> ## Documentation Index
> Fetch the complete documentation index at: https://docs.levelblue.com/llms.txt
> Use this file to discover all available pages before exploring further.
# DbProtect 6.7.2 Release Notes
> New features, upgrade requirements, supported platforms, resolved issues, and known issues for LevelBlue DbProtect v6.7.2 (October 2026).
**October 2026**
The following is a brief description of the New Features and Improvements included in the DbProtect v6.7.2 release. Please refer to the *DbProtect v6.7.2 Install and Upgrade Guide* for detailed instructions.
## New Features
This release provides new features and improvements to DbProtect.
* DbProtect 6.7.1 replaced the reporting engine and fixed various reporting issues
* Improved performance and reliability
* Data accuracy fixes
* Adjustments to some reports, based on customer feedback
* The bundled Scan Engine component is upgraded to v3.25 and includes the following updates:
* Adds support for target x509 certificate validation
* Included Nmap library has been upgraded to the latest available version at time of release
* Scan Engine now supports connecting to target databases using TLS 1.3. This is supported for the latest versions of MariaDB, MongoDB, MSSQL, MySQL, and PostgreSQL. TLS 1.2 remains supported for backwards compatibility purposes. Note that TLS 1.3 support requires using the latest Windows operating systems (Windows 11 or Windows Server 2022 and greater).
* Various OWASP Top 10 security improvements
* Improvements to SSO when using Certificates/Smart Cards
* DbProtect v6.7.1 ships with a significantly updated Scan Engine Architecture. Refer to [Scan Engine Host](#scan-engine-host) and [Scan Engine Manager](#scan-engine-manager) for critical information. We highly recommend upgrading your Scan Engines to take full advantage of these changes.
* As of DbProtect v6.7.0, the Core and Explorer components have now been unified into a single installation package. See [Direct upgrade support](#direct-upgrade-support) below for further details.
## Configuration Customizations
Any changes to service configuration files, like default logging levels, memory allocation settings, etc., are overwritten with default values during a system upgrade. If you edit any configuration files as part of your use, you will need to re-edit the corresponding configuration files following any DbProtect upgrade. Do not attempt to re-use a configuration file from an earlier version of the product as new features and fixes may have required additions to these files.
## Direct Upgrade Support
See [Known issues](#known-issues) for additional installation/upgrade considerations. The policy and features for the Gateway mode offering differ from the policy and features for the Integrated (M365 sending) mode. Integrated mode customers should refer to the document for that mode.
DbProtect v6.7.1 supports direct upgrades **only** from DbProtect v6.6.13, v6.6.15, or v6.7.0.
This release has updates that now require the deployment of the DbProtect components on the Windows host to have the services running with fully qualified domain or local accounts. Insecure configurations where the services run as localsystem or other unqualified accounts are not supported. This is applicable for fresh installations as well as upgrades from DbProtect v6.6.13, v6.6.15, or v6.7.0. If you are running in an insecure configuration or are not sure about your environment, please contact support for guidance.
Existing versions of DbProtect Explorer must always be uninstalled before any new version of DbProtect Explorer can be installed.
Follow this sequence of steps to upgrade the DbProtect suite:
Uninstall Explorer using the Windows **Programs and Features** control panel. Right-click on the DbProtect Explorer component and select **Uninstall**. The uninstall process may prompt you to allow it to automatically close several applications. Permit this and then complete the uninstallation procedure.
Unregister all Linux Scan Engines prior to upgrading core.
Upgrade Windows Scan Engines and re-install Linux Scan Engines (see the [Scan Engine Host](#scan-engine-host) section below as well as the *Linux Scan Engine Guide*).
Update all Scan Engines with the latest SHATTER KB from the core console UI.
Complete the core upgrade process using the DbProtect v6.7.1 installer. The Explorer installer wizard will appear once the core portion of the upgrade is complete.
Proceed through the Explorer installation steps as usual. When the installation is complete, use the Windows Services manager to verify that all DbProtect services are running.
When installing DbProtect Explorer, ensure that the Service Logon Credentials provided are for a user that has the required permissions to access the database. The **Test Credentials** button will only verify the correctness of the password, not the ability to access the database. The installer may default to **Run service as Local System**, which is typically not automatically granted database access.
## Supported Operating Systems
DbProtect v6.7.1 can be installed on the following operating systems:
* Microsoft Windows Server 2016
* Microsoft Windows Server 2019
* Microsoft Windows Server 2022
## Supported Backend Databases
DbProtect v6.7.1 can use the following databases as its backend repository:
* Microsoft SQL Server 2016
* Microsoft SQL Server 2017 (Windows only)
* Microsoft SQL Server 2019 (Windows only)
* Microsoft SQL Server 2022 (Windows only)
The use of Extended Protection or Microsoft SQL Server Express is not supported.
## Scan Engine Host
The DbProtect v6.7.1 release includes an updated Scan Engine Host v3.25 component. Installers for both Windows and Linux are available. Refer to the *DbProtect v6.7.1 Installation and Upgrade Guide* as well as the *DbProtect v6.7.1 Linux Scan Engine Guide* for specific details on deploying the new v3.25 Scan Engine Host.
* As of Scan Engine Host v3.24, open inbound ports to the scan engine host are no longer required.
* This change enables a Scan Engine Host to be installed in a network isolated from the console as long as the hostname is resolvable. Hostname resolution is required in both directions for certificate-based authorization to be successful.
* Some database platforms may now require updated 64-bit Client Drivers for scans to function properly.
* Scan Engine Host v3.25 is **only** supported with DbProtect v6.7.x. It is not intended to be used with DbProtect v6.6.15 or earlier.
* Windows Scan Engine Host version v3.23 is **not** supported with DbProtect v6.7.1. Any v3.23 installations must be upgraded to v3.25 before using DbProtect v6.7.1.
* For scan engine backwards compatibility purposes, Windows Scan Engine Host v3.22 and v3.24 remain supported with DbProtect v6.7.1, but it is strongly recommended that you upgrade all existing scan engines to v3.25.
* Windows Scan Engine Hosts v3.21 and earlier are not supported with DbProtect v6.7.1.
* Linux: Use only Linux Scan Engine Host v3.25 with DbProtect v6.7.1. Linux Scan Engine Host versions 3.24 or earlier are **not** supported with DbProtect v6.7.1.
* New installations of Scan Engine Host v3.25 will install the newer version of Nmap (v7.99) for Discovery-related functionality. Existing Nmap installations can update to a newer version of Nmap outside of the DbProtect application suite.
## Scan Engine Manager
DbProtect v6.7.1 includes a component called Scan Engine Manager v3.25. It replaces the previously used Scan Engine Proxy until DbProtect v6.6.13. This new component has major benefits both in routing and performance. Below are some critical requirements for a successful deployment:
* Scan Engine Manager, or the console host, now requires an inbound port from each Scan Engine Host (default is `28080`).
* Hostname resolution is required in both directions for registration to be successful.
* If installed, and upgrading from DbProtect 6.6.x, unregister all Linux Scan Engines before upgrading the console to DbProtect v6.7.1.
## Future SHATTER Knowledgebase Updates
Subsequent SHATTER Knowledgebase versions are installed at the DbProtect application server and then pushed out to each scanner. This installation includes the most current version of the SHATTER Knowledgebase, and does not require additional updates at the time of publication of this document.
## Runtime Service Users
All runtime service users provided at the time of installation must be the same when provided to each component installer of the suite installation. In the case of an upgrade, the runtime service user must be the same as that which was used during the prior installation. This does not apply to scanners and sensors.
## Resolved Issues
The following issues were investigated and resolved in this release of DbProtect v6.7.1:
* Various included third-party libraries and frameworks have been updated to newer versions. Contact [LevelBlue Support](https://www.levelblue.com/company/support) if you have any questions.
* Resolved an issue that caused some asset credentials with special characters (e.g., `<` or `>`) to not be able to be imported.
* Resolved an issue with some Findings and Check Results PDF reports including `For Policy: = null` in the header information when scoped by asset, job, or org.
* Resolved an issue causing HTML-based Check Results Details reports to sometimes have truncated results.
* Resolved an issue causing Check IDs in Findings Details reports to sometimes differ from Check IDs in Check Results Details reports.
* Resolved an issue causing the number of Facts in Check Results Summary reports to be incorrect.
* Resolved an issue causing Per Asset Policy Lens Report jobs to sometimes produce null values for Job Name and Instance Name fields.
## Known Issues
This section contains information about the known issues in DbProtect.
### General
* Integrated Windows Authentication is an insecure method of connectivity to targets and therefore is no longer supported.
* Scan Engine Manager defaults to `C:\Program Files`. It is recommended to change the installation path to your current DbProtect root directory (ie., `d:\trustwave\dbprotect\scan engine manager`). Installing it outside this path may result in file system permission issues.
* Scan Engine Host defaults to `C:\Program Files` (since it is now 64-bit) for a new installation on Windows. If you had a prior 32-bit version installed, an upgrade will place this in the prior location. If this location was `c:\Program Files (x86)`, that is where it will upgrade even though it is no longer 32-bit.
* If the console host has two enabled network interfaces, Scan Engines may attempt to communicate on the wrong inbound interface. Contact Support if you have more than one network interface on your console for further instructions.
* When your explorer session times out you are not redirected to the login page. Cancel the pop-up auth if you get one and navigate back to the main Explorer page to login again.
* When IPv6 is enabled on a host and set as preferred there may be issues with connectivity between the Scan Engine Host and the Scan Engine Manager. If you experience this contact Support for further assistance.
* Previously created SAP Hana assets will remain unscannable after upgrading. If you wish to use these prior assets contact Support for instructions.
* Credential Tests from the Asset screen do not function for CyberArk Vault credentials. Use a Credential Test Job instead to validate these prior to Audits.
* In certain cases, the DbProtect uninstallation process may fail. Please contact support if you need assistance with this.
* If executed with incorrect credentials, the audit status icon for credential test results may display as a question mark rather than a red cross mark.
* When installing or launching DbProtect on a newer operating system such as Microsoft Windows Server 2022, you may receive a Microsoft Defender popup indicating that `DbProtect.exe` was blocked from running due to having an Unknown publisher. You can choose **Run anyway** to proceed.
* When trying to sort by Alert ID on the Monitoring Alerts tab, you may sometimes receive an error stating "the page you requested doesn't exist". For sorting and Searching capabilities, go to Explorer Management Alerts instead.
* Explorer policy lens filter for DISA-STIG and CIS policies may not display results properly. Instead, switch to the "None" filter.
* Deleting credentials from a Shared Credential Group may results in DbProtect generating an Error. Editing and Saving credentials are unaffected.
* In some cases, Oracle pen test checks may fail depending on the Oracle CPU patch set applied.
* SMB Current Content Authentication is not supported.
* After upgrading to DbProtect v6.7.0 you may be unable to register a Sensor. Contact LevelBlue Support for help with this issue.
### Reports
* In some cases, the Executive Summary Report may not be generated or displayed correctly when attempting to open from within Explorer.
* In exported License Utilization reports, all active asset numbers may be missing (blank). These numbers can be determined by viewing on the Dashboard.
## About LevelBlue
LevelBlue reduces risk and builds lasting resilience so organizations can innovate and advance their mission with confidence. As the world's most analyst-recognized and largest pure-play managed security services provider, LevelBlue elevates client outcomes that matter: stronger defense, faster response, and sustained business continuity. LevelBlue combines AI-powered security operations, advanced threat intelligence, and elite human expertise to provide the most comprehensive portfolio of strategic advisory, managed security, offensive security, and incident response services.