喜歡離線閱讀？
1 - 最新消息？
1.1 Patching for Microsoft SQL Express 2022 moves to WUO
FIX, ANALOG PACKAGE, DATA UPDATE NEEDED
We’ve streamlined how patching is delivered for Microsoft SQL Express 2022.
Previously, patching for Microsoft SQL Express 2022 was handled as a third-party application, which might cause asynchronization with your device’s Windows update. This approach has been removed since this release.
Going forward, Microsoft SQL Express 2022 will be updated exclusively through the Windows Update Offline feature (wuo.dat), ensuring better alignment with Microsoft’s native update mechanisms and improved reliability.
1.2 Known Issues about SQL Server 2016 SP3
KNOWN ISSUE, WINDOWS
When you call GetLatestInstaller for SQL Server 2016 Service Pack 3 (SP3) version 13.0.6300.2, two available KBs might be returned: KB5058717 and KB5058718.
However, we observed a behavior where one KB is installed first, then attempts to install the other, the second installation will fail, and our SDK will return WA_VMOD_ERROR_INSTALLATION_FAILED.
This is expected since Microsoft’s applicability rules list both KBs as valid for the same product version. However, these two KBs belong to different lines (Cumulative Update (CU) builds and Azure Connect Pack builds). After one KB is installed, it effectively moves to that line, making the second update inapplicable.
1.3 Non-security Microsoft patch support
NEW FEATURE, WINDOWS, DATA UPDATE NEEDED, CODE CHANGE
The SDK is now able to detect and install Microsoft non-security patches when using the Windows Update Offline functionality.
目前，SDK 支援的 Microsoft 類別包括安全更新、Service Pack 和 Update Rollups。
透過此更新，我們將新增的 Microsoft 類別為定期更新和關鍵更新。
*您需要修改程式碼才能實現此功能。請聯絡OPSWAT 團隊協助處理*。
1.4 SDK now supports macOS 26.0 beta and Oracle Linux 10.0
ENHANCEMENT, WINDOWS, MAC, ENGINE UPDATE NEEDED
We’ve enhanced our SDK to ensure full compatibility with macOS 26.0 beta and Oracle Linux 10.0.
Our team has verified and made some updates, so our SDK now works seamlessly on these platforms, reflecting the latest OS changes and requirements.
This validation ensures customers can begin planning and testing on these upcoming platforms with confidence.
1.5 Pass-through NVD CPE Data now available in the GetProductVulnerability
增強、類比套件、需要資料更新
We’re excited to introduce pass-through support for National Vulnerability Database (NVD) Common Platform Enumeration (CPE) information for patching third-party applications.
This update enables customers to access detailed CPE data for each patch directly in the SDK, using the standard CPE 2.3 format. The new CPE field is now included in the output of the GetProductVulnerability method for supported platforms (Windows, macOS, Linux), and documentation has been updated accordingly.
CPE Object Schema (found in result.cves[].details.cpe[])
{
"cpe_2_3": string, // required
"version_start_include": string, // optional
"version_start_exclude": string, // optional,
"version_end_include": string, // optional,
"version_end_exclude": string, // optional
}Complete Response Structure
{
"result": {
"cves": [
{
"cve": "CVE-2023-XXXX",
"details": {
"cpe": [
{
"cpe_2_3": "cpe:2.3:a:vendor:product:*:*:*:*:*:*:*:*",
"version_start_include": "1.0.0",
"version_end_exclude": "1.2.5"
}
]
}
}
]
}
}
2 - 即將發生的變更
2.1 Real-time monitoring on macOS
新功能、Mac、需要引擎更新、代碼變更
In Q1-2026, the SDK will provide Real-time monitoring on Mac operating systems. Unlike the current compliance checks, which are on-demand audits, real-time monitoring is dynamic, adapting to live events and rule changes as they occur.
在未來幾個月內，我們會提供更多關於第一階段將支援哪些合規狀態的詳細資訊。
Please note that this feature has been moved from Q4-2025 to Q1-2025.
*您需要修改程式碼才能實現此功能。請聯絡OPSWAT 團隊協助處理*。
2.2 Support for the Windows 10 Extended Security Updates (ESU) program
需要增強、視窗、資料更新
2025 年 10 月 14 日之後，Microsoft 將不再提供 Windows 10 的安全修補程式、功能更新或技術支援。Windows 10 系統仍可正常運作，但會逐漸受到安全威脅和軟體相容性問題的威脅。
Therefore, Microsoft is introducing the Windows 10 Extended Security Updates (ESU) program, which gives customers the option to receive security updates for PCs enrolled in the program.
To extend support for Windows 10 and ensure the MDES SDK remains compatible with future updates of Windows 10, we have decided to continue supporting Windows 10 via the Windows 10 Extended Security Updates (ESU) program. This support will be applied to devices running Windows 10, version 22H2 with KB5046613, or a later update installed, and having an active ESU subscription.
2.3 Enhanced Installer Verification with InstallFromFiles
ENHANCEMENT, WINDOWS, ENGINE UPDATE NEEDED, CODE CHANGE
我們正在增強 InstallFromFiles 方法，以支援傳送預期的 SHA-256 切細值供安裝程式驗證。如果安裝程式的雜湊值不符，SDK 現在會回傳 WAAPI_ERROR_HASH_MISMATCH 錯誤，以確保修補程式安裝時的完整性與安全性。
此增強功能將首先在 Windows 上提供，稍後的版本將支援 Linux 和 macOS。
3 - 必須採取的行動
3.1 CVE-2025-0131
弱點、視窗
在 Windows 裝置上 Palo Alto Networks GlobalProtect™ 應用程式所使用的OPSWAT MetaDefender Endpoint Security SDK 中，存在不正確的權限管理漏洞，允許本機認證的非管理 Windows 使用者將權限提升至 NT AUTHORITY/SYSTEM。然而，執行需要本機使用者同時成功利用競賽條件，這使得此漏洞難以被利用。
若要處理 CVE-2025-0131，請將 MDES SDK 升級至 4.3.4451 或更新版本。
3.2 我們將 OesisPackageLinks.xml 移到 VCR 閘道後面
安全更新、VCR Gateway
自 2024 年 12 月 31 日起，OesisPackageLinks.xml 檔案將遷移至 VCR Gateway 後方，以提高安全性，取代目前的公開位置。
Since September 1st, 2024, the file can be accessed via the VCR Gateway. You can download the file by following these steps: copy and paste this URL: https://vcr.opswat.com/gw/file/download/OesisPackageLinks.xml?type=1&token=<authorization_token> into your browser and replace <authorization_token> with your unique token. If you don't have a unique token, please contact support.
此更新可確保持續且安全的存取，使用者應已更新其系統，以適應此變更。
3.3 在 macOS 上使用舊引擎的 AppRemover 套件支援終止
支援結束,Mac
由於我們重構了 MacOS 上的 AppRemover 模組，以提供更優化、更簡化的體驗，因此在My OPSWAT Portal 上維護了 MacOS 上 AppRemover 模組的兩個套件：AppRemover OSX 和 AppRemover OSX V2。
自 2026 年 1 月 1 日起，OSX 套件將被移除。我們建議升級至 AppRemover OSX V2，以確保您的系統獲得所有新的更新以及 AppRemover 模組的全面技術支援。
3.4 Windows 7 和 Windows 8 支援終止
支援結束、視窗
經過慎重考慮後，SDK 將從 2027 年 1 月 1 日起移除對 Windows 7 和 Windows 8 (包括伺服器版本) 的支援 (比先前的計劃晚一年)。
為確保 MDES SDK 的安全性、相容性及最佳效能，我們建議將端點升級至支援的 Microsoft 作業系統。
3.5 安裝程式簽章檢查功能的行為變更
行為變更，所有平台，代碼變更
自 2025 年 11 月 1 日起，安裝程式簽章檢查功能將應用一項行為變更，以提升安全性成熟度。在修補程式過程中檢查安裝程式的數位簽章時：
- (無變更) 如果安裝程式的數位簽章有效並通過檢查，安裝程式將由 SDK 驗證，而修補程式程序將繼續正常進行。
- (無變更）如果安裝程式的數位簽章無效且檢查失敗，則會傳回適當的錯誤訊息，並中止安裝程序。
- (新) 如果安裝程式的數位簽章遺失，將會傳回適當的錯誤訊息，安裝程序也會中止。
提示：如果因數位簽章遺失或無效而收到錯誤，您可以使用 InstallFromFiles 方法的 skip_signature_check 標記，以繞過安裝程式簽章檢查功能。
4 - 詳細的 SDK 資訊
這只是冰山一角！您可以在我們的支援圖表上查看所有支援的應用程式：
