Rootshell Platform – Patch Notes December 2025

ConnectWise Manage Ticketing Support

We’re excited to announce full support for ConnectWise Manage ticketing integration within the platform.

You can now manually export vulnerabilities to ConnectWise service boards or automate this via the Automation Centre, streamlining remediation through your existing service workflows.

 Key Capabilities:

• Manual Ticket Export: Raise tickets from any issue directly into ConnectWise via a new export modal.

• Automation Centre Support: Automatically generate ConnectWise tickets based on custom rules and filters.

• Custom Field Mapping: Configure severity-to-priority mappings, select boards, contacts, and define default statuses.

• Two-Way Sync: Issues auto-update in Rootshell when tickets are closed in ConnectWise, maintaining lifecycle accuracy.

 Setup & Use:

• Connect your instance via Connected Accounts, using your base URL and API credentials.

• Validate credentials with built-in test functionality.

• Set mappings for severity → priority.

• Begin manually exporting or automate your ticket creation.

This new integration enhances ticketing flexibility, improves visibility, and reduces response times by embedding vulnerability management within your existing ConnectWise environment.

Enhanced CVE Extraction for Qualys WAS Scans

We’ve improved how the platform processes CVE data from Qualys WAS scan imports. In some cases, Qualys WAS XML reports include CVE references in the issue title but not in the underlying issue content, resulting in incomplete CVE mapping and weaker exploit correlation.

The platform now automatically detects CVEs found in the issue title and populates them into the issue record whenever they are missing from the content. This ensures:

• Accurate CVE attribution

• Correct exploit and active exploit detection

• More reliable vulnerability intelligence across all Qualys WAS imports

This enhancement improves data consistency and strengthens downstream analytics and reporting.

Upgrade to Qualys v3+ REST API

We’ve updated our Qualys integration to use the modern v3+ REST API, replacing the older v2 endpoints ahead of their planned deprecation in 2026.

This improvement ensures long-term compatibility, better performance, and continued reliability when importing vulnerability data from Qualys.

API – CVE Support Added to POST Issues API Endpoint

We have enhanced the Issues API to allow CVE data to be included directly in the initial POST request, removing the need for multiple API calls.

What’s Improved

Previously, adding an issue with CVEs required:

1. Creating the issue

2. Retrieving the issue ID

3. Making a second call to attach CVEs

The POST /issues endpoint now supports optional CVE fields within the request payload, enabling issue creation and CVE assignment in a single call.

Key Benefits

• Faster and more efficient API workflows

• Reduced number of calls needed when ingesting scanning results

• Better alignment with clients automating large-scale data ingestion

Acceptance

• CVEs can now be added during issue creation

• CVEs can still be removed later via the DELETE CVE endpoint

• Full QA completed on all CVE endpoints, including edge cases

This update significantly streamlines automated ingestion pipelines, especially for Managed Vulnerability Scanning integrations.

Removal of Project-Level Exports for Vulnerability Scanning (MVS) Projects

To improve stability and prevent failures caused by extremely large data sets, the platform now restricts exports within Managed Vulnerability Scanning (MVS) projects to the scan level only.

What’s Changed

• Project-level exports have been disabled for all MVS project types.

• Scan-level exports remain fully supported, ensuring reliable and performant data extraction.

• The UI has been updated so users only see valid export options at the scan level.

• Any attempt to trigger a project-level export (UI or API) for MVS projects is now gracefully blocked with a clear notification.

• All other project types (Pen Testing, Red Teaming, Ransomware, ASM etc.) retain full project-level export functionality.

This change ensures exports are accurate, stable, and suitable for the high-volume datasets typical of vulnerability scanning workflows.