2026-11-19 Hotfix Release Notes (Advance Notice)

No maintenance window

This release will be performed without stopping the service. You can continue to use FutureVuls as usual during the release.

No action is required on your side for this release

See Impact at a Glance for what is affected.

This document is an advance notice of the Hotfix release scheduled for November 19, 2026. The contents and the date are subject to change.

The 2026-11-19 Hotfix release will make the following two changes.

• We will fix false positives that occurred when matching software registered by CPE against VulnCheck data. Falsely detected tasks will automatically change to PATCH_APPLIED at the next scan after the release, regardless of their status, and their primary and secondary assignees will receive scan notification emails.
• For libraries registered from lockfiles or SBOMs, newly published vulnerabilities will be reflected in tasks sooner than before.

If you have any questions about the release contents, please contact our support desk.

Impact at a Glance

Who Is Affected	Items to Review
Users who have registered CPEs with a specific version on their servers (including CPEs assigned by automatic CPE assignment for Windows)	Falsely detected tasks will automatically change to PATCH_APPLIED (including tasks that you set to NOT_AFFECTED, RISK_ACCEPTED, or other statuses)
Users who have registered CPEs whose version contains a wildcard (e.g., cpe:/a:mozilla:firefox:128.*) on their servers	Falsely detected tasks will automatically change to PATCH_APPLIED. Note that a version that contains a wildcard (such as 128.*) lowers detection accuracy, so we recommend registering a concrete version (such as 128.5.0) (this is not a change made by this release, but a long-standing caveat). See How to Register CPEs for the steps
Users who have registered CPEs whose version is - on their servers	Some tasks will change to "Reliability: Low". If you want tasks with "Reliability: Low" to be sorted into Important CVE as well, set "Vulnerabilities with unreliable detection" to "Include in the target" in the Important CVE Conditions (Group Admins, Groupset Admins, Owners, and users with the CSIRT permission can change it)
Primary and secondary assignees of falsely detected tasks	Scan notification emails will be sent per server
Users who register libraries from lockfiles or SBOMs	Newly published vulnerabilities will be reflected in tasks sooner
Others	No impact

2026-11-19 Release Notes (Planned)

Fixing false positives in CPE detection caused by matching against VulnCheck data

Background

When the CPE vulnerability detection logic was revised in the 2026-10-14 release, matches against VulnCheck NVD++ data whose version match cannot be confirmed came to be treated as the high-reliability detection method VulncheckExactVersionMatch (Confidence: 85). Before that release, they were treated as the low-reliability detection method VulncheckVendorProductMatch (Confidence: 10). As a result, vulnerabilities that should not be detected were detected on servers whose CPEs were registered with a specific version. For example, servers with the following CPEs registered had false positives like those in the table.

Example of a registered CPE	Falsely detected vulnerabilities
cpe:/a:google:chrome:155.0.8059.80	Several vulnerabilities, including CVE-2011-2807, whose VulnCheck condition is cpe:/a:google:chrome:- (the product only, with no version)
cpe:/o:redhat:enterprise_linux:6.9	Several hundred similar detections

Changes

The behavior changes as follows, depending on how the version of the registered CPE is written.

Version of the registered CPE	Example	What happens after the release
A specific version	cpe:/a:google:chrome:155.0.8059.80	False positives from VulnCheck go away. Existing tasks automatically change to PATCH_APPLIED, and assignees receive scan notification emails
A version that contains a wildcard	cpe:/a:mozilla:firefox:128.*	False positives from VulnCheck go away. Existing tasks automatically change to PATCH_APPLIED, and assignees receive scan notification emails. Note that a version that contains a wildcard lowers detection accuracy, so we recommend registering a concrete version (this is not a change made by this release, but a long-standing caveat)
-	cpe:/a:google:chrome:-	Some vulnerabilities detected through VulnCheck change to "Reliability: Low". The tasks remain
Omitted (*)	cpe:/a:google:chrome	No change

Vulnerabilities detected by sources other than VulnCheck, such as matching against NVD data, do not change.

If your Important CVE Conditions, Auto CVE Priority, Auto Ignore Settings, or Task Priority Rule Sets (CSIRT / PSIRT Plans) have "Vulnerabilities with unreliable detection" set to "Do not include in the target", tasks that change to "Reliability: Low" may no longer be covered by them.

How falsely detected tasks are handled

• Falsely detected tasks will automatically change to PATCH_APPLIED at the next scan after the release. Tasks that you set to NOT_AFFECTED, RISK_ACCEPTED, or other statuses will also change to PATCH_APPLIED.
• Tasks that change to PATCH_APPLIED this time do so not because a patch was applied, but because the false positives are no longer detected. As with tasks resolved in the usual way, the system comment The task status was changed to PATCH APPLIED because the vulnerability was resolved in all detection tools is recorded on the task.
• Tasks that change to PATCH_APPLIED will not be deleted. You can continue to see them in the Tasks tab and elsewhere.
• The task status returned by the FutureVuls API also changes to PATCH_APPLIED. If you have integrations that act on the status, such as automatically closing tickets, please keep this in mind.

When tasks change to PATCH_APPLIED depends on the server.

Server	When tasks change to PATCH_APPLIED
Servers that are targets of periodic automatic scans (all servers on the CSIRT and PSIRT Plans, and pseudo servers and others on the Standard Plan, excluding servers that meet the skip conditions)	At the first periodic automatic scan after the release (around 00:00 to 08:00 JST)
Other servers (such as servers whose configuration information was synchronized by a scanner within the last 24 hours)	The next time they are scanned

Scan notification emails sent to assignees

• If primary or secondary assignees are set for falsely detected tasks, a scan notification email (subject: [Task] Update Scan Notification - Group Name: group name) will be sent when those tasks change to PATCH_APPLIED. If the recipient's language is Japanese, the subject is [タスク] スキャン更新通知 - グループ名: group name.
• Scan notifications are sent per server. If many servers have falsely detected tasks, you may receive many emails after the first scan following the release.
• Scan notifications are sent only by email, not to Slack or Teams.

Details of the decision

The version match cannot be confirmed when the VulnCheck vulnerability condition has no version (-) (unless the version of the registered CPE is omitted), or when the condition is a version range or list and the version of the registered CPE is -. This release returns them to VulncheckVendorProductMatch (Confidence: 10), as before the 2026-10-14 release. This is the same treatment as NvdVendorProductMatch in detection methods considered low reliability. Because this kind of detection is caused by missing version information in the data source, FutureVuls does not detect it when the registered CPE has a specific version. As a result, detections go away for CPEs with a specific version, and remain as "Reliability: Low" for CPEs whose version is -.

Version in the VulnCheck condition	Version of the registered CPE	Before	After the release
- (e.g., cpe:/a:google:chrome:- for CVE-2011-2807)	A specific version (e.g., cpe:/a:google:chrome:155.0.8059.80)	Detected as "Reliability: High"	Not detected. Existing tasks automatically change to PATCH_APPLIED
-	A version that contains a wildcard (e.g., cpe:/a:mozilla:firefox:128.*)	Detected as "Reliability: High"	Not detected. Existing tasks automatically change to PATCH_APPLIED
-	- (e.g., cpe:/a:google:chrome:-)	Detected as "Reliability: High"	Detection continues as "Reliability: Low"
A version range or list	-	Detected as "Reliability: High"	Detection continues as "Reliability: Low"

The following combinations do not change.

• When the VulnCheck condition covers all versions (*) with no range or list, or when the version of the registered CPE is omitted (*): detected as "Reliability: High" if they match, regardless of how the other version is written
• A condition with a version range, a version list, or a specific version and a CPE with a specific version: detected as "Reliability: High" if they match
• A condition with a version range, a version list, or a specific version and a CPE whose version contains a wildcard: not matched (we recommend registering a concrete version)
• A condition with a single specific version and a CPE whose version is -: not matched

Library vulnerability data will be reflected sooner

• When the vulnerability database for libraries registered from lockfiles or SBOMs (Trivy DB) is updated by its publisher, the new data will be used for matching in scans after the update.
• Newly published vulnerabilities will be reflected in tasks sooner than before.

Upcoming Releases

Improvements to CPE matching

In an upcoming release, we plan to improve the following CPE matching. We will announce the details in the advance notice of that release.

Version of the registered CPE	Example	Planned change
-	cpe:/o:microsoft:windows_server_2019:-	When the version in the vulnerability condition is also - (the product itself), these will be treated as a confirmed match. Some tasks will change from "Reliability: Low" to "Reliability: High". These CPEs will also be matched against conditions with a single specific version as "Reliability: Low", and some tasks will be newly detected
A version that contains a wildcard	cpe:/a:postgresql:postgresql:12.*	Some NVD vulnerabilities will be newly detected. We continue to recommend registering a concrete version

For CPEs whose version is -, some of the tasks that change to "Reliability: Low" in this Hotfix release will change back to "Reliability: High" in that release.