--- sourceDocument: Store Version History Release Notes sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/store-release-notes Release : - store ft:locale : - en-US ft:publication_title : - Store Version History Release Notes ft:clusterId : - rnst bundleId : - rnst --- # Vulnerability Exposure Assessment release notes # Vulnerability Exposure Assessment release notes {#ariaid-title1} Release version: Store Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 7 minutes to read Version history for the Vulnerability Exposure Assessment application on the ServiceNow Store. Important: For details on system requirements and family compatibility, view the application listing on the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website. ## Version history Version 30.9.1 - September 2026 (USEM) : * New: An option to automatically create vulnerable items and application vulnerable items (VITs/AVITs) when creating a vulnerability assessment that includes: * A new confirmation step in the assessment creation flow, and a scheduled job to process auto-create requests. * Enhancements to fix an issue where the Assess confirmation modal failed to load for new vulnerability assessments. {#store-secops-rn-vr-vulnerability-exposure-assessment__ul_uf1_c4p_lkc} * Changed: Changed how out-of-box risk-calculator seed data is applied so it's no longer repeatedly overwritten, preventing loss of customer customizations to those rules. * Fixed:Aligned the Add button to the right as the primary action in the CVE modal, matching standard UX button-ordering conventions.Layout and behavior issues in the Create Vulnerability Item modal.Issues in the publisher-selection modal and an updated date-picker component.A spacing/layout issue in the Add Configuration Item modal.Issues in the Link MSI (matched software inventory) modal that affected how linked software records are shown and matched.The Add Software modal's Add button no longer remains disabled after the modal is reopened via its native close icon instead of Cancel/Add.Missing software-install-count data on Vulnerability Exception (VEX) records following the vulnerability assessment flow.A security gap with the VIT/AVIT assessment creation flow that enabled injection.Vulnerability assessment processing repeatedly creating duplicate affected-model records for the same product/component.Restricted the Confirm Vulnerability Assessment action that closed an over-permissive access path. Also cleaned up a duplicate/malformed role-grant record.A security issue with the vulnerability data-broker that closied a query-injection exposure and tightened access control.An encoded-query-injection vulnerability in the notification-retrieval endpoint. {#store-secops-rn-vr-vulnerability-exposure-assessment__ul_t1q_b4p_lkc} Removed:An unused, orphaned data transform map. Version 5.8.0 - September 2026 : * New: An option to automatically create vulnerable items and application vulnerable items (VITs/AVITs) when creating a vulnerability assessment that includes: * A new confirmation step in the assessment creation flow. * An API entry point for external systems to submit CVE-based assessment requests with a source identifier. {#store-secops-rn-vr-vulnerability-exposure-assessment__ul_xjd_d4p_lkc} * Fixed: * Vulnerability assessment event processing jobs timing out due to duplicate affected-model records being repeatedly created for the same product/component combination. * A security issue that closed a potential table-name and query-injection exposure. * Vulnerability list filtering so selected criticality filters are retained correctly and cleared properly on reset. An unused/incorrect grouping condition was also removed from the list view. {#store-secops-rn-vr-vulnerability-exposure-assessment__ul_zxp_d4p_lkc} {#store-secops-rn-vr-vulnerability-exposure-assessment__ul_dj5_c4p_lkc} Version 30.6.3 - August 2026 (USEM) : * Fixed: * CVE severity selection to the Exposure Assessment modal on Assess by Publisher tab. * Updated the Vulnerability Assessment Configuration Item (CI) list so it is ungrouped by default. {#store-secops-rn-vr-vulnerability-exposure-assessment__ul_wdc_mhv_bkc} Version 5.5.4 - August 2026 : * Fixed: * CVE severity selection to the Exposure Assessment modal on Assess by Publisher tab. * Updated the Vulnerability Assessment Configuration Item (CI) list so it is ungrouped by default. {#store-secops-rn-vr-vulnerability-exposure-assessment__ul_jj4_mhv_bkc} Version 30.6.0 - June 2026 (USEM) : * Changed: * The vulnerability exposure assessment workflow now excludes inactive component dependencies from analysis. Application Vulnerable Items (AVITs)and related records are no longer created for components that are not actively associated with a Bill of Materials (BOM) entity. This ensures only relevant,active components are considered during exposure assessments. * Enhancements and changes to the Vulnerability Exposure Assessment application to support internal security directives. {#store-secops-rn-vr-vulnerability-exposure-assessment__ul_db3_4k3_ljc} * Fixed: Large tables are now handled efficiently when deleting vulnerability items, preventing unnecessary scans and improving performance when processing related records. {#store-secops-rn-vr-vulnerability-exposure-assessment__ul_mfw_nk3_ljc} Version 5.5.2 - June 2026 : * Fixed: An issue where null related records might trigger unnecessary full table scans when vulnerable items (VITs) and application vulnerable items (AVITs) are being deleted. * Changed: * Inactive component dependencies are now excluded from vulnerability exposure assessment. The system no longer creates vulnerability records or affectedproduct entries for component dependencies marked as inactive, ensuring only active components are considered during SBOM-based exposure analysis. * Enhancements and changes to the Vulnerability Exposure Assessment application to support internal security directives. {#store-secops-rn-vr-vulnerability-exposure-assessment__ul_elq_pk3_ljc} {#store-secops-rn-vr-vulnerability-exposure-assessment__ul_ukw_4k3_ljc} Version 30.4.0 - April 2026 (USEM) : * Changed: * CI filtering for vulnerability assessments: You can now filter which configuration items are included in a vulnerability assessment using a condition builder. * Business Application population on AVITs: AVITs created from SBOM assessment results now include Business Application information, helping you understand application impact and prioritize remediation. * Priority roll‑down from vulnerability assessments: Updates to the priority of a vulnerability assessment now automatically roll down to associated VITs and AVITs, ensuring consistent prioritization based on the highest severity. {#store-secops-rn-vr-vulnerability-exposure-assessment__ul_rlp_fql_1jc} {#store-secops-rn-vr-vulnerability-exposure-assessment__ul_bjy_dql_1jc} Version 5.5.0 - April 2026 : * New: * CI Filter on Vulnerability Assessment * With a new ci_filterconditions field scoped to cmdb_cithat has been added to sn_vul_analyst_vulnerability_assessment, you can define a CI filter on a Vulnerability Assessment record to scope the assessment for CIs that match specified conditions such as environment or operational status, rather than evaluating all the CIs. * The ci_filter field is supported in both the default and Vulnerability Analyst Workspace views. * The new assessment creation modal includes a condition builder for CI filtering alongside the Title and Primary CVE (typeahead) inputs. The modal also shows an inline alert if a record with a matching CVE already exists, and state is reset upon record closure. {#store-secops-rn-vr-vulnerability-exposure-assessment__ul_ur2_tks_t3c} * Priority roll-down from vulnerability assessment to VIT and AVIT * If a Vulnerability Assessment (VA) priority is set or updated, that priority automatically rolls down to all linked Vulnerable Items (VIT)s and App Vulnerable Items (AVIT)s. {#store-secops-rn-vr-vulnerability-exposure-assessment__ul_ys5_sks_t3c} Version 5.3.0 - January 2026 : Performance enhancements in Exposure Assessment scheduled job. Version 30.2.1 - January 2026 (USEM) : Minor defect fix as part of this release, related to the functionality of adding a new affected product in Vulnerability Assessment Workspace. Version 5.2.3 - December 2025 : * Fixed: * PRB1926442: \[Security Bug\] ACL Bypass via 'sn_vul_analyst.Activate CVE' Data Broker * Removed sn_vul_analyst.emergency_response role from CVE activation data broker ACL * Added sn_vul_analyst.vul_event_manager role requirement to data broker ACL {#store-secops-rn-vr-vulnerability-exposure-assessment__ul_a1l_1mz_mhc} * PRB1944031: VCM workspace not visible in Zurich platform * Corrected plugin name fromvulnerability_crisis_management tosn_vul_vcm in sys_ux_page_property configuration. {#store-secops-rn-vr-vulnerability-exposure-assessment__ul_b1l_1mz_mhc} {#store-secops-rn-vr-vulnerability-exposure-assessment__ul_zzk_1mz_mhc} Version 5.2.2 - August 2025 : * New: * The following improvements are available in Hardware Vulnerability Assessment: * Assessments without Normalization: Ability to assess discovery models without content available for normalization. * Confidence Scores: New scoring mechanism for all types of assessments. * Partial assessment for partially normalized discovery model: Creates partial assessments for discovery models without firmware version. The partial assessments are done if the other versions of the discovery model have the same publisher and model. * Expiring of assessments: If you update the firmware version of a CI, the corresponding normalized discovery model also updates. The assessment records based on the older firmware version expires while new assessments are generated for new firmware version. * Fixed: * Update code to create assessments for unmapped discovered models * Created assessments for range criteria having empty in cpe mapping and observe that partial match assessments have confidence score as 1. * fixed few security ACLs related to Data brokers and Script includes. Version 5.1.2 - June 2025 : Fixed: Population of "Installation count" field was fixed when VEX Record was created via Vulnerability Assessment.{#store-secops-rn-vr-vulnerability-exposure-assessment__latest-store-secops-rn-vr-vulnerability-exposure-assessment.dita} {#store-secops-rn-vr-vulnerability-exposure-assessment__latest-store-secops-rn-vr-vulnerability-exposure-assessment.dita} Version 5.1.1 - May 2025 : Fixed: Access to sn_vul_analyst_exposure_manifest and sn_vul_analyst_software_risk tables has been restricted for all users via ACL configuration to improve data security. Version 5.0.2 - February 2025 : Changed: Starting with v25.0.4 of Vulnerability Response and 5.0.2 of Vulnerability Exposure Assessment, you can assess your assets' exposure to vulnerabilities by the publisher in addition to the assessment by Common Vulnerabilities and Exposures (CVEs) or software. Version 4.0.1 - November 2024 : * Changed: If a Common Vulnerability Entry (CVE) has not been updated or had vulnerable items (VITs) created in the past 30 days, the exposure assessment record for that CVE is automatically marked as inactive. However, you can manually activate or deactivate these records. Additionally, the scheduled job Check potential vulnerability exposure scans for such CVEs to designate them as inactive/active. * Fixed: Minor fixes for this release. Version 3.2.2 - August 2024 : * New: Added the Re-assess UI action in the Vulnerability Assessment Workspace to re-assess the exposure assessment of existing Common Vulnerability Entries (CVEs)and software records. * Changed: Vulnerability Response Pro and Enterprise customers can access the Exposure Assessment in the Vulnerability Manager Workspace or Vulnerability Assessment Workspace based on the user role, upon clicking the Exposure Assessment link in the All menu. Vulnerability Response Standard customers can still access the Exposure Assessment in the classic UI. Version 3.1.3 - May 2024 : Vulnerability Emergency Response is a comprehensive solution for proactive vulnerability management and crisis response. In a single workspace, it offers, standalone assessments for single CVEs and vulnerable product versions, while the newly introduced Vulnerability Crisis Management Workflow enables you to efficiently handle vulnerability crisis events from end to end. This workflow includes holistic exposure assessment to identify vulnerable Configuration Items, vulnerable item creation, and crisis declaration with major security incident management enabling cross-team engagement, collaboration, coordination and reporting for rapid response.