Secure Endpoint Agent 11.2 release notes

If automatic agent updates are disabled, you can assign an agent version to your account's Windows and Mac devices to prevent agent upgrades.

To determine if you want to assign agent version 11.2, review this topic to learn about the improvements included in this version of the Secure Endpoint Agent.

To learn about all features, enhancements, and fixes introduced in Secure Endpoint 11.2, see the Secure Endpoint 11.2 release notes.

About the Secure Endpoint Agent

The Secure Endpoint Agent is a small software client that resides on devices that are managed in the Secure Endpoint Console. After the agent is initially installed on a new device, it's activated with the first connection to the Absolute Monitoring Center.

Each agent package includes software specific to its supported operating system, including the agent and its associated agent components, an installer, and a readme file.

Secure Endpoint Agent 11.2 supports devices running the following operating systems:

Operating system Supported versions
Windows

  • Windows 11:

    • Windows 11 Home
    • Windows 11 Pro
    • Windows 11 Enterprise
    • Windows 11 IoT Enterprise editions
    • Windows 11 SE

      Note that due to restrictions imposed by Microsoft, the following features aren't supported on Windows 11 SE:

      • Application Resilience: applications that require PowerShell for health checks, unless otherwise noted
      • Custom Data: data points that use PowerShell scripts
      • Reach Scripts: all PowerShell scripts

    Windows 11 ARM-based devices are supported.

    Microsoft ended its standard support for Windows 10 on October 14, 2025. We recommend upgrading to Windows 11 for ongoing security updates and full feature support.

  • Windows Server:

    • Windows Server 2025 Datacenter Edition

    • Windows Server 2022 Datacenter Edition

    Note that the following features aren't supported on Windows Server:

    • The detection of installed anti-malware applications

    • Firmware Wipe

    • Geolocation tracking

    • Playbooks (Absolute Rehydrate)

Ensure that all required Windows updates are installed.
Mac
  • macOS 27 (requires agent version 11.1.0.2 or higher)
  • macOS 26
  • macOS 15 (requires agent version 9.1.0.1 or higher)
  • macOS 14 (requires agent version 7.23.0.2 or higher)

Intel Core and M-series ARM-based devices are supported.
ChromeOS

  • ChromeOS version 96 or higher

    You can install the Absolute for Chromebooks extension on devices running ChromeOS version 88 or higher, but for full functionality, we recommend using a minimum version of ChromeOS version 96. For example, web usage isn't available for devices running a version of ChromeOS lower than version 96.

    The ChromeOS operating system is supported when it is running on a Chromebook, Chromebox, or Chromebase device that is managed in the Google Admin console. For more information about support for Chromebooks, see Working with Chromebooks.

The following agent components are associated with Secure Endpoint Agent 11.2:

Agent or component Windows version Mac version

Core agent The core agent (also known as rpcnet) is a small software client that resides in devices that are managed in the Secure Endpoint Console. After the core agent is initially installed on a new device, it is activated with its first connection to the Absolute Monitoring Center and the device is enrolled in Absolute. The core agent then makes scheduled connections every 24.5 hours. (rpcnet)

 8.6006.0.1245 7004

Component manager The component manager (also known as CTES) is installed on top of the core agent and manages the agent components responsible for initiating device actions and collecting device data. Most agent components are controlled by policies, such as the Hardware and Installed Applications policies. The component manager typically connects to the Absolute Monitoring Center every 15 minutes, at a minumum, to send device data and receive instructions.

(CTES)

 1.0.0.4411 1.0.0.4411

Core Service

(CTESPersistence)

 2.0.1.17 1.0.3.14

Anti-Malware

(AVP)

 1.0.13.19 1.0.11.45

Application Resilience

(RAR)

 7.16.1.23 N/A

Custom Data

(CDC)

 1.0.14.32 N/A

Data Discovery

(DARAgent)

 11.2.0.17 11.2.0.15

Device Usage

(DUR)

 1.0.10.14 1.0.8.27

End User Messaging

(EUM)

 1.0.5.20 1.0.4.9

File Delete

(SDD)

 1.0.10.8 1.0.10.10
Freeze
(DFZ)		 1.0.10.12

1.0.6.5

Full-Disk Encryption
(ESP)

 1.0.12.4 1.0.10.26

Geolocation

(GEO)

 1.0.15.34 1.1.2.57

Hardware

(HDP)

2.0.17.27

 1.0.13.45

Installed Applications

(SNG)

 1.0.16.106 1.0.12.27

Manage Supervisor Credentials and
Playbooks
(PER)

1.0.11.32

 N/A

Reach Script

(ANS)

 1.0.6.4 1.0.7.5

Web Usage

(WMA)

 11.2.0.2 N/A

Wipe

(SDW)

 1.0.8.19 1.0.4.5

You can view the version number of a device's core agent and component manager on its Details > Summary page.

Absolute for Chromebooks Extension: 2.6.6.9

You can view the version number of a device's Chromebook extension by adding the Core agent version column to a device report.

Agent improvements and fixes

Version 11.2 of the Secure Endpoint Agent includes improvements and fixes to the following agent components:

Component Component version Fixes and improvements
Windows

Application Resilience

(RAR)

 7.16.1.23

  • Fixed an issue where signature errors were incorrectly reported for the RAR component on devices where intermediate certificates were missing from the local certificate store.

  • Previously, if a device was frozen, the RAR component incorrectly reported a non-compliant status and attempted to repair Microsoft SCCM. This issue is now fixed. The component now detects the frozen state and skips the health check of the Server (lanmanserver) service.

Component manager

(CTES)

 1.0.0.4411
  • Security improvement.
Data Discovery
(DARAgent)		 11.2.0.17

  • The Windows DARAgent component and its bundled third-party libraries have been updated with multiple security fixes and cryptographic hardening improvements. These updates implement process sandboxing for third-party document parsers to mitigate potential remote code execution (RCE) risks, upgrade match token encryption from AES-128 to AES-256-GCM to meet post-quantum security standards, and enforce restricted access control lists (ACLs) on agent registry keys. This release patches several vulnerabilities in the bundled OpenSSL library and resolves critical logic regressions and memory-safety issues in the agent's communication components.

    These updates also address several critical and high-severity vulnerabilities in bundled third-party library dependencies, including CVE-2026-34182, CVE-2026-45447, CVE-2026-11822, CVE-2026-11824, CVE-2026-7383, and others.

Installed Applications

(SNG)

 1.0.16.106

  • Fixed an issue where the SNG component did not include an installed application's recent execution status when calculating its hash value. This update ensures that software inventory data more accurately reflects the current state of applications installed on a device.

Manage Supervisor Credentials and Playbooks
(PER)

 1.0.11.32

  • For devices with Secure Boot enabled, the Playbooks provisioning process now supports the newest Windows Secure Boot certificate. The following certificates are supported:

    • Microsoft UEFI CA 2023

    • Microsoft UEFI CA 2011 (expired in June 2026)

  • When Secure Boot is enabled on a device, the PER component now verifies that the Microsoft 2023 UEFI certificate is fully installed and ready for use before booting the device.

  • Stability improvement.

Web Usage

(WMA)

 11.2.0.2

  • The WMA component and its bundled third-party libraries have been updated with multiple security fixes and cryptographic hardening improvements. These updates upgrade OpenSSL to version 3.6.2 across the CtDlpPrv and winwebusage components to address memory-safety and logic defects. Origin header validation has also been implemented for the WMAService component to protect against DNS rebinding and Cross-Site Request Forgery (CSRF) attacks, preventing malicious webpages from injecting fraudulent telemetry.

    These updates also address several medium-severity vulnerabilities in the Web Usage Monitoring service and bundled OpenSSL library, including CVE-2026-31790, CVE-2026-2673, CVE-2026-28386, CVE-2026-28387, and others.
Mac

Component manager

(CTES)

 1.0.0.4411
  • Security improvement.
Data Discovery
(DARAgent)		 11.2.0.15

  • The Mac DARAgent component and its bundled third-party libraries have been updated with key security and cryptographic hardening improvements. These updates expand symmetric encryption key sizes to 256-bit AES-GCM for long-term cryptographic protection, enforce restricted file permissions on local SQLite configuration databases, and establish process isolation safeguards for binary document parsers. Build pipelines have also been migrated to the macOS 26 Tart virtual machine image, and extensive third-party dependency updates across OpenSSL, Expat, and SQLite3 address critical memory-safety and denial-of-service vulnerabilities.

    These updates also address several critical, high, and medium-severity vulnerabilities in bundled third-party library dependencies, including CVE-2026-34182, CVE-2026-45447, CVE-2026-11822, CVE-2026-11824, CVE-2026-7383, and others.

Hardware

(HDP)

 1.0.13.45

  • Previously, when the HDP component was upgraded, a Microsoft Defender alert may have been triggered due to the creation of temporary hidden files in the /tmp directory. This issue has been fixed. A secure internal directory is now used to store temporary backup files.