Release summary
Trellix Data Loss Prevention extension release 11.13.2 includes new and enhanced features that are supported in DLP Endpoint for Windows and macOS, DLP Network Prevent, DLP Network Monitor, and DLP Discover, and includes resolved issues.
Every update release is cumulative and includes all features and fixes from the previous release. We recommend that you always upgrade to the most current update.
Important: Review these sections before upgrading or deploying the release.
FIPS 140-3 compliance
Trellix DLP integrates with OpenSSL to comply with the FIPS 140-3 standard.
Critical vulnerability fixes
CVE-2026-115738, CVE-2026-115739, CVE-2026-115740: Strengthened security posture — Trellix DLP has moved to a dynamic key-management model for stronger key protection.
For more information, see article 000015949.
Requires customer actions
Post-upgrade configuration: setting shared passwords and applying DLP policies
Following an extension upgrade to Trellix DLP Extension 11.13.2, administrators must configure Quarantine and Challenge-Response passwords to ensure proper policy enforcement and maintain secure communication between the Trellix ePolicy Orchestrator (ePO) server and managed systems.
The extension update also adds a revised RSA encryption mechanism for stored evidence files. For more information, see article 000015954.
Compatibility matrix
Component | Build version | Compatible ePO version | Recommendation |
|---|---|---|---|
Trellix DLP | 11.13.2.48 | Trellix ePO 5.10 SP1 Update 6 (CU22) and | Full Production: Install immediately after the upgrade before modifying any DLP policies. |
Appliance | 1.4.4.2 | Trellix ePO 5.10 SP1 Update 6 (CU22) and Trellix ePO 5.10 SP1 Update 7 (CU23) | Standard build for centralized appliance |
DLP Appliance | 11.12.0.4 | Trellix ePO 5.10 SP1 Update 7 (CU23) or lower | Standard build for specific DLP appliance |
Note
Trellix DLP Extension 11.13.2 is compatible with ePO - On-prem SP1 Update 6 (CU22) & ePO 5.10 SP1 Update 7 (CU23). If you are currently running versions between CU15 and CU21, you cannot upgrade directly to 11.13.2. We recommend you first upgrade to DLP extension 11.13.0.45 with compatible ePO - On-prem 5.10 SP1 Update 6 (CU22) without modifying the Trellix DLP policies.
Release rating
Recommended: This release includes minor enhancements, performance optimizations, cosmetic UI fixes, and minor bug resolutions that do not affect core security or system stability.
Action required: Recommended
Customer action: Optional
Administrators can install these at their convenience or skip them if the specific changes do not apply to their environment.
What’s new
FIPS 140-3 compliance
Trellix DLP integrates with OpenSSL to comply with the FIPS 140-3 standard. This integration automatically activates FIPS 140-3 mode at runtime across enterprise systems without manual configuration. All operations comply with federal security mandates and enterprise security standards.
Through this standard, all hardware, software, and firmware modules meet rigorous, independently tested requirements for encryption, key management, and tamper resistance.
New features/enhancements
This release adds support for the following features in its respective Trellix DLP product. For more information on the new or changed features, see the DLP Endpoint for Windows, DLP Endpoint for Mac, DLP Network Prevent, DLP Network Monitor, and DLP Discover Release Notes.
Features | Trellix DLP Endpoint for Windows 11.14.1 | Trellix DLP Endpoint for Mac 11.13.1 | Trellix DLP Network Prevent and Network Monitor 11.11.200 | Trellix DLP Discover 11.11.1 |
|---|---|---|---|---|
FIPS 140-3 compliance | Yes | Yes | Yes | Yes |
Expanding support for new style Microsoft Teams and Copilot | Yes | No | No | No |
Boldon James integration for data classification | Yes | No | No | No |
Seclore integration for Digital Rights Management (DRM) | Yes | No | No | No |
Bluetooth RFCOMM File Monitoring/Blocking | Yes | No | No | No |
Customizable manual classification labeling | Yes | No | No | No |
Support for Cadastro Nacional da Pessoa Jurídica (CNPJ) alphanumeric format | Yes | Yes | Yes | Yes |
Self Protection on macOS | No | Yes | No | No |
Support for iCloud protection on macOS | No | Yes | No | No |
IP-based policy management | No | No | Yes | Yes |
SharePoint Crawler update | No | No | No | Yes |
Resolved issues
Issue ID | Description |
|---|---|
DLPO-16403 | DLP event queries using a bar chart display were limited to 200 results for Rule Sets and Rules, even when more matching records existed. The query chart did not reflect the actual total match count, causing incomplete data to be displayed. Table-based queries for the same data were unaffected. |
DLPO-17499 | Email Protection incidents generated in the SkyHigh Security Cloud failed to synchronize with ePO - On-prem. |
DLPO-17546 | The Custom grouping button was unlocalized on the DLP Policy Manager for Data Protection rule. |
DLPO-17689 | Incorrect User Manager Information was visible under DLP Operations > User information. |
DLPO-18754 | Using the Not one of condition with the ePO Tag Name filter in the Incident Manager resulted in an empty results page. |
DLPO-19740 | Advanced Pattern for detecting Canadian Social Insurance Numbers (9-digit custom regex) incorrectly matched non-contiguous digit sequences across separate spreadsheet cells. Numbers spanning multiple cells, each containing only 3–4 digits, were being combined and falsely flagged as valid matches. |
DLPO-20140 | The value selected in the Window Title field was not retained on editing the Screen Capture Protection rule or Clipboard Protection rule. |
DLPO-20727 | Classification+Ignored Text tab failed to load and displayed an unexpected error. |
DLPO-20786 | Filtering by username or sender email address in the Incident Manager — Incident List returned no results, preventing users from locating incidents associated with a specific user. |
DLPO-21449 | Duplicating a classification and editing it caused data conditions to revert to an Undefined state. This issue, specifically, was observed when using Microsoft Edge. |
DLPO-21666 | The administrators were unable to select more than 10 DLP Network appliances for a single dataset in the DLP Capture module. |
DLPO-22267 | Incident pie charts failed to aggregate total incident counts by a rule set. |
DLPO-23477 | The DLP Sync event users from LDAP server task failed to update user metadata within the incident database. |
DLPO-23610 | DLP incident export reports showed incomplete domain details in the Destination column. |
DLPO-23611 | Reports failed to generate even when the queries returned valid results in the DLP console. |
DLPO-24193 | The Computer Properties Rollup task failed to synchronize data between multiple servers. |
DLPO-24697 | The DLP Import Skyhigh Security Cloud Event server task failed when downloading incidents from Skyhigh Security Cloud via the on-premises console. The task did not complete successfully, preventing cloud events from being imported. |
DLPO-24626 | Querying the incident API using a specific start time returned records from both before and after that timestamp. |
DLPO-24726 | The ellipsis (...) buttons in the Reports module failed to open the selection window for selecting user details. |
DLPO-24909 | The Classification Tester incorrectly displayed a Classification has no content criteria message for classifications that had valid content criteria already configured. As a result, the tester was unable to test files against those classifications despite criteria being present. |
DLPO-25037 | The DLP Policy Manager and Classifications pages appeared blank because of a UI issue when Content Security Policy (CSP) settings were enforced in ePO - On-prem. |
DLPO-25144 | Expression is not unique error was returned when adding multiple RegEx expressions that were distinct but differed only by case, preventing users from saving valid Advanced Pattern configurations. |
DLPO-25638 | The DLP Purge history of Operational Events and Incidents server task failed to complete during the archiving process, and displayed a Failed to create target folder error. |
DLPO-25815 | The Protected Systems count in DLP Policy Manager > Policy Assignment incorrectly displayed as 0 even when policies were actively assigned to one or more systems. |
DLPO-25816 | Trellix ePO failed to add Active Directory users whose display names contained an apostrophe or other special characters. |
DLPO-25589 | The DLP Evidence Purge task failed to move files to the pending delete folder due to an incomplete directory path created on the WebDAV evidence share. |
DLPO-25596 | The User Notification preview in DLP rule Reaction settings displayed a blank text area. When clicking Preview for either a default or custom notification, the notification banner appeared but the configured text from the Text to display field was not rendered. |
DLPO-26301 | Clicking the Access Control List (ACL) on an incident generated from a Pure Storage file path scan displayed no information in the Incident Manager. The ACL permissions for the incident were expected to be visible but the panel was rendered blank. |
DLPO-26363 | DLP Permission Sets were intermittently cleared when editing DLP roles. |
DLPO-26493 | The DLP LDAP Sync server task ran indefinitely without completing. |
DLPO-27511 | Importing a custom query into the DLP Dashboard caused an SQL error and prevented the dashboard page from displaying results. |
DLPO-27544 | Garbled text (encoding errors) was displayed in the Chinese-language interface of Trellix ePO. Specifically, in the DLP Policy Manager, corrupted characters appeared when creating a new Rule Set. |
DLPO-28046 | Cannot download .eml/.rtf evidence files from Incident Details. |
DLPO-29069 | DLP Incident Manager failed to display incidents with IDs exceeding 2,147,483,647 due to a data type mismatch in the Incident Audit Log table. |
DLPO-29079 | Significant API latency was experienced when processing DLP incident requests, causing slow incident retrieval performance. |
DLPO-29739 | MSG evidence file with angle-bracket subject was displayed as raw HTML file instead of a download link. |
DLPO-29843 | DLP Helpdesk could not generate a client bypass key. |
DLPO-30159 | When attempting to remove all exceptions from a Data Protection rule, 'An issue occurred while saving the rule' error occurred. |
For all related resolved issues, see Trellix DLP Release Notes.
Known issues
For a complete list of known issues, see Trellix Data Loss Prevention 11.x.x Known Issues (000013476).
Upgrade and installation information
Release information
Release date: November 5, 2026
Build information:
Component | Build Number |
|---|---|
Trellix Data Loss Prevention | 11.13.2.48 |
Appliance Management extension | 1.4.4.2 |
DLP Appliance Management | 11.12.0.4 |
Prerequisites
Minimum Trellix ePO 5.10 SP1 Update 6 (CU22)
Upgrade impact
None
Supported upgrade path
The following table lists the supported upgrade paths to the current release. If your environment is running in one of the versions listed above, follow the corresponding upgrade path to successfully upgrade to version 11.13.2.
Current version | Supported upgrade path |
|---|---|
11.12.1.23 | 11.12.1.23 → 11.13.0.45 → 11.13.2.x |
11.13.0.45 | 11.13.0.45 → 11.13.2.x |
Deprecated items
The Backward-compatibility option in the DLP Settings page is removed.
Additional information
Trellix Thrive: Access the unified portal for technical support, product downloads, support case management, diagnostic tools, knowledge base articles, product training, webinars, and community interaction.
Note: Access to the Trellix Thrive Portal requires login using valid Trellix customer support, partner, or employee credentials.Trellix Data Loss Prevention: For detailed technical information, including product guides, release notes, installation instructions, and configuration guidelines of Trellix DLP, visit our documentation portal at docs.trellix.com.