Rating
The rating defines the urgency for installing this update.
This release is recommended for all environments. Apply this update at the earliest convenience.
New feature
Enhanced automatic response filtering with file hashes
Trellix Endpoint Security (ENS) 26.8 adds the Target File Hash property to Trellix ePO automatic response filters. This improvement aligns available filter fields with those found in the Threat Event Log. Administrators can now create automated workflows based on specific file hashes. This feature is available in the Automatic Response wizard when selecting the Threat event type. The update enables more precise response actions for known malicious files across the environment.
Enhancements
Improved CPU limit enforcement for on-demand scans
Trellix Endpoint Security (ENS) 26.8 improves CPU limit enforcement during on-demand scans. Previously, the scanning engine excluded processing time for exclusions from CPU usage calculations. Large exclusion lists caused scans to exceed set limits. The engine now includes exclusions in the total usage. This ensures scans honor the Limit maximum CPU usage configuration.
Resolved issues
Reference | Component | Resolution |
|---|---|---|
ENSW-131328 | Platform | Resolves an issue where Windows servers restarted suddenly. The firewall driver correctly handles disconnected TCP sessions to prevent bugchecks. |
ENSW-131173 | Adaptive Threat Protection | Fixes an issue where processes with an unknown reputation score were incorrectly contained. |
ENSW-130706 | Threat Prevention | Ensures that AppProtectionList and ProcessStartupExclusions registry keys are encrypted for improved security. |
ENSW-130465 | Platform | Prevents unauthorized service stops by blocking directory redirection through the Windows Bind Filter. |
ENSW-130263 | Threat Prevention | Corrects a UI error in Trellix ePO - SaaS where exclusion types were not displayed in the Exploit Prevention policy. |
ENSW-129752 | Threat Prevention | Updates the Policy Catalog to hide Linux-specific scan settings when the required license extension is missing. |
ENSW-129706 | Web Control | Prevents incorrect blocking of blob:// URLs by skipping reputation ratings for these addresses. |
ENSW-126827 | Threat Prevention | Ensures consistent enforcement of Access Protection exclusion rules by resolving a configuration file error. |
ENSW-126758 | Platform | Resolves a compatibility issue that prevented Oracle from detecting network interfaces after an upgrade. |
ENSW-132150 | Adaptive Threat Protection | Resolves an issue where ransomware detection settings were missing from migrated policies. The product now correctly displays and enables ransomware behavior settings after an extension upgrade. |
ENSW-132696 | Platform | Resolves an issue in SysCore 25.11 where failed attempts to create files in specific virtualized configurations caused a resource leak. This leak degraded system performance and caused health monitoring services to trigger a BSOD. |
ENSW-130371 | Platform | Resolved an issue where launching a 32-bit (x86) PowerShell instance on a 64-bit (x64) operating system caused registry key access failures. |
Known issues
For a list of known issues in this release, see Trellix Endpoint Security (ENS) 26.x Known Issues (Trellix Endpoint Security (ENS) 26.x Known Issues (000013238)).
Additional information
This release includes the following product software components.
Component | Version |
|---|---|
Common Client | 26.8.0.22584.1 |
Common Extension | 26.8.0.19750 |
Threat Prevention Client | 26.8.0.18496.1 |
Threat Prevention Extension | 26.8.0.16045 |
Firewall Client | 26.8.0.17552.1 |
Firewall Extension | 26.8.0.16045 |
Web Control Client | 26.8.0.16641.1 |
Web Control Extension | 26.8.0.15512 |
ATP Client | 26.8.0.17111.1 |
ATP Extension | 26.8.0.15525 |
SYSCORE - VirusScan Core | 26.2.0.564.2 |
Threat Detection Reporting Extension | 1.0.0.16693 |
ENS Package Designer | 10.7.19.13663.1 |
Trellix Endpoint Security Package Designer (ENSPD) details
The ENSPD tool lets you create a product package ZIP file containing pre-configured custom policies and additional executables for installing Trellix Endpoint Security (ENS). See How to use Trellix Endpoint Security Package Designer for more details.
Support ENSPD version for Trellix Endpoint Security (ENS) 26.8 - ENSW PD 10.7.19.13663.1