Repository URLs for Code Repository Integration Projects now stay aligned in both the Project and Project Settings API responses when a project is created or changed through the UI or API. Teams that consume project metadata no longer need a separate synchronization step.
Risk orchestration and pipeline handling
- Bulk triage in Risk Orchestration: Analysts can select multiple risks with table checkboxes and update severity, state, and change logs through one Triage action, including a mixed-scanner selection. SCA selections can also update VEX parameters. Each risk is processed independently, preserving successful updates and allowing failed ones to be reviewed and retried.
- API Security in Risk Orchestration: Teams can view API Security findings in the unified table with SAST, SCA, and IaC results. They can filter or group by the API Security engine; the asset identifies the affected endpoint and the source identifies code or documentation.
- Internet-Facing badge: Users can identify publicly accessible projects directly in the unified project table when Cloud Insights is configured for the account.
- Scheduled scans: All Code Repository Integration Projects can now use scheduled scans, regardless of how they entered Checkmarx One.
- CLI break-build exemptions: CLI-evaluated scans now exclude findings covered by Break-build Exemption Rules across SCM platforms and flows, including custom triage states rather than only Not Exploitable.
- Project deletion audit event: The Audit Trail API now records
projects.deleteevents.
AI-assisted remediation and supply-chain work
- Automated AI Remediation: Customers with AI Triage & Remediation can configure projects, branches, SAST or SCA scanners, and severity thresholds in Account Settings > AI Assist. Matching risks receive AI fix suggestions after scanning, or after AI Auto Triage when enabled. Supported GitHub Code Repository Integration projects can receive an automatically opened remediation pull request. Project-level overrides can be permitted or blocked.
- MCP Server scanner coverage: AI coding assistants and MCP-connected chat clients can query API Security risks, including exposed, undocumented, shadow, and zombie APIs. IaC Security and Secrets gain triage-tool support; API Security is not supported by triage tools.
- PR comment conversations: Azure DevOps and Bitbucket Cloud developers can ask AI questions in pull request comments and receive responses as further comments.
- AI Supply Chain asset triage: From Global Inventory or scan results, users can Mute, Snooze, or Monitor an entire AI asset. The choice applies to current and future findings for that asset and takes precedence over individual finding states.
- External MCP Server detection: AI Supply Chain scans identify externally referenced MCP servers from client configuration, dependency manifests, or remote endpoints, then list them as MCP Server assets in scan results and Global Inventory.
Scanning, configuration, and data quality
- SCA dependency paths: SCA Scan Results and CycloneDX SBOM exports now show the complete route from a transitive dependency through a Private Package.
- Preset names: Preset Manager accepts names up to 49 characters in the UI and API for create, clone, and update operations. Longer names are rejected instead of truncated or renamed.
- Accessibility: Presets and side navigation now reflow for screen size and zoom changes without losing information or functions.
- IaC version: This release includes IaC version 2.1.21.
- Imports CSV export: Bring Your Own Results can process large imports-table CSV exports in the background and make the completed file available from that table.
DAST changes
DAST scans no longer send Mozilla browser-update requests during Firefox or Chrome-based scanning; this change reached general availability on September 27, 2026.
Users can attach multiple PNG, SVG, JPG, WebP, TIFF, or EPS screenshots to a scan result through the API. This requires Update scan permission and access to the relevant environment; uploaded screenshots can be deleted or replaced.
Failed, Partial, and Complete DAST scans now have reports, including scans with no risks and past scans. Reports include Scan Summary, Executive Summary, and Scan Diagnostics. Onboarding also adds TOTP, app-load wait time, verification fields, custom headers, slow-running-application and included-path options, plus links to authentication reports when authentication fails. Sensitive DAST header values are obscured in the UI and exported reports.
CLI, plugins, and fixes
CLI version 2.3.66 supports passing use-gitignore through --optional-flags and adds --exclude-git-folder to cx scan create. Local-directory scans create contributors.csv and metadata.json in .checkmarx, then remove them after successful scan creation. September releases include Eclipse 2.1.18 and VS Code 2.73.0, both using CLI 2.3.66, with general improvements and bug fixes.
The resolved-issues set covers scan reliability, Azure DevOps tokens and PR decoration, API latency, SCA auto-scan behavior, DAST authentication and OpenAPI processing, AI Triage and Remediation behavior, API Inventory, and a command-injection issue in MCP Trigger Scan.
What this means for your team
AppSec engineers can massively improved productivity with the ability to clear related risks together, retain DAST evidence when scans fail or find nothing, and use API endpoint context alongside code and dependency findings. Developers running CLI scans get the same exemption behavior across their pipeline paths, while eligible GitHub teams can route qualifying AI fix suggestions into pull requests. In an AI-driven SDLC, MCP-aware assistants can query named scanner data without leaving the coding environment which is also a massive benefit. CISOs and audit managers gain a project-deletion audit event and scan reports that document unsuccessful or no-risk DAST outcomes.
Based on the official Checkmarx release notes.
How Merito helps
Merito can help teams configure, govern, and operationalize these Checkmarx One capabilities through managed services, including workflow and evidence practices shared across security, development, and QA.
Merito is an authorized Checkmarx reseller and services partner. Our Checkmarx One team helps you adopt the 3.68 changes, with implementation services to configure them for your environment and training and enablement to bring your teams up to speed.