2026-11-10 Hotfix Release Notes#
The 2026-11-10 Hotfix release enables notifications for actively exploited vulnerabilities by default on the CSIRT and Standard Plans as well (it was already enabled by default for organizations subscribed to the PSIRT Plan). In organizations on the CSIRT and Standard Plans, settings for which this notification was OFF have been turned ON in bulk. In addition, you can now change the email notification scope for this notification in the group settings on the Standard Plan as well. If you have any questions about the release contents, please contact our support desk.
Actions and Impact at a Glance#
[Action Required] marks items that require changes to your workflows.
| Who Is Affected | Items to Review |
|---|---|
| Users on the CSIRT or Standard Plan who have groups or destinations that do not need this notification (group administrators) | [Action Required] Settings that you previously had set to OFF have also been turned ON. Turn them OFF again, for each group and each destination. There is no setting to stop receiving it per user. For the steps, and for what to do if you personally do not want to receive it, see If you do not need this notification |
| Other users on the CSIRT or Standard Plan | No action is required. From now on, you will receive this notification when a task is newly treated as an actively exploited vulnerability. Tasks that were already treated as actively exploited vulnerabilities are not notified retroactively (you can check them with "Security Alert" in the CVE Tab). To see who receives email to users and how to check them, see Settings turned ON in bulk |
| Users in organizations subscribed to the PSIRT Plan | The defaults and settings do not change. Groups and destinations created or registered before subscribing to the PSIRT Plan may still be set to OFF. You can check this with the notification scope in the group settings, the check boxes of the Slack app and Teams Webhook, and "Notification Options" in the notification email address list. If you want to receive this notification there, turn it ON by following the notification settings |
2026-11-10 Release Notes#
Notifications for actively exploited vulnerabilities are now enabled by default on the CSIRT and Standard Plans as well#
Background#
Until now, this notification was enabled by default only in organizations subscribed to the PSIRT Plan. On the CSIRT and Standard Plans, the defaults for email to users, the Slack app, and Teams Webhook were OFF. Notification email addresses that were already registered when this notification was introduced were also set to OFF, so it was not reaching many groups. The 2026-11-05 release consolidated notifications per group. We have therefore enabled it by default on the CSIRT and Standard Plans as well, as announced in the 2026-10-27 and 2026-11-05 release notes.
Settings turned ON in bulk#
We changed the following settings for groups in organizations on the CSIRT and Standard Plans.
| Destination | Before | After |
|---|---|---|
| Email to users (notification scope in the group settings) | None | All group members |
| Slack app and Teams Webhook | OFF | ON |
| Notification email addresses | OFF | ON |
- Settings that you have turned OFF yourself are also included in this change. Because we cannot distinguish settings that we turned OFF when this notification was introduced from settings that you turned OFF, we turned all of them ON. If you do not need this notification, turn it OFF by following If you do not need this notification.
- The 2026-10-27 release notes announced that notification email addresses would be excluded, but we included them, as announced in the 2026-11-05 release notes.
- For groups whose notification scope is "Task assignees", we did not change the notification scope. For those groups, we turned the Slack app, Teams Webhook, and notification email addresses ON if they were OFF. Destinations that are already ON are not changed.
- Email to users ("All group members") is delivered to all users who belong to the group (excluding users with view-only permission). Users who see the group only through the owner, CSIRT, or group set permission do not receive it, even if they are listed in
Group Settings > Member. - "Slack Webhook (Deprecated)" continues to receive this notification as long as it is registered.
- The settings of organizations subscribed to the PSIRT Plan have not been changed. Destinations that you have set to OFF (including those created or registered before subscribing to the PSIRT Plan) continue not to receive it.
- We do not retroactively send notifications for tasks that were already treated as actively exploited vulnerabilities before the settings were turned ON in bulk. To check them, filter "Security Alert" by "Critical" or "Exploited in ransomware campaigns" in the CVE Tab. However, notifications for tasks that were waiting to be sent at the time of the bulk change may arrive after the change. As a result, right after the release, this notification may arrive at destinations that did not receive it before (such as email to all group members, Slack, and Teams).
Defaults for new groups and destinations#
On all plans, this notification is enabled for newly created groups and newly registered destinations.
| Destination | Previous default on the CSIRT and Standard Plans | Default from this release (all plans) |
|---|---|---|
| Email to users (notification scope of newly created groups) | None | All group members |
| Slack app and Teams Webhook (newly registered integrations) | OFF | ON |
| Notification email addresses (newly added addresses) | ON | ON (no change) |
Email notification scope can now be changed on the Standard Plan#
"Notification settings when an actively exploited vulnerability is detected" in the group settings is now shown on all plans. It was previously shown only on the CSIRT and PSIRT Plans, so on the Standard Plan you could not receive this notification by email to users. From this release, you can choose "All group members", "Task assignees", or "None" on the Standard Plan as well.
If you do not need this notification#
You can turn it OFF for each destination.
The setting for email to users is under Group Settings > Group.
The settings for the Slack app, Teams Webhook, and notification email addresses are under Group Settings > Notifications.
"Notifications" appears when you open "Advanced Settings" in the group settings menu.
Group administrators (and users with owner or CSIRT permission) can change these settings. If you do not have permission, ask your group administrator.
- Email to users: Set "Notification settings when an actively exploited vulnerability is detected" in the group settings to "None". To notify only the assignees, set it to "Task assignees" (tasks without a primary or secondary assignee are not notified by email to users).
- Slack app and Teams Webhook: In each integration under
Group Settings > Notifications, clear the "Notification of Actively Exploited Vulnerability Detection" check box. - Notification email addresses: In
Group Settings > Notifications > Notification Email Address, click the edit icon of the address, clear the "Actively Exploited Vulnerability Report" check box, and click "Apply". Addresses for which it is ON show "Actively Exploited Vulnerability" under "Notification Options" in the list.
Even if you stop one destination, the other destinations still receive it. "Slack Webhook (Deprecated)" has no ON/OFF setting per notification type, so you cannot stop only this notification. If you want to turn notifications ON or OFF per type, consider moving to the Slack app.
Email to users cannot be stopped per user. If you personally do not want to receive it, consider the following:
- Ask your group administrator to change the notification scope to "Task assignees" (you will receive notifications only for tasks for which you are the primary or secondary assignee)
- Filter emails whose subject starts with
[FVuls] Actively Exploited Vulnerability Reportin your email client ([FVuls] 悪用されている脆弱性の検知通知if your browser language is Japanese)