喜欢离线阅读？
1 - 最新消息？
1.1 Patching for Microsoft SQL Express 2022 moves to WUO
FIX, ANALOG PACKAGE, DATA UPDATE NEEDED
We’ve streamlined how patching is delivered for Microsoft SQL Express 2022.
Previously, patching for Microsoft SQL Express 2022 was handled as a third-party application, which might cause asynchronization with your device’s Windows update. This approach has been removed since this release.
Going forward, Microsoft SQL Express 2022 will be updated exclusively through the Windows Update Offline feature (wuo.dat), ensuring better alignment with Microsoft’s native update mechanisms and improved reliability.
1.2 Known Issues about SQL Server 2016 SP3
KNOWN ISSUE, WINDOWS
When you call GetLatestInstaller for SQL Server 2016 Service Pack 3 (SP3) version 13.0.6300.2, two available KBs might be returned: KB5058717 and KB5058718.
However, we observed a behavior where one KB is installed first, then attempts to install the other, the second installation will fail, and our SDK will return WA_VMOD_ERROR_INSTALLATION_FAILED.
This is expected since Microsoft’s applicability rules list both KBs as valid for the same product version. However, these two KBs belong to different lines (Cumulative Update (CU) builds and Azure Connect Pack builds). After one KB is installed, it effectively moves to that line, making the second update inapplicable.
1.3 Non-security Microsoft patch support
NEW FEATURE, WINDOWS, DATA UPDATE NEEDED, CODE CHANGE
The SDK is now able to detect and install Microsoft non-security patches when using the Windows Update Offline functionality.
目前，SDK 支持的微软类别包括安全更新、服务包和更新卷。
通过此次更新，我们将添加的微软类别为定期更新和关键更新。
*您需要修改代码才能实现该功能。请联系OPSWAT 团队以获得协助*。
1.4 SDK now supports macOS 26.0 beta and Oracle Linux 10.0
ENHANCEMENT, WINDOWS, MAC, ENGINE UPDATE NEEDED
We’ve enhanced our SDK to ensure full compatibility with macOS 26.0 beta and Oracle Linux 10.0.
Our team has verified and made some updates, so our SDK now works seamlessly on these platforms, reflecting the latest OS changes and requirements.
This validation ensures customers can begin planning and testing on these upcoming platforms with confidence.
1.5 Pass-through NVD CPE Data now available in the GetProductVulnerability
需要增强、模拟包、数据更新
We’re excited to introduce pass-through support for National Vulnerability Database (NVD) Common Platform Enumeration (CPE) information for patching third-party applications.
This update enables customers to access detailed CPE data for each patch directly in the SDK, using the standard CPE 2.3 format. The new CPE field is now included in the output of the GetProductVulnerability method for supported platforms (Windows, macOS, Linux), and documentation has been updated accordingly.
CPE Object Schema (found in result.cves[].details.cpe[])
{
"cpe_2_3": string, // required
"version_start_include": string, // optional
"version_start_exclude": string, // optional,
"version_end_include": string, // optional,
"version_end_exclude": string, // optional
}Complete Response Structure
{
"result": {
"cves": [
{
"cve": "CVE-2023-XXXX",
"details": {
"cpe": [
{
"cpe_2_3": "cpe:2.3:a:vendor:product:*:*:*:*:*:*:*:*",
"version_start_include": "1.0.0",
"version_end_exclude": "1.2.5"
}
]
}
}
]
}
}
2 - 即将发生的变化
2.1 Real-time monitoring on macOS
新功能、Mac、需要引擎更新、代码更改
In Q1-2026, the SDK will provide Real-time monitoring on Mac operating systems. Unlike the current compliance checks, which are on-demand audits, real-time monitoring is dynamic, adapting to live events and rule changes as they occur.
关于第一阶段将支持哪些合规状态，我们将在未来几个月内提供更多详细信息。
Please note that this feature has been moved from Q4-2025 to Q1-2025.
*您需要修改代码才能实现该功能。请联系OPSWAT 团队以获得协助*。
2.2 Support for the Windows 10 Extended Security Updates (ESU) program
需要增强、窗口、数据更新
2025 年 10 月 14 日之后，微软将不再为 Windows 10 提供安全补丁、功能更新或技术支持。Windows 10 系统仍将正常运行，但会逐渐受到安全威胁和软件兼容性问题的影响。
Therefore, Microsoft is introducing the Windows 10 Extended Security Updates (ESU) program, which gives customers the option to receive security updates for PCs enrolled in the program.
To extend support for Windows 10 and ensure the MDES SDK remains compatible with future updates of Windows 10, we have decided to continue supporting Windows 10 via the Windows 10 Extended Security Updates (ESU) program. This support will be applied to devices running Windows 10, version 22H2 with KB5046613, or a later update installed, and having an active ESU subscription.
2.3 Enhanced Installer Verification with InstallFromFiles
ENHANCEMENT, WINDOWS, ENGINE UPDATE NEEDED, CODE CHANGE
我们正在增强 InstallFromFiles 方法，以支持传递预期的 SHA-256 哈希值用于安装程序验证。如果安装程序的哈希值不匹配，SDK 将返回 WAAPI_ERROR_HASH_MISMATCH 错误，从而确保补丁安装过程中更高的完整性和安全性。
该增强功能将首先在 Windows 上推出，随后的版本将支持 Linux 和 macOS。
3 - 要求采取的行动
3.1 CVE-2025-0131
漏洞、窗口
Palo Alto Networks GlobalProtect™ 应用程序在 Windows 设备上使用的OPSWAT MetaDefender Endpoint Security SDK 中存在一个不正确的权限管理漏洞，允许本地验证的非管理员 Windows 用户将其权限升级到 NT AUTHORITY/SYSTEM。但是，执行需要本地用户同时成功利用竞赛条件，这使得该漏洞很难被利用。
要解决 CVE-2025-0131 问题，请将 MDES SDK 升级到 4.3.4451 或更高版本。
3.2 我们将 OesisPackageLinks.xml 移到了 VCR 网关后面
安全更新，录像机网关
自 2024 年 12 月 31 日起，为提高安全性，OesisPackageLinks.xml 文件将迁移到 VCR 网关后面，以取代目前的公开位置。
Since September 1st, 2024, the file can be accessed via the VCR Gateway. You can download the file by following these steps: copy and paste this URL: https://vcr.opswat.com/gw/file/download/OesisPackageLinks.xml?type=1&token=<authorization_token> into your browser and replace <authorization_token> with your unique token. If you don't have a unique token, please contact support.
这一更新可确保持续和安全的访问，用户应更新其系统以适应这一变化。
3.3 终止对 macOS 上使用旧引擎的 AppRemover 软件包的支持
支持结束，Mac
由于我们对 macOS 上的 AppRemover 模块进行了重构，以提供更优化、更精简的体验，因此在My OPSWAT 门户上维护了 MacOS 上 AppRemover 模块的两个软件包：AppRemover OSX 和 AppRemover OSX V2。
从 2026 年 1 月 1 日起，OSX 软件包将被移除。我们建议您升级到 AppRemover OSX V2，以确保您的系统获得 AppRemover 模块的所有新更新和全面技术支持。
3.4 Windows 7 和 Windows 8 支持终止
支持终止,窗口
经过慎重考虑，从 2027 年 1 月 1 日起（比原计划晚一年），SDK 将不再支持 Windows 7 和 Windows 8（包括服务器版本）。
为确保 MDES SDK 的安全性、兼容性和最佳性能，我们建议将端点升级到受支持的 Microsoft 操作系统。
3.5 安装程序签名检查功能的行为变化
行为改变、所有平台、代码改变
自 2025 年 11 月 1 日起，将对安装程序签名检查功能进行行为更改，以提高安全成熟度。在打补丁过程中检查安装程序的数字签名时：
- (无变化）如果安装程序的数字签名有效并通过检查，安装程序将由 SDK 验证，补丁程序将照常进行。
- (无变化）如果安装程序的数字签名无效且未通过检查，系统将返回相应的错误信息，并中止安装过程。
- (新) 如果安装程序的数字签名丢失，将返回相应的错误信息，安装过程也将中止。
小贴士如果因数字签名缺失或无效而出现错误，可使用 InstallFromFiles 方法的 skip_signature_check 标志绕过安装程序签名检查功能。
4 - 详细的 SDK 信息
这只是冰山一角！您可以在我们的支持图表中查看所有支持的应用程序：
