Changelog
Back to All

CLI 6.52.0

October 13th, 2026

Added

  • New regscale acunetix import_acunetix command imports Acunetix XML scan exports as assets, vulnerabilities and issues
  • JCAM SSP import now logs the RegScale security plan id assigned to each newly created plan, with a count in the run summary
  • CrowdStrike Spotlight sync now supplies known-exploited, internet exposure, exploit availability and CVSS vector data for FedRAMP VDR evaluation, and uses the host role to set the asset type
  • Scanner integrations share one asset type lookup, so vendor terms such as server or workstation map to the platform asset types instead of defaulting to Other
  • Axonius V2 get_queries command to list the saved queries defined in Axonius and save their definitions to a JSON file

Changed

  • eMASS POA&M workbook import now reports failed milestone custom field saves as errors instead of reporting success
  • jcam import_controls states outcomes the mapping already decided (a Control Origin or Implementation Status written under the plan's own label, or a Control Origin or applicability answer in the Status column) once per run with a count and the plans it covered, instead of once per control
  • A paginated RegScale issue fetch that loses a page now stops instead of carrying on with the issues that did arrive, so nothing acts on a partial list
  • A JCAM POA&M export or GitLab issue sync stopped by an incomplete RegScale issue fetch now exits with code 6 (upstream unavailable) instead of completing on a partial list, and a Wiz retention reconcile, outdated-issue closure or scanner control assessment skipped for the same reason (control assessments and statuses are then not written rather than passed) counts as a partial failure, so REGSCALE_STRICT_EXIT_CODES=1 reports it as exit 3
  • Compliance syncs now explain when issues are not created because complianceCreation is set to Assessment, and AWS compliance sync help text describes when issues are created for failed controls
  • AWS Security Hub commands report progress while pulling findings (pages, findings and elapsed time every 30 seconds) instead of staying silent until the pull finishes, and say how many findings a --tags filter kept
  • Plan-field routing summaries list how many records each security plan received, and name only the 20 unmatched, ambiguous or shared identifiers with the most records (with a count of the rest) instead of every one; the full lists are logged at DEBUG
  • Guidance now says not to import defusedxml in new code; use hardened lxml for customer-supplied XML
  • Wiz commands now honor the customCaCert setting and the SSL_CERT_FILE and REQUESTS_CA_BUNDLE environment variables, and report a clear error when the named CA bundle cannot be read

Fixed

  • CLI log output redirected or piped to a file is now plain, readable text instead of being polluted with color escape codes
  • Progress bars no longer write redraw characters into redirected or piped log files
  • jcam no longer reports a "Non-Cloud System" cloud descriptor as a value with no RegScale equivalent; it sets no cloud flags, as before, without a warning
  • eMASS Control Information workbook import now reads Army and DISA-format workbooks, which have no Application, Database or Operating System Layer columns, without writing values into the wrong fields
  • eMASS Control Information workbook import no longer resets a control's assessment frequency when the Frequency cell is blank
  • eMASS workbook detection now recognizes Control Information workbooks by their column headers
  • eMASS hardware/software inventory import no longer creates facilities during a dry run
  • eMASS POA&M workbook import now finds the data sheet in Army and DISA-format workbooks that have no sheet named POA&M
  • jcam check_config now reports a failed JCAM read, including an unset jcamToken or jcamURL, as a failure rather than as an empty tenant or a jcamFilter problem, and exits non-zero when JCAM cannot be read, since an import would stop on the same read
  • Issue fetches by security plan no longer return each issue past the first 50 twice, and no longer return a partial list as if it were complete when a page fails, so the JCAM POA&M export, GitLab issue sync, Wiz retention and scanner control assessments stop acting on incomplete data
  • eMASS system export import no longer deletes a tenant's existing information types when creating missing ones
  • Information type lookups no longer fail when a type on the tenant has no description
  • Nessus imports no longer close assets or findings for hosts in a file that failed to parse, report the file as an error, and leave it in place so the next run retries it
  • Vulnerability mop-up now runs on the last request of an import even when the finding count is an exact multiple of the chunk size or the last chunk holds only compliance findings
  • The --scan_date option is honored on Nessus imports, and each file keeps its own scan date when none is given
  • Nessus vulnerabilities that carry only a CVSS v2 score now import with that score in the CVSS v2 field instead of 0
  • The Tenable.io minimum severity filter now treats critical as 9.0 and accepts moderate
  • Nessus software inventory is now built from the downloaded CPE dictionary, and a failed dictionary download is reported and no longer removes the existing one
  • A Nessus import that finds no files now exits with a failure status
  • A finding that appears in more than one Nessus file is no longer imported as a duplicate issue
  • The Nessus CPE dictionary download now honors the sslVerify setting
  • Flat-file imports no longer crash when the operating system column contains only numeric values
  • Nexpose import now accepts the Rapid7 InsightVM CSV export headers without a manual column mapping
  • Xray import now reads JFrog Xray native JSON exports that wrap findings in a top-level rows list
  • eMASS POA&M sync now reports updated POA&Ms separately from newly created ones
  • eMASS API full system sync with --dry-run no longer pushes controls and POA&Ms to eMASS
  • The CLI's log file now records a timestamp and level on every log record, so a long run can be diagnosed from the file afterwards
  • Routed Security Hub syncs (sync_securityhub_by_plan_field, sync_securityhub_by_component_map) run without --fallback_ssp_id now keep only the findings that reach a security plan while reading, instead of holding every finding in memory first, so a multi-account pull where most findings route to no plan stays small; with a fallback plan, unmatched and untagged findings are still held because the fallback receives them
  • Axonius V2 saved-query sync now works against Axonius 6.1.67
  • Qualys sync no longer changes the status or due date of vulnerabilities and issues that were marked accepted, excepted or otherwise set by a person
  • Scanner imports that merge several findings into one record now keep any internet exposure, known-exploited and exploit flags, the highest EPSS score and severity, and the earliest first-seen date from every finding instead of only the first
  • eMASS POA&M pushes no longer update an unrelated eMASS POA&M when a RegScale issue has no exact match
  • The AWS evidence commands (sync_s3, sync_cloudtrail, sync_ssm, sync_cloudwatch, sync_cloudwatch_ex, sync_guardduty, sync_iam, sync_kms, sync_ec2, sync_org, sync_ecr, sync_inspector, sync_directory_services) and wiz compliance_report and wiz sync_compliance now fail the run when RegScale does not accept the evidence record or its file, with exit code 4 for a permission refusal and 6 when RegScale cannot be reached
  • Evidence created by connector commands such as Entra ID evidence collection, the Wiz compliance report, and the AWS and GCP evidence commands is no longer rejected on instances with evidence approval enabled, because the CLI no longer sets the running user as the evidence approver
  • Listing threats by parent and reading, updating or deleting privacy records no longer fail with a KeyError
  • Mock service settings in init.yaml are now applied to Tenable, Microsoft Defender, AWS and BigQuery requests
  • Updated Python and OpenSSL in the FIPS container image to patched versions
  • Fixed AWS Systems Manager compliance totals, which were always reported as zero compliant and zero non-compliant
  • Wiz host configuration findings recorded their first-seen date as the sync time instead of the date Wiz first saw them
  • Entra ID evidence collection for the authentication evidence type now saves the authentication methods policy instead of failing with a missing key error
  • The Threat model's record count endpoint template now points to the route the API serves
  • Tanium sync now records each consolidated vulnerability against the same host on every run instead of a randomly chosen affected host
  • Workflow action, workflow instance and workflow template models can be imported again
  • Tenable.sc JSONL sync now stores a finding whose plugin name is empty but that carries a CVE or plugin id, under a title derived from the CVE and synopsis
  • Tenable.sc JSONL sync now logs a warning naming the file and line of a finding it skips because the finding has no plugin name, CVE or plugin id, or is missing a required field, instead of dropping it silently
  • The API-call summary logged at the end of a scanner sync is now emitted at DEBUG instead of INFO
  • A vulnerability batch chunk the server refuses over one bad record no longer loses the issues and asset links of the records it retries one at a time; they go through the same batch route as the rest
  • A Tanium vulnerability consolidated from several records now reports the earliest first-detected and the latest last-detected date across those records
  • defender collect_entra_evidence, gcp collect_evidence and gcp sync_findings --generate-evidence now fail the run (exit code 1, 4 for a permission refusal, or 6 when RegScale cannot be reached) when RegScale does not accept an evidence record or its file, after finishing the remaining evidence, and the error line for a refused evidence record now names the record and gives RegScale's reason