What's New and Release Notes for 26.x

Firewall tampering detection now reports potential tampering events to the PCE immediately upon initial detection, allowing administrators to investigate suspected tampering sooner. Event reporting now includes richer metadata, distinguish between possible and confirmed tampering, track repeated detections, and use aggregation logic to reduce noise from recurring events.

For more information, see VEN Firewall Tampering Detection.

Illumio now supports PCE-based Network Location Awareness (PCE NLA) for domain-joined Windows endpoints, helping secure hybrid and remote workforces regardless of where they work.

This supports a combined scenario when:

PCE NLA for domain-joined Windows Endpoints requires organization-wide configuration and applies to all VENs paired for that organization. On-Prem customers enable this feature with a north-bound API call. SaaS customers must contact Illumio to create an OPS ticket. For details, see Network Location Awareness (NLA) Support for Endpoints.

The Adaptive User Segmentation (AUS) now maintains policy enforcement even when the PCE is temporarily unreachable.

Previously, the VEN required a live PCE connection to report user status and fetch the needed AUS policy. With this release, the enforcement layer proactively fetches and caches AUS policy for all configured user groups, so rules are available locally and enforced even if the PCE is unreachable.

This applies to both supported integration types:

When the PCE comes back online, AUS policy is refreshed automatically and normal enforcement resumes without dropping existing sessions.

AUS policy resilience applies at the PCE cluster level and defaults to off. To enable this feature, add the following to the PCE runtime_env.yml, then restart the PCE.

agent_service:
aus_resiliency_enabled: true

For more about AUS generally, see Adaptive User Segmentation in the Security Policy Guide.

Linux Outbound Process-based traffic enforcement now recovers automatically across VEN restarts, binary updates, symlink changes, and container contexts. Policy changes are logged with source attribution, tamper detection, optional auto-remediation, and JSON audit output for SIEM ingestion.

See Linux Process-Based Flow Visibility and Outbound Policy Enforcement.

Beginning with this release, VENs are now supported for use on workloads running Ubuntu, version 26.04.

Beginning with this release, Endpoint VENs are now supported for use on workloads running macOS Golden gate, version 27.

The VEN for RHEL 9 and later is FIPS 140-3-ready.