Libraesva ESG v5.5: Release Notes

Main features of version 5.5

• Semantic AI engine: A new local Small Language Model (SLM)-based engine that classifies emails
  by meaning, not just structure. This enhances detection of sophisticated, well-written phishing
  or social engineering emails, even when traditional red flags are absent.
• Enhanced message scan indicators: message indicators now include both positive and negative
  signals and are integrated with the new “AI classifier engine” enabling more accurate and
  insightful threat assessments-making and response speed.
• API configuration for domain admins: Domain-level settings can now be managed directly via API,
  allowing greater automation and remote management for MSPs or multi-domain environments.
• AI dashboard widget: A new interactive widget displays real-time AI-driven threat classification
  activity, including drill-down views that help visualize detection trends and model classification
• Custom semantic categories: Each domain can now define up to eight context-aware threat categories.
  This allows admins to tailor the classification system to business-specific risks (e.g. invoice
  fraud) for sharper alerting and reporting.

Version 5.5.17 (Jun 8, 2026)

Bug fixes

• Attachment Filters: added “.vhdx” to blocked extensions
• CRM114: fixed enable/disable web UI action
• User roles: add “appliance manger” missing role to super-administrator for on-premises appliances

Version 5.5.16 (May 26, 2026)

Improvements

• Domain validation: use only ICANN domains from the public suffix list
• PhishBrain: disabled phishing highlight on user campaigns

Bug fixes

• Cluster setup: avoid failure on post-setup when no TLS certificate is configured yet
• Email continuity: fixed visualization of Reply-To headers
• Resource profile: make sure number of processes is re-configured when changing profile

Version 5.5.15 (Apr 20, 2026)

Bug fixes

• Archive rules: fixed a bug on first access which generated a useless pending job
• Azure: fixed first boot storage optimization script
• LDAP: avoid attempting a connection to the secondary host when it is not configured
• Integration: test page shows the group primary address when there are no additional addresses
• Mail Intercept: fixed "deliver now" actions for super admin users
• Relay: fixed importing of "comment" from CSV
• Report: shows the correct "date from" in reports generated using date range is "All"
• Release requests: shows the link for "message view" in domain admin notification when a request is made by a normal user
• Search: hide the "Mark as" button when the Bayesian engine is disabled
• SIEM HTTP event forwarder: send brief message data when extended information is not available
• Threat remediation: when recalling from multiple mailboxes, a single failure won't stop the whole recall
• User Manager: fixed editing of reserved user 'admin'
• User Messages: use the user-defined reports for bounce spam action instead of the built-in report

API

• FIXED: ignore broken UTF-8 chars in message uris in GET /message/{id}/GET /messages-journal/GET /messages-soar

Version 5.5.14 (Feb 17, 2026)

Improvements

• Microsoft 365: improve addin UX on deploy by hint about disabled API access
• AI engine: added header X-%org-name%-Ai-Classifier for deliveries to internal domains

Bug fixes

• Auditing: track every “apply all settings” actions
• Backup: audit restore action right after a successful restore
• Cofense: preserve configured client secret when editing a connector
• Dictionary: restored dictionary words text import
• Google Workspace: fixed import when when no group is configured
• Mail encryption: block web portal with 404 errors when disabled or unlicensed
• Mail queues: fixed an incorrect message being displayed when changing table rows
• Policyd: fixed reloading of configuration during apply
• QR Code: fixed identification of IP address URI
• Release request: permit user action when license is in overuse
• User management: fixed "make primary" action on user email

API

• ADD: added groupsAsFunctional property to /api/v2/integration/google-connector-config
• ADD: added groupsAsFunctional property to /api/v2/integration/ldap
• ADD: added groupsAsFunctional property to /api/v2/integration/microsoft-365-config
• FIXED: validation on from property for /welcomelist and /blocklist

Version 5.5.13 (Feb 11, 2026)

Improvements

• Outlook add-in: new Microsoft Authentication Library (MSAL) authentication (require manifest deploy)
• Web UI: improved responsiveness of appliances managing thousands of relay domains

Bug fixes

• Bulk mail management: remove useless delete and edit buttons
• SIEM HTTP event forwarder: allow change settings to “Administrator” with “can configure” permissions (regression from 5.5.10)
• URLSand: fixed an encoding issue when replacing link in HTML part that caused some “?” chars to be inserted in email (regression introduced in ESG 5.5.12)
• Web UI: fixed reloading of datagrid views on page-size change

API

• ADD: new POST /logout to delete the current authentication token

Version 5.5.12 (Feb 02, 2026)

Security

• URLSand: improved rewriting of HTML link in text part

Improvements

• DoS protection: more efficient drop of connection coming from banned networks
• TLS: improved UI to show more verbose errors during certificate upload

Bug fixes

• Backup: reset message ID after backup restore
• ESG cloud: reverted strict same-site policy during authentication for `esvacloud.com` to allow quarantine actions from any mail client and browser (regression from 5.5.11)
• TLS: filter UTF-8 BOM from uploaded PEM files
• TLS: fixed key verification for non-wildcard certificates

Version 5.5.11 (Jan 12, 2026)

Security

• ESG cloud: enforce same-site policy during authentication for esvacloud.com
• URLSand: always handle URIs which includes “user info”
• Web UI: integrate OWASP guidelines for new passwords (e.g., longer and stronger passwords)
• Web UI: harden login security by enforcing “no-store” cache policy
• Web UI: harden security by integrating CSRF protection for all requests

Improvements

• Mail queues: improve performance by limiting the default number of queued messages displayed
• Mail intercept: default templates now include the “$from” address to clarify the sender’s identity

Bug fixes

• Maillog2db: delivery information relay status is truncated to prevent failures due to excessive length
• Storage: restore quarantine expansion on systems with namespaced storage (e.g., Amazon AWS)
• User management: fixed cleanup of old imports for domain admin users
• User profile: password change no longer allows reuse of the existing password
• User role: improve detailed email continuity permission visualization
• User role: prevent creation of custom super-user roles (i.e., role managers)

API

• ADD: new POST /profile/password to change the password of the logged-in user
• ADD: new POST /profile/otp-secret to configure MFA authentication for the logged-in user
• ADD: new DELETE /profile/otp-secret to reset MFA authentication for the logged-in user
• ADD: new DELETE /user/{id}/otp-secret to reset MFA authentication for the specified user
• IMPROVED: harden password validation in /user/{id}/password
• FIXED: deny access to POST /user/{id}/otp-secret for domain administrator roles
• DEPRECATED: using POST /user/{id}/otp-secret with an empty value to remove a secret—use DELETE instead
• DEPRECATED: using POST /user/{self_id}/otp-secret or POST /user/{self_id}/password
  to change the current user’s password use POST /profile/password and POST /profile/otp-secret instead

Version 5.5.10 (Dec 9, 2025)

Security

• Antivirus: integrate additional scanning for Microsoft OneNote files and images
• Country policy: policies are now available to any “Administrator” with “can configure” permissions
• ESG cloud: “Appliance administrator” role is limited to Libraesva IT team
• SSH: service can be enabled or disabled by any “Administrator” with “can configure” permissions
• Syslog: service can be enabled or disabled by any “Administrator” with “can configure” permissions
• User profile: require OTP to change password or disable two-factor authentication
• Backup manager role: allows fine-grained control of backup and restore availability
• Web UI: hardened security by integrating CSRF protection to data grids

Improvements

• Cluster auto-recover: make multiple reconnect attempt before notifying a failed connection errors
• Machine learning: reduce the wait time for learn action after a user feedback

Bug fixes

• Mail queue cleaner: fixed search by “bounce” matcher
• MSSP Monitor: handle timeout error
• NTPd: fixed configuration of custom NTP server
• SIEM HTTP event forwarder: added missing message properties
• SMTP Auth: fixed authentication when MTA myhostname contains uppercase characters
• Spam Engine: skip RBL check for managed relay domains
• User profile: fixed reset of two-factor authentication
• User role: fixed preview of permissions for “Advanced settings ➔ ESG config parameters”

API

• FIXED: hardened POST /user pnd PATCH /user permission checking
• FIXED: property hostname in POST /integration/imap and POST /integration/pop3
• FIXED: properties userRole and functionalUserRole in GET /user-default

Version 5.5.9 (Nov 3, 2025)

Security

• Bayes: improved accuracy by increasing memory on big appliances
• Content security policy: hardened security of login procedures
• Web UI: hardened javascript runtime

Improvements

• Reports: MTA statistics report is extended to last 24 hours
• Release request: improved index page load time for domain administrators

Bug fixes

• Cluster: fixed a rece condition when restarting service after a cluster worker setup
• DoS protection: reload jail and blocked clients after firewall reconfiguration
• Mail scanner: fixed engine reload when organization name changes
• URLSand: avoid multiple replaces on URL links without protocol prefix in HTML a tags
• Reports: fixed “machine learning” tag in rules hit report
• User profile: fixed quarantine preference update for non-administrative users

Version 5.5.8 (Oct 22, 2025)

Security

• Web UI: hardened data validation and javascript runtime

Improvements

• API: service is disabled by default to reduce attack surface
• Export: indent XML data to improve readability

Bug fixes

• Dashboard: fixed “recalled” count in “Appliance Status” widget when a cluster is setup
• LDAP: fixed multi selection to change tenant group
• View mail: use received date as a fallback for when Date header is missing
• IMAP/POP3: fixed connection when not using TLS Security (i.e., plain text)

API

• FIXED: configured WAF to allow requests to URL /user-message

Version 5.5.7 (Sep 16, 2025)

Security

• Mail scanner: fixed CVE-2025-59689
• System upgrade: new upgrade system with asymmetric signature validation and encryption
• Passwordless: removed old authentication systems (may need re-login)
• API authentication: removed old authentication systems (may need re-login)
• Remote support: removed the old remote support connection via port 25
• ClamAV: added support for new signature formats via Libraesva updates

Bug fixes

• Queue cleanup: avoid timeouts while waiting for user-first confirmation on removal

Version 5.5.6 (Aug 25, 2025)

Improvements

• Apply settings: added filter for pending changes in audit logs
• Data export: quote cells when tabs or semicolons are present to improve Microsoft Excel import
• Quarantine digest: minor improvements to actions visualization for smaller screens (e.g. tablets)
• Quarantine digest: updated report description for users
• SNMP: update documentation link for better MIB discovery
• Web UI: relays sorted alphabetically in multiple select boxes

Bug fixes

• Antispam settings: clear engine cache after changes on custom rules / overrides
• Content filter: prevent creation of unsupported header rules for Received header
• Email continuity: fixed selection of available sender addresses when forwarding an email
• LDAP: fixed import of groups when member property is not available (regression from 5.5.5)
• Quarantine digest: removes “view” action for user without body permissions when a privacy password is enabled
• Passwordless login: fixed visualization of authentication failures in web UI
• Passwordless login: prevent new authentication in cluster workers
• Passwordless login: updates last use whenever the user re-login
• User text import: fixed examples of CSV file

API

• IMPROVED: added description for `/domain-authentication-set` to document the `PUT` method alternative

Version 5.5.5 (Jul 22, 2025)

Features

• Cofense: automatically recall messages reported via triage
• Dashboard: new dashboard widgets “User Actions,” “Most targeted recipients” and “Appliance status”
• Integration: added “SIEM HTTP event forwarder” for message journaling to SIEM
• Report: new report type “Most Targeted Recipients”

Improvements

• Dashboard: increase “top X” widgets to 25 entries
• Dashboard: incoming queue widget “warning” level is now dependent from the appliance sizing
• Message details: highlight messages that are learned as good/bad due to user feedback
• Message results: added new result “Recipient Verification Deferred” to highlight verification servers temporary issues
• Syslog: added support for RFC5242 format
• Syslog: added support for static token that can be used by a SIEM to identify messages from ESG
• Threat Analysis Portal: improved portal access and the registration procedure
• TLS check: improved notification of invalid and expired certificates

Bug fixes

• Integration: fixed many texts in advanced logging
• Menu: changed “Account Takeover Protection” menu labels
• Message listing: fixed UI for message result “invalid sender (DNS)”
• Policy quota: fixed reliability of notifications and added a 1-hour rate-limit for each tracker
• Reports: show “bounce message” in table results
• Search: properly show the “view body” button for user roles
• Syslog: added more validation constraints to avoid issues when configuring TCP+TLS

API

• OpenAPI: implemented deprecations for v2 in OpenAPI documentation

Version 5.5.4 (Jul 7, 2025)

Improvements

• Attachment filter: preserve inlined HTML in attached forwarded email when a “HTML deny” rule exists
• DLP: renamed all occurrence of MCP/Message Content Protection with DLP/Data Loss Prevention
• Integration: validation issues for users, groups or email are shown when executing web tests
• Job status: adaptive UI refresh, which reduces the HTTPs server loads and lets the session expire
• Message details: improved “view full DLP report” modal
• Message details: track attachments from attached forwarded email
• User management: allow admins to bind primary address as secondary addresses of other users
• Search: added “Marked as Good” and “Marked as Bad” conditions
• Social graph: improved visualization of detailed information

Bug fixes

• AI Classifier: increased timeout for long-running analysis
• Dashboard: fixed reject count in “totals”/”cluster status” widget
• Google Workspace: fixed the import of the first user email where is not the primary address
• LDAP: fixed the import of the first user email where is not the primary address
• Microsoft 365: remove the duplicated primary address shown while testing groups
• Outlook add-in: notify the user when Two-Factor Authentication (OTP) is required
• Reports: fixed alignment and width of graph in generated PDF
• Social graph: fixed ATE score visualization

API

• ADD: added dlp/highDlp/dlpDictionary/dlpWelcomelisted/dlpBlocklisted/dlpScore/dlpReport properties to GET /message
• FIXED: avoid access denied error on /valid-recipient for administrator roles
• DEPRECATED: properties mcp/highMcp/mcpDictionary/mcpWelcomelisted/mcpBlocklisted/mcpScore/mcpReport from GET /message

Version 5.5.3 (Jun 23, 2025)

Improvements

• Dashboard: adaptive UI refresh, which reduces the HTTPs server loads and lets the session expire
• Dashboard: data ranges have more “last X hours” ranges and no longer allow week or month ranges
• Dashboard: show explicit warning when the license is expired
• Dashboard: greatly optimize the database performance of the “analyzed message”, “email flow”, “threat maps”, “cluster status”, “AI classification”, “message distribution”, “top sender” and “top recipient” widget
• Licensing: show previous license information when the license is expired
• Microsoft Azure: triggers a post-deployment storage optimization procedure after every storage expansion
• Microsoft Azure: upgrade agent version to 2.13
• Search: added “last 6 hours”, “last 12 hours” and “last 48 hours” filters
• Web UI: temporary disable form on submission to avoid multiple actions caused by double-clicks

Bug fixes

• Email Continuity: fixed mail compose editor when logged in as user with role “basic user”
• License accounting: excludes released messages from accounted deliveries
• Message details: fixed spam confidence when spam reports contains multiple rules with the same name
• Syslog: fixed logging to syslog of some Web-UI failed login attempt

Version 5.5.2 (Jun 12, 2025)

Security

• Notification to sender: notifications are sent only for outgoing messages

Improvements

• Microsoft Azure: added post-deployment storage optimization procedure
• Microsoft 365: added “hybrid” label in test page for users that are hybrid and not fully migrated
• Microsoft 365: fixed import of user with duplicated additional addresses
• ESG AI: fine-tuned engine parallelism when load average is high

Bug fixes

• File type: updated blocked audio and video label descriptions
• Message details: show when failed DMARC results are ignored since a message is sent by trusted sender
• Microsoft Azure: fixed firewall rule for Microsoft management IP
• Outlook add-in: fixed release action when a reason is required
• Search: fixed export of saved search results
• User management: fixed user export for domain admin
• User management: permit to “reset to default” customized user defaults

Version 5.5.1 (May, 26 2025)

Security

• Whaling protection: ignore outgoing email from SPF validated Google Workspace tenants

Improvements

• Microsoft 365/Google Workspace: convert local users as functional, when a Google user is converted to group
• Microsoft 365/Google Workspace: when a local user is converted to functional (e.g, shared mailbox,
  groups), all emails assigned from previous group membership are removed

Bug fixes

• Google Workspace: fixed creation of functional users when group emails aren’t assigned as user aliases
• Google Workspace: fixed an exception when searching by address
• Greylisting: avoid duplicated entries for auto welcomelisted senders
• HTTP: avoid server name canonicalization for redirect when using self-signed certificates
• Outlook addin: fixed report as bad action
• Quarantine digest: null users and null functional users roles are ignored when generating reports

API

• ADD: added /network/dns-forwarder to configure DNS forwarder
• ADD: added /network/static-host-lookup to configure Static Host Lookup
• ADD: added /sender-dependent-relay to configure sender dependent relay

Version 5.5.0 (May 12, 2025)

Security

• WAF: improved application firewall blocks for API access
• URLSand: improved “base URL” disarming
• URLSand: improve scheme parsing for HTTP/HTTPS

Improvements

• Mailer: added “%org-name%” header to all ESG generated emails and reports
• Mail scanner: fine tuned configuration to avoid cpu saturation
• Message details: show multiple SPF, DKIM and DMARC authentication results with extended information
• View mail: show CC header in the header section
• User management: user export will include email address and domain admin permissions
• User role: allow customization of “can view” capability for “clean” result category

Bug fixes

• Message details: show when welcomelist are ignored due to DKIM or DMARC failures
• Message details: don’t store “cid:” links and http local anchors
• Search: apply custom permissions for message results to custom administrator roles
• System preferences: removed empty section “System notification” in cloud appliances
• Rebranding: replaced “Antispam Service” with “Email Security”
• Saved search: disambiguate duplicate names

API

• ADD: added /machine-learning/ai-classifier to configure AI Classification engine
• ADD: property aiClassifier to /message/{id}
• ADD: property hostname to /integration/pop3
• ADD: added /trusted-network to configure trusted networks
• ADD: property headers.spfValid to GET /message/{id}
• ADD: added headers.authenticationResults to GET /message/{id}
• IMPROVED /message/{id}/fetch returns 410/Gone when a message is removed or has been rotated
• IMPROVED: property headers.dkimValid in GET /message/{id} will honor alignment to sender domain
• IMPROVED: properties headers.spfResult/headers.spfIdentity from GET /message/{id}
• FIXED: removed POST/PATCH/PUT action on non-editable /quarantine/release-request-entry
• FIXED: removed /graph since it’s included in /report output
• FIXED: allow /report to domain administrator and user roles
• FIXED: filter sender/recipient in GET /restricted-sender
• FIXED: filter sender/recipient in GET /attachment-filter/file-name-rule,
  GET /attachment-filter/file-type-rule, GET /attachment-filter/password-protected-archive-rule
  and GET /attachment-filter/scan-archive-rule
• FIXED: avoid duplicate entries with the same domain unique property for /relay
• DEPRECATED: properties headers.spfResult/headers.spfIdentity from GET /message/{id}

Breaking changes

There are no breaking changes in this release.

Version 5.4

All upgrades from previous versions are included. See the full release notes of Libraesva ESG version 5.4.