Secure Endpoint 11.2 release notes

This topic describes the software updates included in Secure Endpoint 11.2, along with subsequent hotfixes and upgrades. In addition to the specific changes detailed here, each release also includes broader system enhancements designed to strengthen security, optimize performance, and enhance overall stability.

To view the software updates that apply to the Secure Endpoint Agent, see the Secure Endpoint Agent release notes - Version 11.2.

Depending on the Absolute product licenses associated with your account, and your Absolute data center, some of the following features, enhancements, and fixes may not be available to you.

  • October updates
  • Release 11.2

Features and enhancements

You can now manage your Linux devices in Absolute Secure Endpoint.

Overview

Linux versions of the Secure Endpoint Agent are now available for download from the Agent Management area in Settings. The following Linux distributions are supported:

  • Ubuntu Desktop:
    • 26.04 LTS (x64, ARM64)
    • 24.04 LTS (x64)
    • 22.04 LTS (x64)
  • Ubuntu Server LTS 24.04 (x64, ARM64)
  • Red Hat Enterprise Linux for Workstations
    • 9.7 (x64, ARM64)
    • 10.1 (x64, ARM64)

Linux support is available with Secure Endpoint Agent 11.2.0.1 and higher.

Helpful links

Download the Linux agent

Install the Linux agent

Trigger an agent call

Working with Linux devices in the console

After the agent is installed and activated on a supported device, the device is added to the console and its hardware information is uploaded. To view the collected hardware information, go to each device's Hardware page in Device Details, or add hardware-related columns to a device report.

List of hardware data points collected

In the current release, Linux devices support the following features:

More features will be supported in future releases.

Linux support is not available with the Absolute Visibility product license.

You can now configure wake schedules for policy groups to automatically wake Windows and Mac devices from sleep or hibernation at a specified time. This feature helps ensure that pending device actions, such as freezing a device or executing a script, can be processed during off-hours without requiring manual intervention. You can configure wake schedules in a policy group’s settings and monitor individual device wake status on the Device Details page.

Learn more

A new Websites tab is now available in a device’s Device Details page, providing you with granular visibility into the web activity of individual devices. This tab shows a report of specific page titles and URLs visited, the time spent in focus on each page, and the associated logged-in user. Drilling down by device from a Web Usage report takes you directly to this tab, with the default Last 7 days filter applied for quicker investigation of web activity.

The Websites tab is available on Windows and Chromebook devices with an active Web Usage policy.

The new location summary feature uses AI analysis to provide a concise, natural-language overview of a device’s historical movements directly on the History page in Device Details. By analyzing geolocation data to identify primary locations and significant travel patterns, this feature can help you quickly assess device activity, investigate potentially suspicious behavior, and verify compliance with organizational travel policies.

The summary also identifies low-confidence location events, such as those derived from public IP addresses, providing additional context for more informed risk assessments.

Learn more

We welcome your feedback on this new feature. Please use the Is this helpful? prompt at the bottom of the summary to add your comments.

In Device Details, the following enhancements have been added to each device's History page:

  • In preparation for the retirement of the Location History page in a future release, the History page has been enhanced to show more device location information.

    For authorized users, a device’s History page now shows the device’s last known location before an event occurred. Click an event to see the location on a map in the overview area. The map also shows other locations the device moved to during the selected date range.

    Map availability

    Map availability is now controlled by a new account-level setting, Location history privacy. When the setting is disabled (default setting), the map is available to all authorized users. When it's enabled, authorized users need to click View location to unmask the map. This action logs a Location history accessed event to Event History. Learn more

    Additional enhancements

    The following device location enhancements were also added to theHistory page:

    • By default, IP locations are now excluded from the timeline. Select the Show IP locations checkbox to include them.
    • The map includes new location markers and map controls. Learn more
    • The following events are now shown on the timeline when the Location updated events filter is applied:
      • Device entered a geofence
      • Device exited a geofence
      • Location history accessed
    • For Device location updated events, the timeline now shows one of the following:
      • Moved to <city name>
      • Moved within <city name>

  • The filters on the History page have been updated as follows:

    • A new filter, Compliance events, has been added. It includes anti-malware, encryption, application compliance, and policy group events. Learn more

    • Additional events have been added to System updated events. List of all events

    • Additional events have been added to Action events. List of all events

    • The User updated events filter has been removed and its events have been moved to System updated events.

    • The Rule triggered events filter has been removed and its events have been moved to Action events.

    • When the All Events filter is applied to the page, the following items may now be displayed to ensure that there are no gaps in the timeline:

      • No changes

      • No changes for <#> days

      • Offline

      • Offline for <#> days

The following enhancements have been added to the Absolute Rehydrate feature:

  • A new area called Files is now available in the Settings area. It allows you to upload and manage files used in Restore from image Run Playbook requests.

    Before submitting a Run Playbook request, you can go to Files and upload your ISO or WIM image, and an answer file (if required). The files will be available for selection when you submit the Run Playbook request.

    Learn more about the Files area

  • The Restore from image playbook has been enhanced:
    • A manifest file is no longer required. In the Run playbook dialog, you can now specify the location of your stored image file and answer file (if applicable). The following locations are supported:
      • Files area in the console
      • External URL
      • Local storage (image files only)

      Learn more

    • Optionally prompt the device user when a playbook processing error occurs Learn more
    • Optionally pass command line parameters to the playbook. Learn more

Firmware Freeze requests can now be sent over a cellular network to select Windows devices that support cellular connectivity.

A Firmware Freeze over cellular request is more reliable because it doesn't require the device to be online or its operating system or Secure Endpoint Agent agent to be functional. For example, it can secure a device below the OS level when:

  • It is powered off or unreachable via WLAN/LAN.
  • The operating system is compromised or reinstalled.
  • The device's Secure Endpoint Agent has been tampered with by a bad actor.

Note that unlike standard Firmware Freeze requests, requests sent over a cellular network:

  • Freeze the device at the firmware level only.
  • Can be removed using a Remove Freeze request or the device's unfreeze code.

Learn more

System requirements

  • Lenovo ThinkPad X1, X, and T series devices running Windows 11 that support:

  • Absolute Control or Absolute Resilience license that includes ThinkShield TraceLock, or a ThinkShield TraceLock add-on license.

Learn more

For all accounts that use the Absolute identity provider (IdP) to log in to the Secure Endpoint Console, two-factor authentication (2FA) is now required.

For accounts that have not already enabled 2FA, this security enhancement will be rolled out in phases over the next few weeks. If you want to enable 2FA for your users before 2FA authentication is enforced, go to Settings > Account and click the toggle to turn Two-Factor Authentication on. Learn more

When 2FA is enabled, users need to enter a 2FA verification code along with their username and password when they log in to the console. To generate verification codes, users need to add a 2FA authenticator app to their mobile device and then add their Absolute user account to the app. Learn more

For accounts with Single Sign-On enabled, this requirement only applies to users that have been added to the SSO exclusion list.

The following events are now logged to the Events page in the History area:

  • Wake schedule policy enabled

  • Wake schedule policy updated

  • Wake schedule policy disabled

  • Wake schedule set on device

  • Wake schedule updated on device

  • Wake schedule set failed on device

  • Device awoke

  • Asset file uploaded

  • Asset file updated

  • Asset file deleted

If desired, you can create an Alert rule based on any of these new events.

Improvements and fixes

Feature/Area Details
AI Assistant

  • AI Assistant can now respond to queries related to events, making it easier to investigate and analyze activity across your endpoint fleet. For example, you can ask it to filter specific event types, summarize device histories, identify who performed security actions, or track event status trends over time.

  • AI Assistant now enforces two layers of permission filtering to ensure query results respect each user’s permissions in the Secure Endpoint Console. This update ensures that users can access device information, geolocation data, and event history through AI Assistant only if they have the corresponding View permissions in the console.
Application Resilience

  • Application Resilience now supports Nexthink Collector. Learn more

  • Application Resilience policies now support version 25.x or higher of SentinelOne, including the ability to upload either an MSI or EXE installer for application upgrades and repairs.

  • Application Resilience policies for Trend Micro Apex One Security Agent and HP Insights have been updated to correctly identify the applications under their new service names.

  • Application Resilience policies now allow you to persist the following application versions:

    • Version 5.1.19.x or higher of Cisco Secure Client

    • Version 26.7.x or higher of Citrix Workspace

    • Version 6.7.2.x or higher of Qualys Cloud Agent

    • Version 11.2.3.x or higher of Tenable Nessus Agent

  • Fixed an issue that prevented Application Resilience policies for Citrix Workspace from monitoring or repairing the application when it was installed in the 64-bit Program Files directory.

  • Fixed an issue where Application Resilience policies for Microsoft System Center Configuration Manager (SCCM) incorrectly reported devices as non-compliant because the Secure Endpoint Agent detected the product version instead of the actual client version. You can now configure a policy to validate the application status against either the product version from Add/Remove Programs or the SMS client version from the SCCM client registry.
Chromebook support

  • The Absolute for Chromebooks extension (now at version 2.6.7.0) and its bundled third-party libraries have been updated to use Node.js v26.12.1 to address several high-severity security vulnerabilities. This update resolves a Brotli decoder flaw that could permit remote code execution (CVE-2026-111497) and multiple TLS certificate hostname bypasses (CVE-2026-106069, CVE-2026-105483).
Dashboards

  • To avoid filtering errors in widgets based on device usage, the ability to filter the widget data by device group has been removed.
Device Details

  • Editing custom field values on a device’s Details > Custom Fields page is now easier, with improved keyboard navigation and clearer visual indicators for editable fields.

  • In the ThinkShield TraceLock > Status details report column and field, the following value now shows if the detected BIOS version supports Firmware Wipe requests, but not Firmware Freeze over cellular requests: BIOS update required for full support

    Update the BIOS before submitting a Firmware Freeze over cellular request.
Freeze

  • If the Create an alphanumeric unfreeze code for all devices option is selected when specifying the unfreeze code for a Freeze request or Offline Freeze rule, the unfreeze code that is prefilled in the field is now masked.
Playbooks (Absolute Rehydrate)
  • To help troubleshoot provisioning issues, and errors that may occur when a playbook runs, a new Error status has been added. The status shows in the Playbook > Status report column, and the Playbooks field in Device Details. To view details about the error, review the values in the Playbook > Status details report column.

  • To help troubleshoot device provisioning issues, the Playbook > Status details report column may now show the following errors:

    • Secure boot certificate not found

    • Hash check failed

    • File validation failed

    • Bootloader installation failed

    • EFI volume mount failed

    • Boot entry creation failed

    • Boot order update failed

    • BitLocker suspension failed

    • Boot order locked

    • Drive encryption in progress

    • Persistence not fully activated. Try rebooting the device.

    • Invalid server ID configured in AbtStatus. Contact Technical Support.

    • Persistence not installed. AbtStatus is missing.

  • The Absolute Bootloader was updated to prevent the device from entering a reboot loop, in certain situations.
Reach Scripts

  • The following scripts are now available in the Script library:

    • Detect Node.js runtimes affected by the October 2026 security release, which detects Node.js runtimes on Windows and Mac devices that are affected by the Node.js October 2026 security release, so you can find devices that need to be upgraded.

    • Detect PHP2Shell (CVE-2026-109618 and CVE-2026-109619) on a Windows or Mac device, which detects PHP installations on Windows and Mac devices that are affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) and can apply interim mitigations until PHP is upgraded.
Reports

  • The unsubscribe link in scheduled report emails now specifies the email address being unsubscribed, making it clearer which address will be removed from the report's recipient list. This enhancement helps users with shared or group email addresses understand that unsubscribing will stop report delivery to everyone using that address.

  • To improve visual consistency across the Secure Endpoint Console, the layout and styling of results grids have been updated. These enhancements include standardized margins and padding to align the grids with other page elements, such as titles and filters.
User Management and permissions

  • The Roles page in the User management area has been redesigned to match the look and feel of the rest of the console, providing a more consistent user experience.

  • When assigning the Perform permission for Remove Freeze to a new custom role, also assign the View permission for Freeze to ensure that users can view the Freeze request before they remove it.

    For existing custom roles created before the October release, users assigned the Perform permission for Remove Freeze can view Freeze requests regardless of whether the View permission for Freeze is assigned or not. However, for existing default roles, users assigned only the Perform permission for Remove Freeze will no longer be able to view Freeze requests.
Utilities
  • The Settings > Utilities page has been updated as follows:
    • A Linux tab has been added. To trigger an agent call, click the tab to download the Persistence Status Monitor for Linux. Learn more.
    • The Agent Management Tool for Mac has been retired and removed from the macOS tab. A new agent management tool will be available in a future release. In the meantime, use the command line to trigger an agent call.

Features and enhancements

You can now purchase and auto-renew Absolute product licenses directly from the Secure Endpoint Console using a credit card. This self-service capability lets you quickly manage licensing and auto-renewal for your account, helping you maintain continuous endpoint protection without waiting for manual purchasing processes. This feature is currently available for eligible accounts in the United States and Canada.
Learn more

Web Usage reports now use a new high-performance database, delivering faster, more reliable report generation. You can also now customize the report date range and choose from multiple aggregation options, including totals and daily, weekly, or monthly averages, to analyze website activity at the level of detail you need. As part of this update:

  • The Web Usage (Last 7 Days), Web Usage (Trending), and Web Subscriptions reports have been retired. All custom reports based on these reports have also been removed.

  • The configuration for standard work hours has been moved to Account Settings, ensuring that your daytime and evening usage definitions are easily accessible and consistently applied across all Web Usage reports.

The following events are now logged to the Events page in the History area:

  • License purchase succeeded

  • License purchase failed

  • Auto-renewal enabled

  • Auto-renewal disabled

If desired, you can create an Alert rule based on any of these new events.

Improvements and fixes

Feature/Area Details
Absolute APIs
  • The following endpoints are now available in the Freeze resource:
  • In the Playbook resource, an InputType parameter is now returned when you run the Get playbook templates endpoint. It indicates the type of content contained in the parameter, such as URL, Credentials, or File.
Account settings

  • Single Sign-On now supports only the following encryption methods: AES-128-GCM, AES-192-GCM, AES-256-GCM, AES-256-CBC, RSA-OAEP, or RSA-OAEP-MGF1P. For security reasons, other encryption methods are no longer supported.
Application Resilience

  • Application Resilience policies for Carbon Black Cloud now support version 4.2.x or higher, including updated detection for the application's new architecture.

  • The Application Resilience policy for the following applications now supports an additional default signer name:

    • Trellix Endpoint Security Agent (formerly FireEye Endpoint Agent): FireEye (Musarubra US LLC)

    • BlackBerry CylancePROTECT: Arctic Wolf Networks, Inc.

    • Ivanti Secure Access Client: Ivanti, Inc.

    • Dell Encryption: Dell Technologies Inc.

    These updates reflect the current signers used by the respective services.

    In addition, the default signer name for F5 BIG-IP Edge Client was updated from F5 Inc. to F5, Inc.
Dashboards

  • Previously, when exporting a dashboard widget based on the Web usage, Device usage, or Application usage data source, the exported report was empty if the widget configuration included a metric filter. This issue is now fixed.

  • Fixed an issue where the Time in focus (total) column header was missing from the report when you exported a widget based on the Web usage data source.

  • When a filter contains a long value, such as a local IPv6 address, the value now wraps correctly to the next line.

  • When a widget is based on the Devices data source, you can now filter the widget’s data by the Last core agent connection field.
Device Details

  • Each device’s Policies page has been improved to show comprehensive information about a device’s activated policies.

    The page now shows the activation status of all policies responsible for data collection, and the device’s activated Application Resilience policies. It also shows the date and time when the policy was last activated or updated, and the date and time when the policy last detected new data on the device. Learn more

  • The date range on the History page now defaults to Last 1 year instead of Last 30 days. All events logged during the past year are now automatically loaded. As a result, the Load an additional 30 days option has been removed.
Device usage

  • Previously, the Average daily usage and Usage level fields were recalculated only when a new device usage payload was sent to the Absolute Monitoring Center. This issue is now fixed. These fields are now recalculated on a daily basis to ensure that they reflect the correct value based on the 30-day period prior to the current date.
History > Events

  • When a theft report is created for a missing device, the associated events are now logged in the correct order: the Missing device found event is now logged before the Theft report created event. In addition, the Missing device found event now explicitly states that the event was triggered by a new theft report.
License Management

  • Fixed an issue where manual license assignment requests could fail to complete when multiple licenses of the same type were available. Previously, if the first license in the sequence was exhausted, the system could become unresponsive during the transition to the next available license. Manual assignment now correctly uses all available licenses to ensure the process completes successfully.
Mac support

  • The Secure Endpoint Agent for Mac now supports macOS 27 and runs natively on devices with Apple silicon, without relying on the Rosetta translation environment.

    macOS 27 requires agent version 11.1.0.2 or higher.
Playbooks (Absolute Rehydrate)
Reports

  • Recipients of scheduled reports can now unsubscribe from future deliveries directly from the report email by clicking a unique link in the footer. This self-service option removes the recipient from the distribution list without requiring action from the report owner or a console login.
User Management and permissions

  • The Device Usage reports permission, which is no longer applicable, has been removed from the Roles page in User Management.

    To allow a custom role to view device usage on the Dashboard, assign the View permission for Device reports. To allow a custom role to view and export device usage events on the History page in Device Details, assign the View permission for both Device reports and Audit Event History.

  • To view or export location related events on the History page in Device Details, the View permission for Geolocation is now required. To view locations below city level, the Address-level view permission for Geolocation is now also required.