OpenText published the release notes for OpenText Fortify SAST 26.3 in July 2026. It is the first release under the product's new name. OpenText Static Application Security Testing (OpenText SAST), originally Fortify Static Code Analyzer, is now OpenText Fortify SAST. Source: OpenText Fortify SAST 26.3 documentation.
New in Fortify SAST 26.3
- AI-powered SAST providers. AI-powered SAST now works with Claude models through Microsoft Azure, and Google Cloud is a supported provider.
- Platform support. macOS 26.3 and 26.4.
- Languages and build tools. Go 1.26, Gradle 9.x and xcodebuild 26.6.
- Fixed. Teams can again configure which test, example and documentation files and directories AI-powered SAST excludes from a scan.
Product name changes
The 26.3 release notes list the renames OpenText is rolling out across the Fortify portfolio.
Previous name | New name |
|---|---|
OpenText Static Application Security Testing (OpenText SAST) | OpenText Fortify SAST |
Fortify Software Security Center | OpenText Application Security |
Fortify WebInspect | OpenText Dynamic Application Security Testing (OpenText DAST) |
OpenText Core Application Security | OpenText Fortify on Demand |
OpenText Core Software Composition Analysis | OpenText Fortify Software Composition Analysis |
OpenText Application Security Aviator | OpenText Fortify Remediation Aviator |
Fortify Applications and Tools | OpenText Application Security Tools |
Removed and deprecated
- No longer supported: CentOS, Red Hat Enterprise Linux 7.2, Ubuntu 20.04.1 LTS and Microsoft Windows Server 2019.
- The
com.fortify.sca.FilterSetproperty is removed. - A Windows binary for enhanced COBOL translation is removed as AI-powered SAST takes over COBOL analysis. The legacy COBOL translator remains available as a fallback.
- Deprecated: the Intel-based macOS installer and the
fortifyclientCLI. OpenText recommends fcli as the replacement.
Known issues
Analyzing Terraform, Solidity and Bicep downloads dependencies at scan time unless you provide them, so scan those locally or give the scan machine network access. Xcode projects can miss source files when targets build for different architectures. The workaround is to pass a single -arch option to xcodebuild.
What to check before upgrading
Move scan hosts, build agents and ScanCentral SAST sensors off the unsupported operating systems first. Replace fortifyclient calls in CI/CD pipelines with fcli before the tool is removed. Then baseline findings on a few representative applications before and after the upgrade, and record any change to policies or quality gates.
How Merito helps
Merito is an authorized OpenText reseller and services partner. Merito licenses OpenText Fortify SAST, and its upgrade services plan and validate Fortify upgrades without disrupting release schedules. Request Fortify SAST pricing or upgrade help.
