Skip to content

2026-10-27 Hotfix Release Notes#

The 2026-10-27 Hotfix release now reflects vulnerabilities newly added to KEV (a catalog of vulnerabilities that are actually being exploited) in tasks typically within 1 hour, without waiting for a scan. If there are many target servers, it may take until the next morning, depending on the time of day. Because this release does not change the notification settings (recipients and defaults), on some plans you do not receive the notification unless you turn it ON (see the warning below). If you have any questions about the release contents, please contact our support desk.

On the CSIRT and Standard Plans, you do not receive notifications for actively exploited vulnerabilities unless you turn them ON

On plans other than the PSIRT Plan, this notification is OFF by default for email to users, the Slack app, and Teams Webhook. Even after this release, destinations that are still OFF do not receive it. Destinations that you have already turned ON continue to receive it.

  • CSIRT Plan: Enable each destination you want to use. For email to users, change the notification scope in the group settings to "All group members" or "Task assignees". For the Slack app and Teams Webhook, turn this notification ON in each setting.
  • Standard Plan: Email to users is not available yet. Turn this notification ON in the Slack app and Teams Webhook settings.

For notification email addresses, this notification is ON by default when you add a new address. "Slack Webhook (Deprecated)" receives it as long as it is registered. For the steps, see notifications for actively exploited vulnerabilities. For the defaults by plan, see Notification recipients and defaults. As described in Upcoming Releases, we plan to turn it ON by default on all plans.

2026-10-27 Release Notes#

Vulnerabilities newly added to KEV are now reflected typically within 1 hour, without waiting for a scan#

Background#

If you apply patches only monthly or wait for the next scan, your response to vulnerabilities that have started to be exploited may be delayed. Customers have also told us that they want to know right away which vulnerabilities need an immediate response.

The time between the disclosure of a vulnerability and its exploitation in attacks keeps getting shorter. The "Information Security White Paper 2026" published by Japan's Information-technology Promotion Agency (IPA) cites VulnCheck's annual report, which found that about 30% of the KEV-listed vulnerabilities first exploited in 2025 were exploited on or before the day their CVE was published. On that basis, it states that vulnerability management that uses KEV registration as the priority criterion is effective. It also points out the need to strengthen countermeasures on the premise that AI will enable vulnerabilities to be discovered and fixed faster and in greater numbers.

Until Now#

KEV information was imported through the vulnerability database, which is updated every few hours. Even when a vulnerability that you had already detected was added to KEV, it was reflected in tasks only when you next scanned the server after the database update.

From Now On#

Vulnerabilities newly added to KEV are reflected in tasks, SSVC, and notifications, typically within 1 hour. If there are many target servers, it may take until the next morning, depending on the time of day. We re-match the previous scan results against the latest KEV information. The servers are not scanned again, and no action is needed on your side.

What is updated:

Servers updated without waiting for a scan#

The following servers are updated without waiting for a scan. This depends on the server type and your plan.

Server type Target organizations
Servers other than scanner, paste, and SBOM servers (pseudo servers, container images, etc.) All plans
Scanner, paste, and SBOM servers Organizations subscribed to the CSIRT / PSIRT Plan

In the following cases, changes are reflected as before, at the next scan (import).

  • Scanner, paste, and SBOM servers in organizations that are not subscribed to the CSIRT / PSIRT Plan
  • Servers whose previous scan results are no longer available
  • When a vulnerability that has not yet been detected is added to KEV
  • Vulnerabilities detected by Amazon Inspector in groups that have enabled Amazon Inspector SBOM import

How it works#

  • We check CISA KEV / VulnCheck KEV / ENISA KEV every 15 minutes.
  • We re-match servers where a newly added vulnerability has been detected, using the previous scan results. As with scheduled automatic scans, each re-match is recorded in the scan history with the scan type "Vulnerability Scan" and the scanner name "FutureVulsAuto".
  • The security alerts in the Vulnerability List and Vulnerability Details, and the display and filtering of exploit code, change when we check KEV. Tasks, SSVC, and notifications change when the servers are re-matched. Until then, only the security alerts may have changed.

Notification recipients and defaults#

Who receives notifications for actively exploited vulnerabilities is determined by the notification settings of the group that the server with the detected vulnerability belongs to.

Destination Who receives it
Email to users (notification scope "All group members") All users who belong to the group (excluding users with view-only permission), regardless of whether they use the software in which the vulnerability was found. Users who do not belong to the group do not receive it, even if they have the CSIRT permission of the organization.
Email to users (notification scope "Task assignees") The main and sub assignees of the task. Owners, CSIRT users, and group set users who do not belong to the group also receive it if they are assigned to the task (for the users who can be assigned, see Candidates Displayed for Assignee/Secondary Assignee).
Notification email addresses (addresses not registered as FutureVuls users that notifications are forwarded to), Slack app, and Teams Webhook The destinations registered for the group that have this notification turned ON
Slack Webhook (Deprecated) All destinations registered for the group. It has no ON/OFF setting per notification type, so you cannot stop only this notification.

Users who have not verified their email address do not receive email to users.

The defaults differ by plan as follows.

Destination PSIRT Plan CSIRT Plan Standard Plan
Email to users (notification scope) "All group members" "None" Not available (*)
Slack app and Teams Webhook ON OFF OFF (you can receive it if you turn it ON)

For notification email addresses, this notification is ON for newly added addresses on all plans. On plans other than the PSIRT Plan, we turned it OFF for addresses that were already registered when this notification was introduced.

(*) On the Standard Plan, you cannot receive this notification by email to users yet. For now, you can receive the notification by turning ON the Slack app or Teams Webhook. As described in Upcoming Releases, we plan to make email to users available as well.

You may receive many notifications in a row

Notifications for actively exploited vulnerabilities are currently sent per server. If a single vulnerability is found on many servers, you may receive as many notifications as there are servers within a short period. If you do not need these notifications, you can set the notification scope in the group settings to "None" or turn them OFF in the Slack app or Teams Webhook settings. "Slack Webhook (Deprecated)" cannot be turned OFF per notification type. We plan to consolidate them per group (see Upcoming Releases).

Vulnerabilities that became "actively exploited" based on information other than KEV are also re-matched without waiting for a scan#

Vulnerabilities whose SSVC Exploitation has changed to active (actively exploited) based on information other than KEV, such as Microsoft (MSRC) or CISA Vulnrichment, are also re-matched by the same mechanism. They are re-matched within a few hours after that information is reflected in the vulnerability database.

  • If you use SSVC, their SSVC Priority and due date are updated, and auto triage actions are executed.
  • The target servers are the same as for KEV above.
  • Even if the SSVC Exploitation becomes active, FutureVuls treats only vulnerabilities added to KEV as "actively exploited vulnerabilities", as before.

Newly added detection conditions are now matched immediately on pseudo servers with registered CPEs#

CPE detection conditions are the conditions that determine which vulnerabilities apply to a registered CPE. Previously, even when new detection conditions were added to the vulnerability database, they were not reflected until the next day's automatic scan. From now on, when detection conditions are added, pseudo servers that have the corresponding CPEs registered are automatically re-matched.

  • This applies to vulnerabilities with a CVSS score of 7.0 or higher and to vulnerabilities that are listed in KEV.
  • Only detection conditions that were not in the previous vulnerability database are re-matched. If an existing detection condition changes, or if a CVSS score later rises to 7.0 or higher, the change is reflected at the next scan, as before.

Upcoming Releases#

Planned changes to notifications for actively exploited vulnerabilities#

With this release, vulnerabilities newly added to KEV are now reflected in tasks typically within 1 hour. In line with this, we plan to change notifications for actively exploited vulnerabilities in the near future as follows.

Notifications will be consolidated per group#

Notifications for vulnerabilities newly added to KEV will be consolidated per group instead of being sent per server. Even if a single vulnerability is found on many servers, you will not receive as many notifications as there are servers. This change applies to all plans, including the PSIRT Plan.

What the consolidated notification looks like:

  • Email and Teams will receive one notification per group, and Slack will receive one post per group. In Slack, when there are two or more vulnerabilities, the details of each vulnerability will be added as replies in the thread of that post.
  • For each vulnerability, it will include the number of affected servers in the group and the names of up to 5 servers.
  • Email and Slack notifications will also include the packages for each server. Teams notifications will include them only when there is one vulnerability.
  • Each notification will include up to 20 vulnerabilities. To see all servers and packages, see Tasks × Servers in Vulnerability Details.

If a vulnerability that is already listed in KEV is detected later, how the notifications are grouped depends on the scan that detected it.

Scan that detected it How the notifications are grouped
Importing scan results (from the scanner, paste, SBOM, Amazon Inspector, etc.), a manual scan of a single server, or a bulk scan of 100 or fewer servers Sent per server, as before.
Scheduled automatic scans (pseudo servers, etc.) Consolidated per group. Detections from the nightly scheduled automatic scans are sent once per night.
More than 100 servers scanned or re-matched at once (including scans of all servers in a group) Consolidated per group. Detections during the day are sent together every 15 minutes.

The format of the notifications may continue to change. If you process notifications automatically, please use the task list of the FutureVuls API (filterIsActivelyExploited=true) instead.

The notification will be available on all plans and enabled by default#

This notification will be available on all plans.

  • In organizations on the Standard / CSIRT Plan, settings for this notification that are set to "None" or OFF will be changed to the following values at once. This includes settings that you turned OFF yourself. Newly created groups will use the same values by default.
    • Email notification: All group members
    • Slack / Teams notification: ON
  • This bulk change will not change the settings of notification email addresses.
  • For organizations on the PSIRT Plan, the default settings will not change, because this notification has been enabled by default for them since the 2026-06-03 release.
  • Groups that do not need this notification can turn it OFF after the change from the group settings or the Slack app and Teams Webhook settings.