged. This ensures that PNPM-managed projects receive accurate vulnerability and license risk analysis without requiring any changes to the project configuration.

Checkmarx One now automatically reverts the triage state of a risk from Not Exploitable to To Verify when a subsequent scan detects a new Exploitable Path for that risk.

Previously, this state change had to be performed manually, which meant exploitable risks could remain incorrectly triaged across scans.

A message logged in the risk History explains the reason for the automatic state change, keeping the audit trail clear. This improvement ensures that exploitability changes are surfaced immediately, so that prioritization policies, merge blockers, and remediation workflows reflect accurate and up-to-date risk information.

Added support for Chrome in DAST CLI. Choose between Firefox and Chrome browser to run your DAST scans. See the --browser CLI command in the table here.

Added column management to environments table. Show or hide columns, pin key ones to lock their place in the table, and drag others to reorder them for better visibility. See here for more information on column management in DAST.

Client Spider has been added as an additional web crawler to web scans. Client Spider is more adept at crawling single-page applications (SPA) than other web crawlers (Spider Ajax).