Skip to content
English
More support Customer portal
Contact us
  • There are no suggestions because the search field is empty.

Release notes-Cydarm 26.12.0

Updates and release notes for Cydarm version 26.12.0

Cydarm version 26.12.0 is now generally available!

This release introduces SLA management and automated escalations to help teams configure custom warning thresholds and trigger actions before breaches occur.

We have also streamlined SSO by automatically redirecting users to their identity provider once their username is entered, alongside general platform security hardening.

Enhancements and bug fixes 26.12.0

04 November 2026

New features

SLA warning management and triggered automations

  • SLA warning thresholds can now be configured and managed under Settings > Service Levels. Managers can add, edit, or delete warnings per tier. New service levels automatically include a breach alert at the target time limit.
  • Triggered automations can now respond directly to case SLA warnings. Select the case SLA warning event when creating an automation to trigger actions and dynamically populate message templates with warning details, time remaining, and breach statuses.

Enhancements

  • The in-case Add STIX Data form now supports eight additional observable types, so that all STIX 2.1 SCOs are now supported.
  • The Case transitions dashboard widget now supports charting transitions between intermediate workflow stages (such as progressing out of Containment). When selecting a start state, the To States picker populates all reachable stages in addition to final end states.
  • The step description field within the CACAO playbook builder can now be resized to simplify drafting and reviewing detailed, long-form instructions.
  • User lists are no longer rebuilt on every screen update, significantly reducing interface latency across deployments with extensive user and group directories.
  • The new Cydarm symbol is now displayed as the default browser favicon and iOS home screen web app icon.
  • Settings pages now contextually display create, edit, and delete buttons only if the current user holds the required permissions, preventing unauthorized actions from failing upon save.
  • Permission checks now directly verify an authenticated user’s explicit manage, create, read, update, delete, and find permissions across access control lists, eliminating the need to infer permissions from role assignments.

Security

  • The sign-in screen now displays a built-in security and compliance logon banner.
  • Single sign-on now initiates automatically by redirecting users straight to their identity provider once they enter their username, eliminating the need for a separate "Log in with SSO" button. Authentication completes within a secure cookie session bound to the initiating browser, supports IdP-initiated logins, and tracks the sign-in mechanism per session. Administrators can still toggle this via the COOKIE_SSO_ENABLED system property if legacy SAML handling is required.
  • Tightened the platform's global Content Security Policy headers to further mitigate cross-site scripting (XSS) risks without impacting SSO flows.

Bug fixes

  • Fixed an issue where STIX data entries added via the manual form displayed as unformatted raw JSON strings in the case activity feed rather than structured summaries.
  • Resolved a performance issue when importing large STIX bundles. Now bundles with hundreds of relationships can be imported in seconds.
  • Fixed an issue where playbooks containing a while loop stalled after the initial iteration. Loops now reset their state cleanly on each pass (including nested branching) and release when the loop variable meets the exit condition.
  • Fixed a defect where SLA notifications failed to reach external integrations, causing outbound webhooks configured for approaching or breached SLAs to be skipped silently.
  • Corrected overlapping layout text in the case automation connector modal.

Security highlight - did you know?

We actively monitor the evolving threat landscape to ensure the Cydarm platform remains secure and resilient. Following recent industry disclosures, we can confirm that Cydarm infrastructure and cloud deployments are not affected by the PHP2Shell vulnerabilities (CVE-2026-109618 / CVE-2026-109619) or other recent widespread zero-days. Regarding the upstream eMudhra intermediate CA revocation incident (CVE-2026-111943), remediation was identified and deployed on the same day of disclosure with zero service disruption.