Version 3.69 | October 25, 2026

When the Checkmarx MCP Server is connected to the CLI, users can now configure IaC Security-specific scan parameters - such as preset, filter, and platform - directly through MCP, matching the options already available via the CLI.

For additional information, see documentation

Container Security now recognizes Echo hardened base images and ingests Echo’s own vulnerability advisory, alongside existing sources like Ubuntu, Alpine, and Red Hat. Echo-specific fix and rating data is shown alongside the NVD severity score, across the UI, API, CLI, and exports.

This gives teams using Echo-based images accurate, vendor-aware risk posture instead of relying only on upstream advisories.

The Malicious Package Identification API (v4) now distinguishes between automated analysis and manual AppSec Research review by introducing a new Completed status, alongside the existing Scanned status. A package returns Scanned once automated analysis is complete, and Completed once manual review has also finished.

This applies to all packages and versions already in the database, not only newly published ones.

The Change Log in the Edit Results side panel now shows Done In, indicating where a triage action was performed, matching what is already shown in the result’s Change Log.

This is available in both the SAST Results Viewer and Risk Orchestration. This provides a consistent, complete history when reviewing how and where a result was triaged.

Developer Assist now extends real-time secret detection to Copilot CLI, automatically scanning files as the AI agent writes or edits code.

When a hardcoded secret is detected, it is automatically remediated - such as replacing it with an environment-variable reference - and the file is re-scanned to verify the fix, all without interrupting the developer’s session. If the issue can’t be resolved automatically, the plugin halts action on that file and surfaces a clear message for manual review.

For additional information, see documentation

AI Triage and Remediation now supports Azure DevOps, including both ADO Cloud and ADO Server (self-hosted). This includes AI Triage directly in pull requests, AI Remediation, and Risk Orchestration actions back into ADO.

Teams using Azure DevOps can now benefit from the same AI-driven triage and remediation workflows already available to GitHub users.

Learn more about AI Triage and Remediation

When a SAST result has no Best Fix Location (BFL), AI Remediation now shows a clear message explaining that one isn’t available, instead of leaving the section blank.

The Application Overview page now reflows into a single column when zoomed to 400%, without requiring horizontal scrolling or losing content. This is part of ongoing improvements to the platform’s accessibility and usability.

This change makes the page easier to navigate for users relying on zoom or working with enlarged layouts.

CSV exports for Container Security scan results now include Package ID, Package Version, and Fixed Version columns.

This allows teams to identify and remediate vulnerable container packages directly from the exported report, without needing to cross-reference other tools.

Scan reports can now be exported in Markdown format, in addition to PDF. This makes it easier for developers to consume scan results directly in their own tooling and pipelines. The Markdown export mirrors the structure of the existing report sections, so teams get the same information in a format suited to their workflow.

Learn more about Scan Reports

AI Triage and Remediation now offers manual ways to access a remediation fix, in addition to delivering it through a pull request. Users can Copy Patch or Download Patch to apply a fix locally, or Copy Prompt to hand it off to their own AI coding agent.

These options are available across all manual and imported projects and for every scanner supported by AI Triage and Remediation.

Risk Orchestration now shows Attackability and Remediation columns for SAST and SCA risks, along with an attackability indicator in the risk header. This gives teams an at-a-glance view of AI Triage and AI Remediation outcomes without opening each risk individually, and both columns can be sorted and filtered.

For additional information, see documentation

Checkmarx One now identifies provided dependencies, which are packages supplied by the runtime environment, in cloud scans, in addition to the existing support for CLI and SCA Resolver scans. SCA scan results and Global Inventory display a Provided tag alongside existing tags such as Dev and Test, and you can filter by this new scope. The classification is also included in SCA scan reports, Global Inventory exports, and the Export Service API. This helps you distinguish packages that ship with your application from those the runtime provides, so you can assess and prioritize risk more accurately.

For more information, see documentation

DAST scans can now be narrowed to the specific technologies a website actually uses, so ZAP skips checking for alerts that only apply to technologies not in use, reducing scan time and false positives. Technologies are grouped by database, framework, language, operating system, web server, and protocol, and are all selected by default for both new and existing environments. Unused technologies can be deselected as needed.

This option is available under Scan Configuration in environment settings.

Users can now scan an MCP server by creating an MCP environment, a new environment type alongside Web and API. Providing the server URL is sufficient - no documentation file upload is required, unlike API environments. A security key, an HTTP sender script, or custom headers can optionally be added. See here for more information.