26.2.0 - Release Notes - BlueCat LiveAssurance

BlueCat LiveAssurance Release Notes
ft:locale
en-US
Product name
BlueCat LiveAssurance

Release date: July 15, 2026

Platform

New Features:

  • Upgraded MongoDB and Node.js versions—MongoDB has been upgraded from 7.0.28 to 7.0.34 while the Node.js version has been upgraded from 22.12.0 to 22.22.0 to address security vulnerabilities and include bug fixes. During the upgrade to LiveAssurance v26.2.0, the MongoDB and Node.js packages will be automatically upgraded in stages. Once the upgrade to v26.2.0 is successful, LiveAssurance will use the upgraded MongoDB and Node.js versions.

Knowledge

New Features:

  • Proactive alerting for Check Point security blade database updates—LiveAssurance now collects signature update status and health metrics for Check Point security blades across gateways. Based on the collected metrics and defined rule configuration (including alerting threshold), LiveAssurance proactively generates alerts for conditions such as missed update cycles, update failures, expired contracts, connectivity issues to update servers, engine mismatches, and SLA violations. For details on configuring rules, refer to Configure rules for custom alerts.

    The collected metrics include last successful update time per blade, database version per blade, engine version (where applicable), update status (Succeeded, Failed, or Stalled), contract validity (Valid or Expired), connectivity to update servers (Reachable or Failed), and time since last update.

    In earlier releases, verifying whether security blades were receiving updated signatures required manual CLI checks, SmartConsole inspection, and per-gateway log inspection. This enhancement enables centralized monitoring with proactive alerting, reducing manual verification and enabling faster detection of blade update issues across gateways.

  • Centralized monitoring and proactive alerting for Check Point Log Exporter—LiveAssurance now includes centralized monitoring of Log Exporter process health, network connectivity to external SIEM platforms, and TLS handshake status, with proactive alerting for critical failure conditions such as process crashes and failed network connectivity based on defined rule configuration. For details on configuring rules, refer to Configure rules for custom alerts.

    In earlier releases, when the Log Exporter stopped forwarding data to external SIEM platforms, detection was delayed and required manual CLI checks and log inspection. This enhancement enables centralized monitoring and proactive alerting, reducing detection time and operational overhead.

  • Support for BlueCat Edge v25.3.x—LiveAssurance now supports BlueCat Edge v25.3.x, ensuring compatibility with the latest Edge releases for monitoring and management.

New/Updated CVE Rules:

F5

Severity CVEs
Critical CVE-2025-53521, CVE-2026-41225
High CVE-2026-32673, CVE-2026-34176, CVE-2026-35062, CVE-2026-39455, CVE-2026-39458, CVE-2026-39459, CVE-2026-40060, CVE-2026-40061, CVE-2026-40067, CVE-2026-40423, CVE-2026-40462, CVE-2026-40618, CVE-2026-40629, CVE-2026-40699, CVE-2026-41217, CVE-2026-41218, CVE-2026-41219, CVE-2026-41227, CVE-2026-41956, CVE-2026-41957, CVE-2026-42409, CVE-2026-42781, CVE-2026-42919, CVE-2026-42920, CVE-2026-42930
Medium CVE-2026-24464, CVE-2026-28758, CVE-2026-32643, CVE-2026-34019, CVE-2026-40435, CVE-2026-40631, CVE-2026-40698, CVE-2026-40703, CVE-2026-41953, CVE-2026-41954, CVE-2026-41959, CVE-2026-42058, CVE-2026-42063, CVE-2026-42406, CVE-2026-42408, CVE-2026-42780, CVE-2026-42924, CVE-2026-42937

Fortinet

Severity CVEs
Critical CVE-2026-24858
High CVE-2025-53844
Medium CVE-2025-53847, CVE-2025-61624, CVE-2025-67862

Palo Alto Networks

Severity CVEs
High CVE-2026-0257, CVE-2026-0263, CVE-2026-0300
Medium CVE-2025-4615, CVE-2026-0256, CVE-2026-0258, CVE-2026-0261, CVE-2026-0262, CVE-2026-0264, CVE-2026-0269, CVE-2026-0272, CVE-2026-0273
Low CVE-2025-0133, CVE-2026-0265, CVE-2026-0266

Check Point

Severity CVEs
High CVE-2026-48131, CVE-2026-48132, CVE-2026-48133, CVE-2026-50752
Medium CVE-2026-48134, CVE-2026-48135, CVE-2026-48136

Improved security:

  • LiveAssurance v26.2.0 includes updated third-party libraries and dependencies for improved security.

  • The Axios version has been upgraded for various services to address security vulnarabilities.

  • This release also includes kernel updates that address CVE-2026-31431 (crypto: algif_aead - Revert to operating out-of-place, commonly known as Copy Fail) (KI-027168).
    Note: After upgrading LiveAssurance to v26.2.0, you must reboot the virtual machine or physical server that hosts LiveAssurance for the fix to take effect.

This release includes the following issues:

Knowledge

  • After upgrading BlueCat Address Manager and BlueCat DNS/DHCP Servers monitored by LiveAssurance, the device version displayed in the GUI does not update automatically to reflect the new version. As a workaround, you must manually suspend and then, resume such devices from the GUI to view the correct version. You can suspend and resume devices from the Device Summary drawer in the Devices tab (KI-027354).

  • The Traefik version is incorrectly displayed in istatus as 2.10.4 but the actual version in use is 2.11.9. The Traefik version was upgraded to 2.11.9 in LiveAssurance v25.1.2 to address CVE-2024-45410 (HTTP clients can remove or modify certain headers in Traefik, posing potential security risks). However, 2.10.4 is currently hardcoded, causing issues during upgrades due to this discrepancy (KI-027634).

This release resolves the following issues:

Platform

  • A failed attempt to configure a proxy server through the GUI still resulted in invalid entries being added in configuration files (/etc/environment, /etc/profile.d/proxy.sh, and /etc/apt/apt.conf). This caused log uploads to fail until the files were manually removed because they attempted to route through the invalid proxy. The proxy configuration entries are now saved in configuration files only when the proxy connection is successful (KI-027349).

  • The LiveAssurance GUI displayed a different alerting threshold value (in the Rule Configuration section of the issue summary drawer) for the High Packet Descriptor (on-chip) Maximum usage alert, as compared to the actual configured value, due to inconsistent value formats. This display inconsistency has been corrected to show alert threshold values consistently across all views (KI-026255).

Knowledge

  • LiveAssurance generated false Connectivity amongst DNS servers broken alerts for DNS servers when cached forwarding zone responses contained additional DNS server records, causing connectivity checks to be performed against DNS servers that were not part of the forwarding zone configuration. LiveAssurance now validates only DNS servers explicitly defined in the forwarding zone, thereby preventing these false-positive alerts (KI-026960).

  • The Device Info page for Check Point Maestro devices did not display any metrics from the devices and remained blank due to a processing exception. Correcting this restored device information visibility (KI-027030).

  • LiveAssurance generated false Device restarted (uptime low) alerts due to incorrect interpretation of the uptime. Updating the monitoring script's uptime parsing regex to correctly handle SNMP uptime values resolved this issue (KI-027282).

  • LiveAssurance generated false No syslog servers are configured alerts for devices with syslog servers configured using hostnames instead of IP addresses because LiveAssurance only validated the IP address of the syslog server. LiveAssurance now recognizes both IP addresses and hostnames as valid syslog server configurations (KI-026633).

  • Configuration backup for Check Point VSX (Virtual System Extension) firewalls captured only the backup from VS0 (the physical host) and did not include configurations from the virtual systems running on top. This issue has been resolved to ensure that when configuration backup is triggered for a VSX device, all virtual system configurations are captured along with the VS0 configuration (KI-026629).

  • LiveAssurance generated false throughput alerts for Check Point devices with interfaces defined without an assigned speed (Unknown! speed). Interfaces with unknown speed values are now handled correctly and no longer trigger false alerts (KI-027350).

  • LiveAssurance failed to correctly recognize Check Point 3920 devices running Gaia R82.10 due to the etc-os-release interrogation script overwriting correct vendor and OS version tags from chkp-vendor-interrogation with incorrect values. The incorrect values prevented matching to any Check Point monitoring commands. Correcting the etc-os-release script resolved this issue (KI-027317).

  • LiveAssurance reported incorrect interface throughput in the Network interface utilization graph due to octet-to-bit conversion errors (KI-027275).