26.1.0 - Release Notes - BlueCat LiveAssurance

Release date: March 04, 2026

Attention: While support for the integration of LiveNX with LiveAssurance will continue to be available, the freemium offer is limited to v25.1.0 through v25.3.0 and does not apply to subsequent versions.

Platform

New Features:

Support for staging table integration—when configuring the ServiceNow integration in LiveAssurance, you can now specify the ServiceNow staging table that will be used to temporarily hold data from LiveAssurance prior to transformation and insertion into the target ServiceNow tables. For details, refer to ServiceNow Integration.

Knowledge

New Features:

Support for disabling alerts from the GUI—you can now disable an alert temporarily from the Code tab in the GUI and re-enable it as required. This feature is useful in certain emergency scenarios (such as emergency maintenance or upgrades) or when an alert is either non-actionable or irrelevant to your environment. For details, refer to Disable Alerts from the GUI.

New/Updated CVE Rules:

Palo Alto

Severity	CVEs
Medium	CVE-2025-4619, CVE-2026-0227, CVE-2026-0229
Low	CVE-2026-0228

Fortinet

Severity	CVEs
Critical	CVE-2025-59718, CVE-2026-24858
High	CVE-2025-25249, CVE-2026-22153
Medium	CVE-2025-53843, CVE-2025-55018, CVE-2025-58413, CVE-2025-62631, CVE-2025-64157, CVE-2025-68686
Low	CVE-2025-25255, CVE-2025-54821, CVE-2025-62439

Severity	CVEs
High	CVE-2026-22548, CVE-2026-2507
Low	CVE-2026-20732

Improved security:

LiveAssurance v26.1.0 includes updated third-party libraries and dependencies for improved security.

This release includes the following issue:

Knowledge

The Traefik version is incorrectly displayed in istatus as 2.10.4 but the actual version in use is 2.11.9. The Traefik version was upgraded to 2.11.9 in LiveAssurance v25.1.2 to address CVE-2024-45410 (HTTP clients can remove or modify certain headers in Traefik, posing potential security risks). However, 2.10.4 is currently hardcoded, causing issues during upgrades due to this discrepancy (KI-027634).

This release resolves the following issues:

Platform

The Dashboard page failed to display widget data for servers monitoring a large number of devices due to the Link header being larger than the supported size. Increasing the maximum allowed Link header size resolved this issue (KI-026988).
When non-administrator users attempted to download a device backup file, the download failed with an error message. LiveAssurance now checks device permissions and prevents downloads without proper permissions and device access (KI-026857).
Scheduling a device backup job during the 12:00 AM – 1:00 AM window failed due to a discrepency between the expected time ranges in the backend and GUI. Aligning the GUI time range with the backend resolved this issue (KI-026989).
Device backup reports incorrectly included deleted job schedules appearing as undefined entries, along with backup jobs that ran more than 24 hours ago. The reports now exclude deleted job schedules and include only the correct report scope, displaying jobs that ran only within the last 24 hours (KI-026990).

Knowledge

After adding a new BlueCat DNS/DHCP Server in LiveAssurance, the DNS Stats - Nameserver and DNS Stats - Zone Maintenance categories in the Device Info section of the GUI were missing or not populated due to timeout and parsing issues (KI-026934).
LiveAssurance failed to generate high availability split-brain alerts for Palo Alto Network devices when one cluster member transitioned from down to up state, incorrectly rendering both members active. LiveAssurance now generates split-brain alerts for high availability configurations as required (KI-026131).
The CPU microburst detected alert for Palo Alto Networks firewalls was incorrectly reported at the data plane level instead of the specific core that had the burst, causing the alert to trigger on sequential bursts across multiple cores. This alert is now triggered only when a specific core experiences more than two sequential bursts (KI-026127).
Following certain upgrades, User Space (instead of Kernel Space) was enabled by default for Check Point Firewalls, falsely triggering the High CPU usage per core(s) alert for CPU cores 0 and 1. Excluding CPU cores 0 and 1 for the specific devices resolved this issue (KI-025908).
LiveAssurance failed to generate alerts for Check Point VSX virtual system interfaces nearing maximum throughput because the corresponding interface files were missing from the /sys/class/net folder. LiveAssurance now monitors all interfaces connected to a virtual system on a VSX, generating alerts as required (KI-026390).
Orphaned files were erroneously created in the /tmp/.lock.clish.<pid> file by the clishcmd process during configuration pushes on target Check Point devices due to the absence of a save config command at the end of the clish scripts. Adding support for terminating the processes cleanly resolved this issue (KI-025844).
LiveAssurance generated false No syslog servers are configured alerts for BlueCat Integrity devices due to changes in the syslog-ng.conf file syntax between different Integrity versions, causing difficulties in parsing syslog server details. Adding support for syntax used in previous Integrity versions resolved this issue (KI-025753).
LiveAssurance generated false traffic load close to port capacity alerts for Palo Alto Network firewalls, due to incorrect counter values. Adding a sanity check in the traffic parser for corrupted counter values resolved this issue (KI-026457).