Release summary
This release enhances data protection, strengthens overall security and compliance by enforcing stricter administrative controls for organizations using Trellix DLP Endpoint for Windows.
Support for Microsoft Teams and Microsoft Copilot MSIX/UWP (Microsoft Installer X/Universal Windows Platform) style applications.
Boldon James integration to seamlessly import and utilize Boldon James classification labels within DLP rules and policies.
Integration with Seclore’s persistent Digital Rights Management (DRM) capabilities, ensuring sensitive data remains protected even after it leaves the corporate network.
Monitors and blocks classified data shared over Bluetooth connections while simultaneously permitting other peripheral Bluetooth devices to operate without restriction.
Visual labels (watermarks, headers, footers) and associated metadata can now be configured independently for each manual classification label template.
Integrates with OpenSSL to comply with the FIPS 140-3 standard.
Supports Brazil’s updated alphanumeric Cadastro Nacional da Pessoa Jurídica (CNPJ) format to ensure continuous detection and protection of Brazilian corporate identification numbers.
Improves OCR performance by increasing extraction speed, efficiency, and accuracy.
Resolves operational issues in API parsing, printer protection, incident reporting, and server connectivity to improve software reliability.
Important
Post-upgrade configuration: setting shared passwords and applying DLP policies
Following an extension upgrade to Trellix DLP Extension 11.13.2, administrators must configure Quarantine and Challenge-Response passwords to ensure proper policy enforcement and maintain secure communication between the Trellix ePolicy Orchestrator (ePO) server and managed systems.
The extension update also adds a revised RSA encryption mechanism for stored evidence files. For more information, see article 000015954.
Release rating
Recommended
This release includes minor enhancements, performance optimizations, cosmetic UI fixes, or minor bug resolutions that do not affect core security or system stability.
Action required: Recommended
Customer action: Optional
Administrators can install these at their convenience or skip them if the specific changes do not apply to their environment.
What’s new
Expanding support for new style Microsoft Teams and Microsoft Copilot
Trellix DLP capabilities are now extended to Microsoft Teams and Microsoft Copilot in Microsoft Installer X/Universal Windows Platform (MSIX/UWP) style. This feature effectively monitors and blocks the exfiltration of classified data across Microsoft collaboration environments. You can configure rules using the Application File Access Protection (AFAPR) module to block unauthorized file uploads.
For more information, see Protect sensitive data in Microsoft Teams and Copilot environments with Trellix DLP Endpoint for Windows.
Boldon James integration for data classification
Trellix DLP Endpoint seamlessly integrates with Boldon James Classifier (API 2.0) which supports Control-flow Enforcement Technology with Hardware-enforced Stack Protection (CET/HSP) endpoints. The software automatically identifies file classification labels, such as Confidential or Internal. Trellix DLP Endpoint enforces data loss prevention policies, such as blocking unauthorized uploads.
For more information, see Integrate Fortra/Boldon James Classifier with Trellix DLP Windows Endpoint.
Seclore integration for Digital Rights Management (DRM)
Trellix DLP Endpoint seamlessly integrates with Seclore DRM (version 3.22.5.0) through the Trellix ePO console to deliver automated, document-level protection across enterprise endpoints and external channels. When Endpoint File System discovery scans identify sensitive data based on defined content rules or keywords, Seclore policies are automatically applied. These persistent security controls enforce granular permissions, restricting unauthorized viewing, editing, printing, and screen sharing. Ensuring data compliance and safe collaboration with external vendors even after the files leave the network.
Note
As a prerequisite, install Seclore DRM client version 3.22.5.0 on the endpoint. Complete all required configurations for Seclore.
ARM64 Endpoints are unsupported by Seclore DRM.
For more information, see Trellix DLP Endpoint for Windows integration with Seclore Digital Rights Management.
Bluetooth RFCOMM file monitoring/blocking
Trellix DLP Endpoint allows administrators to protect Bluetooth file transfers without disrupting everyday peripherals like wireless headsets, keyboards, and mice. When users transmit sensitive or classified files, the system can monitor, block, or prompt for business justification. By distinguishing between specific Bluetooth profiles such as Object Exchange (OBEX), it isolates data transfers while keeping non-data channels, including Human Interface Device (HID) and Hands-Free Profile (HFP), fully operational.
For more information, see Prevent Bluetooth file transfers using Trellix DLP Endpoint for Windows.
Customizable manual classification labeling
Manual classification label templates allow administrators to separate visual labeling from metadata configuration, offering users greater flexibility when assigning labels to documents or emails. This enables tailored templates for different departments or user groups.
Depending on organizational requirements, each template can apply:
Metadata only: Embeds classification tags without modifying the document’s appearance.
Visual labels only: Applies visible markers without modifying backend file metadata.
Both metadata and visual labels: Combines visible indicators with embedded metadata for complete policy enforcement.
Note
Customizable manual classification functions on Microsoft Office applications: Word, Excel, and PowerPoint.
For more information, see Customize data classification using Customizable Manual Classification labeling.
FIPS 140-3 compliance
Trellix DLP Endpoint for Windows integrates with OpenSSL to comply with the FIPS 140-3 standard. This integration automatically activates FIPS 140-3 mode at runtime across enterprise systems without manual configuration. All operations comply with federal security mandates and enterprise security standards.
Through this standard, all hardware, software, and firmware modules meet rigorous, independently tested requirements for encryption, key management, and tamper resistance.
For more information, see FIPS 140-3 compliance with Trellix DLP Endpoint for Windows.
Support for Cadastro Nacional da Pessoa Jurídica (CNPJ) alphanumeric format
Trellix DLP now supports Brazil's updated Cadastro Nacional da Pessoa Jurídica (CNPJ) format, mandated by the Brazilian Federal Revenue. Trellix DLP supports both the legacy and the new alphanumeric format of CNPJ.
For more information, see the Classification Reference Guide.
Component updates
This release updates the following components:
Component | Version |
|---|---|
FIPS using OpenSSL | Base provider - 3.5.7 FIPS provider - 3.1.2 |
Resolved issues
Issue ID | Resolution |
|---|---|
DLPW-10991 | WeChat file blocking was unreliable, allowing user to still open the files. |
DLPW-14078 | DLP failed to add classification to Microsoft Word files which had both portrait and landscape page layout. |
DLPW-14483 | iPhones were not blocked allowing the users to use the iPhone and copy files to the machine. |
DLPW-16426 | DLP failed to block .exe file upload to Google Drive, Gmail, and other web mail websites on Edge web browser. |
DLPW-17393 | DLP failed to detect emails in the Korean language. |
DLPW-17996 | File names with non-English characters didn’t get classified during file upload. |
DLPW-18066 | Chrome hooking skipped |
DLPW-18102 | Text extraction skipped processing files with the |
DLPW-18107 | When setting up a custom quarantine location path in a Trellix DLP Endpoint policy on Windows 11 (23H2 and 24H2), an extra |
DLPW-18491 | Trellix DLP Endpoint prompted users to overwrite existing files when copying a file to a USB drive under a File Protection reaction policy on Windows 11. |
DLPW-18896 | The new Microsoft Outlook version 1.2026.720.100 failed to trigger justification before sending emails. |
DLPW-18994 | The print rules blocked the print jobs when the machine was disconnected from the corporate VPN. |
DLPW-19003 | CPU usage spiked on some machines where DLP Agent was not installed. |
DLPW-19005 | Conflicting Group Policy Objects (GPOs) disabled the Trellix DLP Chromium extension, causing blank destination URLs in incident reports. |
DLPW-19016 | DLP failed to prevent the progress bar while installing. |
DLPW-19648 | Upgrade failed with uninstall protection.exe error while upgrading from DLP 11.10.200 to 11.11.1. |
DLPW-19856 | Incidents reported by Web protection rules failed to report Outlook links. |
DLPW-20007 | DLP triggered incidents when a pdf file was opened on the Chrome or Edge browser. |
DLPW-20009 | The evidence file didn’t get uploaded to Amazon S3 bucket. |
DLPW-20029 | Diagnostic tool reported incorrect OS version on Windows 11 24H2 machine. |
DLPW-20176 | Trellix DLP Endpoint delayed screen capture protection enforcement when users pasted images immediately after taking a screenshot. |
DLPW-20724 | Trellix DLP Endpoint failed to block screen capture commands executed from the Command Prompt on Windows 11. |
DLPW-20981 | File print alerts sent to Trellix ePO incorrectly modified file extension names (for example, .xlsx changed to .xls). |
DLPW-20775 | dlptest.com failed to open on Edge browser in IE compatibility mode. |
DLPW-21252 | Outlook .msg files failed to open on second attempt. |
DLPW-21254 | Uploading a second file in the CFR portal caused the application to stop responding. |
DLPW-21222 | URL exceptions failed to work on On-prem and SaaS environments. |
DLPW-21999 | The DLP Printer Protection rule, configured to detect and block AIP-labeled files, failed to prevent right-click print operations for PowerPoint (PPT) files. |
DLPW-22251 | Print jobs were paused intermittently when trying to print from an SAP application. |
DLPW-22338 | File names with non-English characters didn’t get classified during file upload. |
DLPW-22729 | Files downloaded through the Island browser caused DLP to trigger incidents. |
DLPW-23097 | A residual 0 KB placeholder file was left on the file system after the agent blocked a file operation. |
DLPW-23229 | Web protection rules failed to work on SharePoint without enabling Browser API Integration. |
DLPW-23368 | Event ID 19136 lacked a display name, making log entries difficult to interpret. |
DLPW-23519 | The laptops stopped responding with a blank screen during Active Directory lookups due to application hooking issues. |
DLPW-23773 | DLP Extension 11.13 failed to generate incidents when specific PDF files were uploaded. |
DLPW-24012 | Users were unable to run the PsExec tool against remote machines from a command prompt. |
DLPW-24349 | Manual classifications were not displayed against evidence items when incidents were generated by DLP Endpoint. |
DLPW-24381 | When DLP policy with Endpoint discovery local file system scan was applied, fcag.exe crashed, causing managed features to disappear from the system tray menu. |
Known issues
For a complete list of known issues, see Data Loss Prevention Endpoint 11.x.x Known Issues (KB13475).
Upgrade and installation information
Release information
Release date: November 5, 2026
Build information:
Component | Build number |
|---|---|
Trellix DLP Endpoint client build | 11.14.1.3962 |
Trellix DLP Extension | 11.13.2.48 |
Prerequisites
A manual classification must exist in DLP Policy Manager before you configure label-level visual and metadata properties.
Review supported platform requirements before deployment.
Upgrade impact
Component | Impact |
|---|---|
DLP Endpoint for Windows package | The Trellix DLP Endpoint for Windows version 11.14.1 package displays as a new deployment package rather than an upgrade for version 11.14. A change to the product ID causes this behavior. |
Supported upgrade path
The following table lists the supported upgrade paths to the current release.
Current version | Supported upgrade path |
|---|---|
11.14.0 | 11.14.0 → 11.14.1 |
11.12.2 | 11.12.2 → 11.14.1 |
11.11.3 | 11.11.3 → 11.14.1 |
11.10.300 | 11.10.300 →11.14.1 |
Deprecated items
There are no deprecated items in this release.
Additional information
Trellix Thrive: Access the unified portal for technical support, product downloads, support case management, diagnostic tools, knowledge base articles, product training, webinars, and community interaction.
Note
Access to the Trellix Thrive Portal requires login using valid Trellix customer support, partner, or employee credentials.
Trellix DLP Endpoint for Windows Documentation: For detailed technical information, including product guides, release notes, installation instructions, and configuration guidelines of DLP Endpoint, visit our documentation portal.
Rollback information: Rollback and Recovery procedures.