Secure Endpoint Agent 11.2 release notes

If automatic agent updates are disabled, you can assign an agent version to your account's Windows and Mac devices to prevent agent upgrades.

To determine if you want to assign agent version 11.2, review this topic to learn about the improvements included in this version of the Secure Endpoint Agent.

To learn about all features, enhancements, and fixes introduced in Secure Endpoint 11.2, see the Secure Endpoint 11.2 release notes.

About the Secure Endpoint Agent

The Secure Endpoint Agent is a small software client that resides on devices that are managed in the Secure Endpoint Console. After the agent is initially installed on a new device, it's activated with the first connection to the Absolute Monitoring Center.

Each agent package includes software specific to its supported operating system, including the agent and its associated agent components, an installer, and a readme file.

Secure Endpoint Agent 11.2.0.1 supports devices running the following operating systems:

Operating system Supported versions
Windows

  • Windows 11:

    • Windows 11 Home
    • Windows 11 Pro
    • Windows 11 Enterprise
    • Windows 11 IoT Enterprise editions
    • Windows 11 SE

      Note that due to restrictions imposed by Microsoft, the following features aren't supported on Windows 11 SE:

      • Application Resilience: applications that require PowerShell for health checks, unless otherwise noted
      • Custom Data: data points that use PowerShell scripts
      • Reach Scripts: all PowerShell scripts

    Windows 11 ARM-based devices are supported.

    Microsoft ended its standard support for Windows 10 on October 14, 2025. We recommend upgrading to Windows 11 for ongoing security updates and full feature support.

  • Windows Server:

    • Windows Server 2025 Datacenter Edition

    • Windows Server 2022 Datacenter Edition

    Note that the following features aren't supported on Windows Server:

    • The detection of installed anti-malware applications

    • Firmware Wipe

    • Geolocation tracking

    • Playbooks (Absolute Rehydrate)

Ensure that all required Windows updates are installed.
Mac
  • macOS 27 (requires agent version 11.1.0.2 or higher)
  • macOS 26
  • macOS 15 (requires agent version 9.1.0.1 or higher)
  • macOS 14 (requires agent version 7.23.0.2 or higher)

Intel Core and M-series ARM-based devices are supported.

Linux
  • Ubuntu Desktop:
    • 26.04 LTS (x64, arm64)
    • 24.04 LTS (x64)
    • 22.04 LTS (x64)
  • Ubuntu Server LTS 24.04 (x64, arm64)
  • Red Hat Enterprise Linux for Workstations
    • 9.7 (x64, ARM64)
    • 10.1 (x64, ARM64)
ChromeOS

  • ChromeOS version 96 or higher

    You can install the Absolute for Chromebooks extension on devices running ChromeOS version 88 or higher, but for full functionality, we recommend using a minimum version of ChromeOS version 96. For example, web usage isn't available for devices running a version of ChromeOS lower than version 96.

    The ChromeOS operating system is supported when it is running on a Chromebook, Chromebox, or Chromebase device that is managed in the Google Admin console. For more information about support for Chromebooks, see Working with Chromebooks.

The following agent components are associated with Secure Endpoint Agent 11.2.0.1:

Agent or component Windows version Mac version Linux version (all distributions)

Core agent The core agent (also known as rpcnet) is a small software client that resides in devices that are managed in the Secure Endpoint Console. After the core agent is initially installed on a new device, it is activated with its first connection to the Absolute Monitoring Center and the device is enrolled in Absolute. The core agent then makes scheduled connections every 24.5 hours. (rpcnet)

 8.6006.0.1245 7004 8004.0.4874

Component manager The component manager (also known as CTES) is installed on top of the core agent and manages the agent components responsible for initiating device actions and collecting device data. Most agent components are controlled by policies, such as the Hardware and Installed Applications policies. The component manager typically connects to the Absolute Monitoring Center every 15 minutes, at a minumum, to send device data and receive instructions.

(CTES)

 1.0.0.4411 1.0.0.4427 1.0.0.4425

Core Service

(CTESPersistence)

 2.0.1.17 1.0.3.14 N/A

Anti-Malware

(AVP)

 1.0.13.19 1.0.11.45 N/A

Application Resilience

(RAR)

 7.16.1.23 N/A N/A

Custom Data

(CDC)

 1.0.14.37 N/A 1.0.14.27

Data Discovery

(DARAgent)

 11.2.0.17 11.2.0.15 N/A

Device Usage

(DUR)

 1.0.10.16 1.0.8.27 N/A

End User Messaging

(EUM)

 1.0.6.4 1.0.4.9 N/A

File Delete

(SDD)

 1.0.10.8 1.0.10.10 N/A
Freeze
(DFZ)		 1.0.12.5

1.0.6.5

 1.0.0.59

Full-Disk Encryption
(ESP)

 1.0.12.4 1.0.10.26 N/A

Geolocation

(GEO)

 1.0.16.9 1.1.2.57 N/A

Hardware

(HDP/HNG)

2.0.17.27

 1.0.13.45 1.1.1.17

Installed Applications

(SNG)

 1.0.16.106 1.0.12.30 N/A

Manage Supervisor Credentials and
Playbooks
(PER)

1.0.11.37

 N/A N/A

Reach Script

(ANS)

 1.0.6.4 1.0.7.5 N/A

Wake Schedule

(WKS)

 1.0.0.67 1.0.0.31 N/A

Web Usage

(WMA)

 11.2.0.2 N/A N/A

Wipe

(SDW)

 1.0.8.19 1.0.4.5 N/A

You can view the version number of a device's core agent and component manager on its Details > Summary page.

Absolute for Chromebooks Extension: 2.6.7.0

You can view the version number of a device's Chromebook extension by adding the Core agent version column to a device report.

Agent improvements and fixes

  • Version 11.2.0.1
  • Version 11.2

Version 11.2.0.1 of the Secure Endpoint Agent includes improvements and fixes to the following agent components:

Component Component version Fixes and improvements
Windows

Custom Data Collector

(CDC)

 1.0.14.37

  • Added stability improvements to fix an issue where the CDC component failed to be installed or updated on some devices.

Device Usage

(DUR)

 1.0.10.16

  • Fixed an issue where exported device usage events were reported with incorrect timestamps if a device's time zone changed.

  • Fixed an issue where device usage events may have been missing from the Secure Endpoint Console after a device was woken from hibernation.
End User Messaging
(EUM)		 1.0.6.4

  • The EUM component and its bundled SQLite engine have been updated to address multiple memory-corruption vulnerabilities. This update upgrades the bundled SQLite version from 3.47.1 to 3.53.1, mitigating risks associated with integer truncation and overflow during SQL query processing. This update addresses several critical and high-severity vulnerabilities in the bundled SQLite engine, including CVE-2025-6965, CVE-2025-29087, and CVE-2025-3277.

  • To enhance the security and stability of the EUM component, it has been updated to include the latest versions of OpenSSL, Poco, and other core libraries.
Freeze
(DFZ)		 1.0.12.5

  • The DFZ component and its bundled SQLite engine have been updated to address multiple memory-corruption vulnerabilities. This update upgrades the bundled SQLite version from 3.47.1 to 3.53.1, mitigating risks associated with integer truncation and overflow during SQL query processing. This update addresses several critical and high-severity vulnerabilities in the bundled SQLite engine, including CVE-2025-6965, CVE-2025-29087, and CVE-2025-3277.

  • To enhance the security and stability of the DFZ component, it has been updated to include the latest versions of OpenSSL, Poco, and other core libraries.

Geolocation

(GEO)

 1.0.16.9

  • The GEO component and its bundled SQLite engine have been updated to address multiple memory-corruption vulnerabilities. This update upgrades the bundled SQLite version from 3.47.1 to 3.53.1, mitigating risks associated with integer truncation and overflow during SQL query processing. This update addresses several critical and high-severity vulnerabilities in the bundled SQLite engine, including CVE-2025-6965, CVE-2025-29087, and CVE-2025-3277.

  • To enhance the security and stability of the GEO component, it has been updated to include the latest versions of OpenSSL, Poco, and other core libraries.

  • Reliability improvement.

Manage Supervisor Credentials and Playbooks
(PER)

 1.0.11.37

  • Previously, the PER component required a reboot to maintain secure communication and preserve existing configurations after a device was reimaged or the operating system was reinstalled. This issue is now fixed. A reboot is no longer required.

  • Fixed an issue where a device-initiated playbook could fail to execute if a new version of the Absolute Recovery Environment was pending download. The PER component now validates that the download is complete before running a playbook.

  • Previously, if a device entered hibernation while it was being provisioned, it may have booted back into the Absolute Recovery Environment after provisioning was complete instead of resuming the active Windows session. This issue is now fixed.

  • To help troubleshoot device provisioning issues, the PER component now reports the following errors, which are shown in the Playbook > Status details report column:

    • Persistence not fully activated. Try rebooting the device.

    • Invalid server ID configured in AbtStatus. Contact Technical Support.

    • Persistence not installed. AbtStatus is missing.

Wake Schedule

(WKS) (New!)

 1.0.0.67

  • The new WKS component applies the wake schedule you set in the Secure Endpoint Console, wakes sleeping or hibernating devices at the scheduled time, and reports each device's wake status back to the console.
Mac

Component manager

(CTES)

 1.0.0.4427

  • For devices running macOS 26, fixed an issue where the Secure Endpoint Agent for Mac failed to install a required component during the device enrollment process.

Installed Applications

(SNG)

 1.0.12.30

  • The SNG component now collects and reports more granular application run signals, including recent execution status, process start counts, and start times for each executable. These enhancements provide the Secure Endpoint Agent with a more precise understanding of application activity within a specific measurement window, improving the accuracy of compliance monitoring.

Wake Schedule

(WKS) (New!)

 1.0.0.31

  • The new WKS component applies the wake schedule you set in the Secure Endpoint Console, wakes sleeping or hibernating devices at the scheduled time, and reports each device's wake status back to the console.

Linux (all distributions) (New!)

Component manager

(CTES)

 1.0.0.4425

The CTES component (also known as component manager) acts as an orchestrator for other agent components that initiate device actions and collect device data. The component manager uses a secure connection to connect to the Absolute Monitoring Center every 15 minutes, at a minimum, to send device data and receive instructions.

Hardware
(HNG)

 1.1.1.17 The HNG component is responsible for collecting hardware data from Linux devices. The collected data is available for review on the Hardware page in Device Details or by adding the applicable report column to a report. Hardware data points collected

Custom Data

(CDC)

 1.0.14.27 The CDC component serves as a host for the HNG component.

Freeze
(DFZ)

 1.0.0.59 The DFZ component is responsible for freezing Linux devices when a Freeze request is processed or an Offline Freeze rule is triggered. The device can be unfrozen by submitting a Remove Freeze request, or by entering the applicable unfreeze code on each device.

Version 11.2 of the Secure Endpoint Agent includes improvements and fixes to the following agent components:

Component Component version Fixes and improvements
Windows

Application Resilience

(RAR)

 7.16.1.23

  • Fixed an issue where signature errors were incorrectly reported for the RAR component on devices where intermediate certificates were missing from the local certificate store.

  • Previously, if a device was frozen, the RAR component incorrectly reported a non-compliant status and attempted to repair Microsoft SCCM. This issue is now fixed. The component now detects the frozen state and skips the health check of the Server (lanmanserver) service.

Component manager

(CTES)

 1.0.0.4411
  • Security improvement.
Data Discovery
(DARAgent)		 11.2.0.17

  • The Windows DARAgent component and its bundled third-party libraries have been updated with multiple security fixes and cryptographic hardening improvements. These updates implement process sandboxing for third-party document parsers to mitigate potential remote code execution (RCE) risks, upgrade match token encryption from AES-128 to AES-256-GCM to meet post-quantum security standards, and enforce restricted access control lists (ACLs) on agent registry keys. This release patches several vulnerabilities in the bundled OpenSSL library and resolves critical logic regressions and memory-safety issues in the agent's communication components.

    These updates also address several critical and high-severity vulnerabilities in bundled third-party library dependencies, including CVE-2026-34182, CVE-2026-45447, CVE-2026-11822, CVE-2026-11824, CVE-2026-7383, and others.

Installed Applications

(SNG)

 1.0.16.106

  • Fixed an issue where the SNG component did not include an installed application's recent execution status when calculating its hash value. This update ensures that software inventory data more accurately reflects the current state of applications installed on a device.

Manage Supervisor Credentials and Playbooks
(PER)

 1.0.11.32

  • For devices with Secure Boot enabled, the Playbooks provisioning process now supports the newest Windows Secure Boot certificate. The following certificates are supported:

    • Microsoft UEFI CA 2023

    • Microsoft UEFI CA 2011 (expired in June 2026)

  • When Secure Boot is enabled on a device, the PER component now verifies that the Microsoft 2023 UEFI certificate is fully installed and ready for use before booting the device.

  • Stability improvement.

Web Usage

(WMA)

 11.2.0.2

  • The WMA component and its bundled third-party libraries have been updated with multiple security fixes and cryptographic hardening improvements. These updates upgrade OpenSSL to version 3.6.2 across the CtDlpPrv and winwebusage components to address memory-safety and logic defects. Origin header validation has also been implemented for the WMAService component to protect against DNS rebinding and Cross-Site Request Forgery (CSRF) attacks, preventing malicious webpages from injecting fraudulent telemetry.

    These updates also address several medium-severity vulnerabilities in the Web Usage Monitoring service and bundled OpenSSL library, including CVE-2026-31790, CVE-2026-2673, CVE-2026-28386, CVE-2026-28387, and others.
Mac

Component manager

(CTES)

 1.0.0.4411
  • Security improvement.
Data Discovery
(DARAgent)		 11.2.0.15

  • The Mac DARAgent component and its bundled third-party libraries have been updated with key security and cryptographic hardening improvements. These updates expand symmetric encryption key sizes to 256-bit AES-GCM for long-term cryptographic protection, enforce restricted file permissions on local SQLite configuration databases, and establish process isolation safeguards for binary document parsers. Build pipelines have also been migrated to the macOS 26 Tart virtual machine image, and extensive third-party dependency updates across OpenSSL, Expat, and SQLite3 address critical memory-safety and denial-of-service vulnerabilities.

    These updates also address several critical, high, and medium-severity vulnerabilities in bundled third-party library dependencies, including CVE-2026-34182, CVE-2026-45447, CVE-2026-11822, CVE-2026-11824, CVE-2026-7383, and others.

Hardware

(HDP)

 1.0.13.45

  • Previously, when the HDP component was upgraded, a Microsoft Defender alert may have been triggered due to the creation of temporary hidden files in the /tmp directory. This issue has been fixed. A secure internal directory is now used to store temporary backup files.