Libraesva ESG v5.5: Release Notes – LibraCyber - Help Center

Table of Contents

Main features of version 5.5

Semantic AI engine: A new local Small Language Model (SLM)-based engine that classifies emails
by meaning, not just structure. This enhances detection of sophisticated, well-written phishing
or social engineering emails, even when traditional red flags are absent.
Enhanced message scan indicators: message indicators now include both positive and negative
signals and are integrated with the new “AI classifier engine” enabling more accurate and
insightful threat assessments-making and response speed.
API configuration for domain admins: Domain-level settings can now be managed directly via API,
allowing greater automation and remote management for MSPs or multi-domain environments.
AI dashboard widget: A new interactive widget displays real-time AI-driven threat classification
activity, including drill-down views that help visualize detection trends and model classification
Custom semantic categories: Each domain can now define up to eight context-aware threat categories.
This allows admins to tailor the classification system to business-specific risks (e.g. invoice
fraud) for sharper alerting and reporting.

Version 5.5.17 (Jun 8, 2026)

Bug fixes

Attachment Filters: added “.vhdx” to blocked extensions
CRM114: fixed enable/disable web UI action
User roles: add “appliance manger” missing role to super-administrator for on-premises appliances

Version 5.5.16 (May 26, 2026)

Improvements

Domain validation: use only ICANN domains from the public suffix list
PhishBrain: disabled phishing highlight on user campaigns

Bug fixes

Cluster setup: avoid failure on post-setup when no TLS certificate is configured yet
Email continuity: fixed visualization of Reply-To headers
Resource profile: make sure number of processes is re-configured when changing profile

Version 5.5.15 (Apr 20, 2026)

Bug fixes

Archive rules: fixed a bug on first access which generated a useless pending job
Azure: fixed first boot storage optimization script
LDAP: avoid attempting a connection to the secondary host when it is not configured
Integration: test page shows the group primary address when there are no additional addresses
Mail Intercept: fixed "deliver now" actions for super admin users
Relay: fixed importing of "comment" from CSV
Report: shows the correct "date from" in reports generated using date range is "All"
Release requests: shows the link for "message view" in domain admin notification when a request is made by a normal user
Search: hide the "Mark as" button when the Bayesian engine is disabled
SIEM HTTP event forwarder: send brief message data when extended information is not available
Threat remediation: when recalling from multiple mailboxes, a single failure won't stop the whole recall
User Manager: fixed editing of reserved user 'admin'
User Messages: use the user-defined reports for bounce spam action instead of the built-in report

API

FIXED: ignore broken UTF-8 chars in message uris in GET /message/{id}/GET /messages-journal/GET /messages-soar

Version 5.5.14 (Feb 17, 2026)

Improvements

Microsoft 365: improve addin UX on deploy by hint about disabled API access
AI engine: added header X-%org-name%-Ai-Classifier for deliveries to internal domains

Bug fixes

Auditing: track every “apply all settings” actions
Backup: audit restore action right after a successful restore
Cofense: preserve configured client secret when editing a connector
Dictionary: restored dictionary words text import
Google Workspace: fixed import when when no group is configured
Mail encryption: block web portal with 404 errors when disabled or unlicensed
Mail queues: fixed an incorrect message being displayed when changing table rows
Policyd: fixed reloading of configuration during apply
QR Code: fixed identification of IP address URI
Release request: permit user action when license is in overuse
User management: fixed "make primary" action on user email

API

ADD: added groupsAsFunctional property to /api/v2/integration/google-connector-config
ADD: added groupsAsFunctional property to /api/v2/integration/ldap
ADD: added groupsAsFunctional property to /api/v2/integration/microsoft-365-config
FIXED: validation on from property for /welcomelist and /blocklist

Version 5.5.13 (Feb 11, 2026)

Improvements

Outlook add-in: new Microsoft Authentication Library (MSAL) authentication (require manifest deploy)
Web UI: improved responsiveness of appliances managing thousands of relay domains

Bug fixes

Bulk mail management: remove useless delete and edit buttons
SIEM HTTP event forwarder: allow change settings to “Administrator” with “can configure” permissions (regression from 5.5.10)
URLSand: fixed an encoding issue when replacing link in HTML part that caused some “?” chars to be inserted in email (regression introduced in ESG 5.5.12)
Web UI: fixed reloading of datagrid views on page-size change

API

ADD: new POST /logout to delete the current authentication token

Version 5.5.12 (Feb 02, 2026)

Security

URLSand: improved rewriting of HTML link in text part

Improvements

DoS protection: more efficient drop of connection coming from banned networks
TLS: improved UI to show more verbose errors during certificate upload

Bug fixes

Backup: reset message ID after backup restore
ESG cloud: reverted strict same-site policy during authentication for `esvacloud.com` to allow quarantine actions from any mail client and browser (regression from 5.5.11)
TLS: filter UTF-8 BOM from uploaded PEM files
TLS: fixed key verification for non-wildcard certificates

Version 5.5.11 (Jan 12, 2026)

Security

ESG cloud: enforce same-site policy during authentication for esvacloud.com
URLSand: always handle URIs which includes “user info”
Web UI: integrate OWASP guidelines for new passwords (e.g., longer and stronger passwords)
Web UI: harden login security by enforcing “no-store” cache policy
Web UI: harden security by integrating CSRF protection for all requests

Improvements

Mail queues: improve performance by limiting the default number of queued messages displayed
Mail intercept: default templates now include the “$from” address to clarify the sender’s identity

Bug fixes

Maillog2db: delivery information relay status is truncated to prevent failures due to excessive length
Storage: restore quarantine expansion on systems with namespaced storage (e.g., Amazon AWS)
User management: fixed cleanup of old imports for domain admin users
User profile: password change no longer allows reuse of the existing password
User role: improve detailed email continuity permission visualization
User role: prevent creation of custom super-user roles (i.e., role managers)

API

ADD: new POST /profile/password to change the password of the logged-in user
ADD: new POST /profile/otp-secret to configure MFA authentication for the logged-in user
ADD: new DELETE /profile/otp-secret to reset MFA authentication for the logged-in user
ADD: new DELETE /user/{id}/otp-secret to reset MFA authentication for the specified user
IMPROVED: harden password validation in /user/{id}/password
FIXED: deny access to POST /user/{id}/otp-secret for domain administrator roles
DEPRECATED: using POST /user/{id}/otp-secret with an empty value to remove a secret—use DELETE instead
DEPRECATED: using POST /user/{self_id}/otp-secret or POST /user/{self_id}/password
to change the current user’s password use POST /profile/password and POST /profile/otp-secret instead

Version 5.5.10 (Dec 9, 2025)

Security

Antivirus: integrate additional scanning for Microsoft OneNote files and images
Country policy: policies are now available to any “Administrator” with “can configure” permissions
ESG cloud: “Appliance administrator” role is limited to Libraesva IT team
SSH: service can be enabled or disabled by any “Administrator” with “can configure” permissions
Syslog: service can be enabled or disabled by any “Administrator” with “can configure” permissions
User profile: require OTP to change password or disable two-factor authentication
Backup manager role: allows fine-grained control of backup and restore availability
Web UI: hardened security by integrating CSRF protection to data grids

Improvements

Cluster auto-recover: make multiple reconnect attempt before notifying a failed connection errors
Machine learning: reduce the wait time for learn action after a user feedback

Bug fixes

Mail queue cleaner: fixed search by “bounce” matcher
MSSP Monitor: handle timeout error
NTPd: fixed configuration of custom NTP server
SIEM HTTP event forwarder: added missing message properties
SMTP Auth: fixed authentication when MTA myhostname contains uppercase characters
Spam Engine: skip RBL check for managed relay domains
User profile: fixed reset of two-factor authentication
User role: fixed preview of permissions for “Advanced settings ➔ ESG config parameters”

API

FIXED: hardened POST /user pnd PATCH /user permission checking
FIXED: property hostname in POST /integration/imap and POST /integration/pop3
FIXED: properties userRole and functionalUserRole in GET /user-default

Version 5.5.9 (Nov 3, 2025)

Security

Bayes: improved accuracy by increasing memory on big appliances
Content security policy: hardened security of login procedures
Web UI: hardened javascript runtime

Improvements

Reports: MTA statistics report is extended to last 24 hours
Release request: improved index page load time for domain administrators

Bug fixes

Cluster: fixed a rece condition when restarting service after a cluster worker setup
DoS protection: reload jail and blocked clients after firewall reconfiguration
Mail scanner: fixed engine reload when organization name changes
URLSand: avoid multiple replaces on URL links without protocol prefix in HTML a tags
Reports: fixed “machine learning” tag in rules hit report
User profile: fixed quarantine preference update for non-administrative users

Version 5.5.8 (Oct 22, 2025)

Security

Web UI: hardened data validation and javascript runtime

Improvements

API: service is disabled by default to reduce attack surface
Export: indent XML data to improve readability

Bug fixes

Dashboard: fixed “recalled” count in “Appliance Status” widget when a cluster is setup
LDAP: fixed multi selection to change tenant group
View mail: use received date as a fallback for when Date header is missing
IMAP/POP3: fixed connection when not using TLS Security (i.e., plain text)

API

FIXED: configured WAF to allow requests to URL /user-message

Version 5.5.7 (Sep 16, 2025)

Security

Mail scanner: fixed CVE-2025-59689
System upgrade: new upgrade system with asymmetric signature validation and encryption
Passwordless: removed old authentication systems (may need re-login)
API authentication: removed old authentication systems (may need re-login)
Remote support: removed the old remote support connection via port 25
ClamAV: added support for new signature formats via Libraesva updates

Bug fixes

Queue cleanup: avoid timeouts while waiting for user-first confirmation on removal

Version 5.5.6 (Aug 25, 2025)

Improvements

Apply settings: added filter for pending changes in audit logs
Data export: quote cells when tabs or semicolons are present to improve Microsoft Excel import
Quarantine digest: minor improvements to actions visualization for smaller screens (e.g. tablets)
Quarantine digest: updated report description for users
SNMP: update documentation link for better MIB discovery
Web UI: relays sorted alphabetically in multiple select boxes

Bug fixes

Antispam settings: clear engine cache after changes on custom rules / overrides
Content filter: prevent creation of unsupported header rules for Received header
Email continuity: fixed selection of available sender addresses when forwarding an email
LDAP: fixed import of groups when member property is not available (regression from 5.5.5)
Quarantine digest: removes “view” action for user without body permissions when a privacy password is enabled
Passwordless login: fixed visualization of authentication failures in web UI
Passwordless login: prevent new authentication in cluster workers
Passwordless login: updates last use whenever the user re-login
User text import: fixed examples of CSV file

API

IMPROVED: added description for `/domain-authentication-set` to document the `PUT` method alternative

Version 5.5.5 (Jul 22, 2025)

Features

Cofense: automatically recall messages reported via triage
Dashboard: new dashboard widgets “User Actions,” “Most targeted recipients” and “Appliance status”
Integration: added “SIEM HTTP event forwarder” for message journaling to SIEM
Report: new report type “Most Targeted Recipients”

Improvements

Dashboard: increase “top X” widgets to 25 entries
Dashboard: incoming queue widget “warning” level is now dependent from the appliance sizing
Message details: highlight messages that are learned as good/bad due to user feedback
Message results: added new result “Recipient Verification Deferred” to highlight verification servers temporary issues
Syslog: added support for RFC5242 format
Syslog: added support for static token that can be used by a SIEM to identify messages from ESG
Threat Analysis Portal: improved portal access and the registration procedure
TLS check: improved notification of invalid and expired certificates

Bug fixes

Integration: fixed many texts in advanced logging
Menu: changed “Account Takeover Protection” menu labels
Message listing: fixed UI for message result “invalid sender (DNS)”
Policy quota: fixed reliability of notifications and added a 1-hour rate-limit for each tracker
Reports: show “bounce message” in table results
Search: properly show the “view body” button for user roles
Syslog: added more validation constraints to avoid issues when configuring TCP+TLS

API

OpenAPI: implemented deprecations for v2 in OpenAPI documentation

Version 5.5.4 (Jul 7, 2025)

Improvements

Attachment filter: preserve inlined HTML in attached forwarded email when a “HTML deny” rule exists
DLP: renamed all occurrence of MCP/Message Content Protection with DLP/Data Loss Prevention
Integration: validation issues for users, groups or email are shown when executing web tests
Job status: adaptive UI refresh, which reduces the HTTPs server loads and lets the session expire
Message details: improved “view full DLP report” modal
Message details: track attachments from attached forwarded email
User management: allow admins to bind primary address as secondary addresses of other users
Search: added “Marked as Good” and “Marked as Bad” conditions
Social graph: improved visualization of detailed information

Bug fixes

AI Classifier: increased timeout for long-running analysis
Dashboard: fixed reject count in “totals”/”cluster status” widget
Google Workspace: fixed the import of the first user email where is not the primary address
LDAP: fixed the import of the first user email where is not the primary address
Microsoft 365: remove the duplicated primary address shown while testing groups
Outlook add-in: notify the user when Two-Factor Authentication (OTP) is required
Reports: fixed alignment and width of graph in generated PDF
Social graph: fixed ATE score visualization

API

ADD: added dlp/highDlp/dlpDictionary/dlpWelcomelisted/dlpBlocklisted/dlpScore/dlpReport properties to GET /message
FIXED: avoid access denied error on /valid-recipient for administrator roles
DEPRECATED: properties mcp/highMcp/mcpDictionary/mcpWelcomelisted/mcpBlocklisted/mcpScore/mcpReport from GET /message

Version 5.5.3 (Jun 23, 2025)

Improvements

Dashboard: adaptive UI refresh, which reduces the HTTPs server loads and lets the session expire
Dashboard: data ranges have more “last X hours” ranges and no longer allow week or month ranges
Dashboard: show explicit warning when the license is expired
Dashboard: greatly optimize the database performance of the “analyzed message”, “email flow”, “threat maps”, “cluster status”, “AI classification”, “message distribution”, “top sender” and “top recipient” widget
Licensing: show previous license information when the license is expired
Microsoft Azure: triggers a post-deployment storage optimization procedure after every storage expansion
Microsoft Azure: upgrade agent version to 2.13
Search: added “last 6 hours”, “last 12 hours” and “last 48 hours” filters
Web UI: temporary disable form on submission to avoid multiple actions caused by double-clicks

Bug fixes

Email Continuity: fixed mail compose editor when logged in as user with role “basic user”
License accounting: excludes released messages from accounted deliveries
Message details: fixed spam confidence when spam reports contains multiple rules with the same name
Syslog: fixed logging to syslog of some Web-UI failed login attempt

Version 5.5.2 (Jun 12, 2025)

Security

Notification to sender: notifications are sent only for outgoing messages

Improvements

Microsoft Azure: added post-deployment storage optimization procedure
Microsoft 365: added “hybrid” label in test page for users that are hybrid and not fully migrated
Microsoft 365: fixed import of user with duplicated additional addresses
ESG AI: fine-tuned engine parallelism when load average is high

Bug fixes

File type: updated blocked audio and video label descriptions
Message details: show when failed DMARC results are ignored since a message is sent by trusted sender
Microsoft Azure: fixed firewall rule for Microsoft management IP
Outlook add-in: fixed release action when a reason is required
Search: fixed export of saved search results
User management: fixed user export for domain admin
User management: permit to “reset to default” customized user defaults

Version 5.5.1 (May, 26 2025)

Security

Whaling protection: ignore outgoing email from SPF validated Google Workspace tenants

Improvements

Microsoft 365/Google Workspace: convert local users as functional, when a Google user is converted to group
Microsoft 365/Google Workspace: when a local user is converted to functional (e.g, shared mailbox,
groups), all emails assigned from previous group membership are removed

Bug fixes

Google Workspace: fixed creation of functional users when group emails aren’t assigned as user aliases
Google Workspace: fixed an exception when searching by address
Greylisting: avoid duplicated entries for auto welcomelisted senders
HTTP: avoid server name canonicalization for redirect when using self-signed certificates
Outlook addin: fixed report as bad action
Quarantine digest: null users and null functional users roles are ignored when generating reports

API

ADD: added /network/dns-forwarder to configure DNS forwarder
ADD: added /network/static-host-lookup to configure Static Host Lookup
ADD: added /sender-dependent-relay to configure sender dependent relay

Version 5.5.0 (May 12, 2025)

Security

WAF: improved application firewall blocks for API access
URLSand: improved “base URL” disarming
URLSand: improve scheme parsing for HTTP/HTTPS

Improvements

Mailer: added “%org-name%” header to all ESG generated emails and reports
Mail scanner: fine tuned configuration to avoid cpu saturation
Message details: show multiple SPF, DKIM and DMARC authentication results with extended information
View mail: show CC header in the header section
User management: user export will include email address and domain admin permissions
User role: allow customization of “can view” capability for “clean” result category

Bug fixes

Message details: show when welcomelist are ignored due to DKIM or DMARC failures
Message details: don’t store “cid:” links and http local anchors
Search: apply custom permissions for message results to custom administrator roles
System preferences: removed empty section “System notification” in cloud appliances
Rebranding: replaced “Antispam Service” with “Email Security”
Saved search: disambiguate duplicate names

API

ADD: added /machine-learning/ai-classifier to configure AI Classification engine
ADD: property aiClassifier to /message/{id}
ADD: property hostname to /integration/pop3
ADD: added /trusted-network to configure trusted networks
ADD: property headers.spfValid to GET /message/{id}
ADD: added headers.authenticationResults to GET /message/{id}
IMPROVED /message/{id}/fetch returns 410/Gone when a message is removed or has been rotated
IMPROVED: property headers.dkimValid in GET /message/{id} will honor alignment to sender domain
IMPROVED: properties headers.spfResult/headers.spfIdentity from GET /message/{id}
FIXED: removed POST/PATCH/PUT action on non-editable /quarantine/release-request-entry
FIXED: removed /graph since it’s included in /report output
FIXED: allow /report to domain administrator and user roles
FIXED: filter sender/recipient in GET /restricted-sender
FIXED: filter sender/recipient in GET /attachment-filter/file-name-rule,
GET /attachment-filter/file-type-rule, GET /attachment-filter/password-protected-archive-rule
and GET /attachment-filter/scan-archive-rule
FIXED: avoid duplicate entries with the same domain unique property for /relay
DEPRECATED: properties headers.spfResult/headers.spfIdentity from GET /message/{id}

Breaking changes

There are no breaking changes in this release.

Version 5.4

All upgrades from previous versions are included. See the full release notes of Libraesva ESG version 5.4.