Release summary
This release adds TLS 1.3 support and FIPS 140-3 compliance to Trellix Agent, upgrades core security libraries, and fixes multiple issues affecting Linux DAT updates, RHEL system classification, managed/unmanaged mode switching, and client deployment task reporting.
Adds TLS 1.3 support for agent-to-server communication, completing the security enhancement in ePO On-prem 5.10.0 SP1 Update 7.
Upgrades core security libraries and cryptographic modules to comply with FIPS 140-3 standards.
Lets administrators view the MessageBus Certificate Updater version in the System Tree and report on it across managed systems using ePO queries.
Upgrades third-party libraries—including Apache Commons-Lang, zlib, OpenSSL, and libcurl to resolve known vulnerabilities.
Fixes an issue where client deployment task failures were incorrectly reported to ePO as successful deployments.
Resolves operational issues affecting Linux DAT updates, RHEL system classification, scheduled task execution, and managed-to-unmanaged mode switching.
Important
TLS 1.3 requirement: TLS 1.3 communication activates automatically once Trellix Agent 5.8.7 is deployed alongside ePO On-prem 5.10.0 SP1 Update 7 or later. Agents communicating with earlier ePO versions will automatically fall back to TLS 1.2.
EDR Client compatibility: Do not install Trellix Agent 5.8.7 on Linux or Mac systems running EDR Client 4.2.1 or earlier. Before installing, upgrade the EDR Client to version 4.2.2 or later on Linux systems, or to a version later than 4.2.1 on Mac systems.
Release rating
Critical
Action required: Critical
Customer action: Required.
What's new
TLS 1.3 support for agent-to-server communication: Trellix Agent 5.8.7 adds TLS 1.3 support, completing the communication security enhancement made in ePO On-prem 5.10.0 SP1 Update 7. When TA 5.8.7 or later communicates with ePO On-prem 5.10.0 SP1 Update 7 or later, the agent-to-server communication automatically uses TLS 1.3 to provide stronger encryption. Agents communicating with earlier ePO versions automatically continue to use TLS 1.2 to maintain uninterrupted backward compatibility. DXL Client 6.0.3.1782 also adds TLS 1.3 support, extending this capability across the Trellix Agent communication stack.
FIPS 140-3 compliance support: Trellix Agent 5.8.7 and DXL Client 6.0.3.1782 has upgraded their core security libraries and cryptographic modules to comply with FIPS 140-3. This update applies only to Agent installations running in FIPS mode.
MessageBus Certificate Updater version in queries and reports: ePolicy Orchestrator (ePO) now includes a MessageBus Certificate Updater version column that you can add to the System Tree to view the MessageBus Certificate Updater version of each managed system. Security administrators can use the Message Bus Certificate Updater version as a filtering criteria in Queries & Reports to view, segregate, and report on client systems based on their specific certificate updater versions across managed endpoints.
Configurable log levels and expanded logging capacity: The General policy Logging tab now includes a Log Level dropdown with Info, Detail, and Trace options. Additionally, default log file size limit has also increased from 2 MB to 10 MB, and the default rollover count has increased from 1 to 5.
Upgrade to Apache Commons-Lang 3: Upgraded Apache Commons-Lang 2.3 library with the Commons-Lang 3 version. This upgrade resolve known vulnerabilities, ensuring the product aligns with current security standards.
Note
Trellix Agent version 5.8.7.752 is supported on Trellix ePO - On-prem 5.10 Service Pack 1 Update 6 or later.
Third-party component upgrades: This release includes the following third-party component upgrades:
OpenSSL (Trellix Agent) library upgraded to version 3.5.7, including the OpenSSL FIPS provider module version 3.1.2, to resolve known security vulnerabilities. For more information, see KB96878.
OpenSSL (DXL Client) upgraded from version 1.0.2 to 3.5.7 to comply with FIPS 140-3.
zlib library upgraded from version 1.3.1 to 1.3.2 to include the latest security hardening and stability improvements.
libcurl upgraded from version 8.15.0 to 8.22.0 to resolve known vulnerabilities and improve data transfer stability. For more information, see KB96878.
SQLCipher upgraded from version 3.1.0 to 4.16.0 to improve database encryption security.
SQLite upgraded from version 3.07.15.02 to 3.53.1 to enhance database performance and stability.
Boost (non-Windows) upgraded from version 1.39/1.70 to 1.83 to incorporate critical stability fixes.
POCO (DXL Client) upgraded from version 1.8.0 to 1.15.0 as part of ongoing security hardening.
Resolved issues
General
Issue ID | Description |
|---|---|
MA-17454 | Trellix Agent on Linux endpoints created duplicate |
MA-17629 | Red Hat Enterprise Linux (RHEL) 8.x, 9.x, and 10.x Server systems were incorrectly classified and tagged as "Workstations" in ePO. |
MA-17712 | Trellix Agent incorrectly classified SUSE Linux Enterprise Server 16.0 (SLES16) systems as Workstation instead of Server due to comment lines at the beginning of the /etc/os-release file. |
MA-17584 | The attempt to switch Trellix Agent from managed to unmanaged mode using the maconfigCMD command intermittently failed after repeated mode changes, due to Self Protection blocking access to a required registry key. |
MA-17505 | Client deployment task failures were incorrectly reported to ePO as successful deployments when point product installers returned non-numeric error strings. |
MA-17590 | Trellix Agent generated an Event ID 2422 policy enforcement failure event when a point product policy session was already in progress. |
MA-15461 | Custom ePO queries containing the "Reboot Pending" column from the "Reboot Pending Status" category failed to execute and displayed a database view error. |
MA-16643 | Scheduled weekly tasks failed to run at their configured times due to an incorrect task validation check following system time synchronizations. |
Security fixes
Issue ID | Description |
|---|---|
MA-17608 | The |
MA-17457 | The cryptographic seed, salt, and initialization vector values used to protect the Trellix Agent keystore were stored as readable plaintext strings in the mfecryptc.dll file, which allowed them to be extracted from the binary. See SB15866 for more details. |
Known issues
For a list of known issues in this product release, see KB96738.
Upgrade and installation information
Release information
This section details the release date, build numbers and installation packages included in this release.
Release date:
Agent for ePO On-prem: 12 October, 2026
Build information:
Component | Build Number |
|---|---|
Trellix Agent | 5.8.7.752 |
DXL Client | 6.0.3.1782 |
System Information Reporter (only OT package) | 1.0.7.70 |
Prerequisites
On systems with EDR Client installed, EDR Client 4.2.2 or later is required on Linux, and a version later than 4.2.1 is required on Mac, before installing Trellix Agent 5.8.7. For the list of products compatible with Trellix Agent 5.8.7, see KB96739.
Note:
In air-gapped environments, ePO cannot update the Product Compatibility List (PCL), so incompatible deployments are not blocked automatically.
Upgrade impact
Use this section to describe any expected operational impact during or after installation of the release.
Component | Impact |
|---|---|
Trellix Agent upgrade | If the upgrade to Trellix Agent 5.8.7 fails, the installer automatically rolls back to the previously installed Agent version. No manual intervention is required to recover from a failed upgrade. |
EDR Client (Linux/Mac) | Trellix Agent 5.8.7 is supported only with EDR Client 4.2.2 or later on Linux systems and with an EDR Client version later than 4.2.1 on Mac systems. The Product Compatibility List (PCL) automatically blocks deployment to systems running an earlier EDR Client version. Before you deploy, verify that your Linux systems run EDR Client 4.2.2 or later and your Mac systems run an EDR Client version later than 4.2.1. For the list of compatible products, see KB96739. |
DXL Client | After you upgrade to Trellix Agent 5.8.7, the DXL Client might intermittently show as disconnected from the DXL broker. To restore the connection, restart the DXL broker service. For more information, see KB92077. |
Supported upgrade path
The following table lists the supported upgrade paths to the current release.
Current version | Supported upgrade path |
|---|---|
5.7.7 to 5.8.6 | 5.7.7 to 5.8.6 → 5.8.7 |
See KB15651 for more information.
Deprecated items
There are no deprecated items in this release.
Additional information
Trellix Thrive: Access the unified portal for technical support, product downloads, support case management, diagnostic tools, knowledge base articles, product training, webinars, and community interaction.
Note
Access to the Trellix Thrive Portal requires login using valid Trellix customer support, partner, or employee credentials.
Trellix Agent Documentation: For detailed technical information, including product guides, release notes, and configuration instructions of Trellix Agent, visit our documentation portal.
Rollback information: To roll back Trellix Agent to a previous version, see Restore Agent in the Trellix Agent Installation Guide.