OESIS Framework Release Announcement | August 2026

We are thrilled to unveil the latest updates to the OESIS Framework this month. Get ready to supercharge your endpoint protection solutions with expanded support for more products and some new, exciting features. Build stronger defenses with advanced capabilities that integrate seamlessly into your products. Prepare for an epic upgrade that'll take your security to the next level.

FEATURE: COMPLIANCE

ENHANCEMENT, WINDOWS, ENGINE UPDATE NEEDED, CODE CHANGE

We have enhanced the GetRealTimeProtection method for Windows Defender to make it clearer when Windows Defender is being managed (and effectively disabled) by a third‑party antivirus product.

Earlier, customers sometimes see Windows Defender protection state reported as ON or OFF inconsistently, which is expected when a third‑party AV is in control. But the previous output does not explain why.

With this change, when Windows Defender is managed by another AV, JSON output of GetRealTimeProtection will include a new managed_by_3rd_party_products array listing the managing product’s information. If Windows Defender is not managed by any third‑party AV, this field will be omitted.

This additional context helps customers understand that Windows Defender’s state is no longer the primary indicator of protection and that they should rely on the third‑party AV’s real‑time protection state for posture and compliance decisions.

*You will need to make a code change to implement this feature. Please contact the OPSWAT team to assist with this*

FEATURE: PATCHING

ENHANCEMENT, ANALOG PACKAGE, DATA UPDATE NEEDED

We are adding a new boolean field, has_static_download_link, to each object in the signatures[] array of products.json. This field indicates whether a patch ships a static download link stored in patch_aggregation.json, which helps customers who use their own downloader identify exactly which patches provide a usable static URL.

This is distinct from the existing usable_download_link field, whose meaning is unchanged. Some products generate links dynamically at runtime (for example, FileZilla and TortoiseSVN), so usable_download_link can be true while has_static_download_link is false.

FEATURE: PATCHING

NEW FEATURE, ANALOG PACKAGE, DATA UPDATE NEEDED

To improve the reliability of patch management on macOS, we have added a new attribute, requires_full_disk_access, to help administrators identify applications that require Full Disk Access (FDA) permissions for successful installation or updates.

Some macOS applications require the OESIS Agent to have Full Disk Access to perform patching operations. Without this, update attempts might fail silently or with permission errors if the necessary rights haven't been granted.

requires_full_disk_access is now available in patch_aggregation.json, specific to macOS product entries only; non-macOS patches remain unaffected. The field returns “yes” for applications requiring FDA and “no” otherwise.

By exposing this requirement directly in OESIS, integrators can have the technical insights needed to build more robust and user-friendly patch management workflows for macOS environments.

FEATURE: COMPLIANCE

NEW FEATURE, ALL PLATFORMS, ENGINE UPDATE NEEDED, CODE CHANGE

A new GetComplianceReport method is available on Windows, macOS, and Linux, returning a device-state compliance report with no pass/fail verdict, so you can map endpoint posture directly to a regulatory framework. Currently we support two modes: Generic Mode (framework_id: "generic", framework_version: "1.0") and PCI-DSS 4.0.1 (framework_id: "pci_dss", framework_version: "4.0.1"), the latter returning each control with its requirements[] mappings.

• Generic Mode currently covers 12 controls: anti_malware, firewall, anti_phishing, backup, encryption_at_rest, dlp, vpn, patch_management, vulnerability_management, remote_control, public_file_sharing, web_conference
• PCI-DSS 4.0.1 currently covers 6 controls: anti_malware, encryption_at_rest, firewall, vpn, dlp, patch_management

*You will need to make a code change to implement this feature. Please contact the OPSWAT team to assist with this*

FEATURE: PATCHING

ENHANCEMENT, WINDOWS, ENGINE UPDATE NEEDED

InstallFromFiles no longer reports a generic WA_VMOD_ERROR_INSTALLATION_FAILED (-1034) when a Windows KB installation fails because the disk ran out of space mid-install. The SDK now returns a new, specific error, WAAPI_ERROR_INSUFFICIENT_DISK_SPACE, so callers can distinguish a disk-space failure from other installation failures and remediate accordingly, for example by prompting the operator to free up space before retrying.

This addresses the case where free space looks sufficient at install start but drops below what DISM requires at peak activity, causing the installer to abort. A small number of KB installer types do not follow the Windows disk-space error convention and may still return -1034 in this scenario.

FEATURE: VULNERABILITY ASSESSMENT

ENHANCEMENT, ALL PLATFORMS, DATA UPDATE NEEDED

We are adding the Exploit Prediction Scoring System (EPSS) score to our vulnerability data, giving customers an exploitability-based signal to prioritize remediation alongside CVSS severity. EPSS estimates the likelihood that a vulnerability will be exploited in the wild.

The GetProductVulnerability (method 50505) response will include a new optional “epss” object nested inside each cves[].details, containing three fields: “score” (probability from 0 to 1), “percentile” (rank from 0 to 1), and “date” (the EPSS model date, in YYYY-MM-DD format). The object is present only when EPSS data is available for the CVE and is omitted otherwise. This is an additive change, so existing integrations continue to parse the response without modification.

FEATURE: COMPLIANCE

ENHANCEMENT, MAC, ENGINE UPDATE NEEDED, CODE CHANGE

We are extending DetectProducts on macOS with a new optional detect_all_users_products boolean flag, matching the existing Windows behavior. When enabled, DetectProducts enumerates installed products across all user accounts on the endpoint, active and inactive, regardless of session state. When omitted or set to false, detection remains scoped to the active user as it is today.

Detecting all users' products requires elevated privileges (running as a root daemon); without sufficient permissions the SDK returns WAAPI_ERROR_ACCESS_DENIED, consistent with Windows. This gives customers a complete inventory on shared and multi-user macOS endpoints, including scenarios where no user is logged in.

*You will need to make a code change to implement this feature. Please contact the OPSWAT team to assist with this*

FEATURE: ALL MODULES

ENHANCEMENT, ALL PLATFORMS, ENGINE UPDATE NEEDED

We are adding a new error_message field to the error response, surfacing the underlying native error detail alongside the existing OESIS error code. This makes it easier to diagnose failures during integration and support investigations. This is an additive change.

3.1 Engine Release Cadence Change (Starting October)

RELEASE SCHEDULE UPDATE, ALL PLATFORMS

Starting in October, we will update our Engine Package release cadence from weekly to bi-weekly. Under this new schedule, releases will occur twice per month, once in the second week and once in the fourth week of each month. This change aligns with our new development framework, enabling more accurate estimations, clearer updates, and more reliable on-time releases. We believe this adjustment will help us deliver higher- quality updates more consistently.

*The initial rollout timeline has been revised from April to October. If you have any concerns or need clarification on this update, please contact the OPSWAT team to assist with this*

3.2 End of Support for AppRemover package with the old engine on macOS

END OF SUPPORT, MAC

As we have refactored the AppRemover module on macOS to provide a more optimized and streamlined experience, two packages of the AppRemover module on macOS are being maintained on the My OPSWAT Portal: AppRemover OSX and AppRemover OSX V2.

As of January 1, 2026, the OSX package has been removed. We recommend upgrading to AppRemover OSX V2 to ensure your system receives all new updates and comprehensive technical support for the AppRemover module.