These are the release notes for Sophos NDR.
The features mentioned in these release notes are only available if you have the appropriate license.
View the product documentation at NDR.
| Issue ID | Component | Description |
|---|---|---|
| MTRNTA-3811 | NDR | Fixed an issue where Sophos Central reported the hardware appliance IP address as DHCP when it was configured with a manual IP address. |
| MTRNTA-3802 | NDR | Fixed an issue where installing Nutanix using the provided script did not create all required NICs for the VM. |
| MTRNTA-3758 | NDR | Fixed an issue where the AWS appliance on Ubuntu failed to start and showed an incorrect version in the console. |
| MTRNTA-3748 | NDR | Fixed an issue where the Investigation Console API key required for the Remote IC feature was not recreated after an upgrade. |
| MTRNTA-3873 | NDR | Added a mitigation for the CVE-2026-31431 Copy Fail exploit. |
| MTRNTA-3877 | NDR | Added mitigation for the CVE-2026-43284 and CVE-2026-43500 Dirty Frag exploits. |
We're upgrading NDR appliances from Ubuntu 20.04 to Oracle Linux 9.
The following Investigation Console pages are now accessible in Sophos Central as a beta feature. These pages have functionality that's similar to what they currently have on the VM, and will remain accessible on the VM until the feature is no longer in beta.
We've introduced a new ISO installer for certified hardware with an easy-to-use UI.
NDR components that use self-signed certificates now use the Diffie-Hellman algorithm.
The Encrypted Payload Analytics (EPA) model has been updated to v2.1.0.
| Issue ID | Component | Description |
|---|---|---|
| MTRNTA-3558 | NDR | Fixed an issue with the proxy connection in the NDR Console UI. |
| MTRNTA-3544 | NDR | Fixed an issue with NDR on Nutanix where the system was reporting it incorrectly as hardware. |
| MTRNTA-3534 | NDR | The management settings modal text was improved, and the appearance was updated to make it easier to read. |
| MTRNTA-3451 | NDR | Fixed an issue where metadata from ERSPAN tunneled packets may not have been seen. |
| MTRNTA-3407 | NDR | Fixed an issue with VMware ESXi where enabling RSS on NICs with only one receive queue caused an error. RSS is now enabled only when multiple receive queues are available. |
| MTRNTA-3308 | NDR | Fixed an issue where the NDR Console UI screen didn't refresh properly. |
| MTRNTA-3304 | NDR | Fixed an issue with the NDR Console UI where it was unable to update the network setting. |
| MTRNTA-3200 | NDR | Fixed an issue with the internet check where the network took too long to come up and assign an IP address to the interface. |
| MTRNTA-3176 | NDR | Fixed an issue with the NDR Console UI, which was causing it to stop responding. |
See Sophos NDR Known Issues list for a full list of known issues with Sophos NDR.
You can find technical support for Sophos products in any of these ways:
Copyright © 2026 Sophos Limited. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner.
Sophos and Sophos Anti-Virus are registered trademarks of Sophos Limited and Sophos Group. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.