Native SCA reachability analysis now runs as part of an SCA scan for supported direct dependencies, removing the former requirement for a separate SAST scan to determine Package Usage and Exploitable Path results.
SAST, dashboards, and scan traceability
The SAST engine moves to version 9.7.7 and will be introduced gradually over the following weeks.
Dashboard users can save and share a link that retains selected filters, so recipients open the same filtered view. Checkmarx One also adds token-based authentication for Bitbucket Cloud through the custom repository-integration setup flow; this is available to single-tenant customers.
Scans initiated by push or pull-request events can now carry the associated Git commit ID. Enable this through SCM setup, project settings, or project migration. New SCA vulnerability results also show the affected package name and version alongside the CVE wherever CVE-based vulnerabilities are listed, ranked, or broken down.
AI triage, reporting, Analytics, and MCP
For customers with AI Triage & Remediation enabled, Risk Orchestration now supports AI triage and remediation for SCA findings. The capability applies only to SCA risks in that workflow.
The AI Triage Changelog for enabled customers now records who triggered Triage Assist and links each AI-driven SAST or SCA state change to its insight. This includes manual and auto-triage activity; auto-triage identifies the user who configured the rule, while bulk actions retain an individual insight link per finding. SAST AI Triage and AI Remediation agents were also updated for accuracy and performance automatically, with no end-user action required.
Scan Reports gain Results Distribution by Status and Results Distribution by State tables in Scan Results Overview. Both tables are included in PDF and JSON exports. Analytics now ingests API Security findings and reflects their severity and state changes in KPIs, charts, and summary counters.
MCP Server users can change risk state and severity through the server across major scan engines, including actions such as setting a risk to Not Exploitable or Confirmed.
SCA inventory and dependency analysis
The public Global Inventory API retrieves account-level packages, risks, or licenses using a platform API token. Each request returns one inventory type, supports filters including project, application, severity, and exploitability, and uses pagination for complete datasets.
Global Inventory replaces page-number navigation with Next and Previous controls on Packages, Risks, and Licenses. The change also removes the prior export-result limit.
Native reachability covers Python, Java, JavaScript, and C#. Its scope is direct dependencies called by the application and vulnerabilities whose vulnerable method is contained in that package. No additional configuration is required. The new Reachability column reports Exp.Path Found, Not Detected, Not Supported, Pending Analysis, or Calculation Failed.
SCA also supports UV for Python dependency resolution in cloud scans and the SCA Resolver. Set UV Resolution at tenant or project level; pip remains the default. Vulnerability, license, and SBOM outputs remain consistent with other supported Python package managers.
DAST controls
DAST scans can now include manually identified vulnerabilities uploaded through the CLI or a JSON file. Manual and ZAP findings appear together in the UI and reports, can be filtered separately, and manual results can be deleted through the UI or overridden using the CLI.
Admins can hide raw API keys in copied scan-trigger commands, replacing them with CLIENT_ID/CLIENT_SECRET placeholders for OAuth authentication. The setting applies wherever Checkmarx One generates a command.
DAST AI features now require the Dast-to-code-initiator and Dast-AI-attack-initiator permissions added to the dast-admin role. Users without permission can still view existing correlation and AI attack results, but the menu options are disabled.
Delivery components and fixes
The release includes IaC version 2.1.21. CLI 2.3.63 prepares support for the upcoming Developer Assist plugin for Cursor CLI. CLI 2.3.60 adds OSS-Realtime support for RubyGems, Composer, Yarn, and Bower, and improves downloaded scanner-component auto-update security.
CLI 2.3.59 applies default supported-file filters to all scanner archives; --skip-default-filter includes all source-location files instead. It also adds *.tfvars and *.tfbacken to supported files. August releases include GitHub Actions 2.3.42 and Jenkins 2.0.13-853.v1fa_8405d5991, with general improvements and fixes.
JetBrains 2.3.8, Visual Studio 4.4.17, and VS Code 2.72.0 add OSS-Realtime package-manager support. JetBrains and Visual Studio cover Gradle, SBT, Yarn, Bower, pip, Setuptools, Poetry, Composer, and RubyGems; VS Code covers Yarn, Bower, Composer, and RubyGems.
Resolved issues address DAST authentication and CLI failures, Global Inventory behavior and performance, Analytics and dashboard filtering, SAST result loading, scan execution, SBOM generation, API behavior, and other platform defects.
Based on the official Checkmarx release notes.
How Merito helps
Merito can help teams govern configuration and operational adoption of these capabilities through Managed Services, including SCA inventory, reporting, and DevSecOps workflow controls.
Merito is an authorized Checkmarx reseller and services partner. Our Checkmarx One team helps you adopt the 3.66 changes, with implementation services to configure them for your environment and training and enablement to bring your teams up to speed.