Agent Packages for Microsoft KB Update (September 8, 2026) Released

If your organization uses Netwrix Threat Prevention to monitor Exchange activity, the following Microsoft security update requires your attention before deployment. This issue affects all current Netwrix Threat Prevention Windows Agent versions. There is no adverse impact on Exchange Server operation itself if the KB is deployed; however, Exchange event monitoring through Netwrix Threat Prevention will be lost until the updated Netwrix Threat Prevention Windows Agent is installed. An updated Agent build is planned for release on Tuesday, June 30, 2026.
For full details click the link below!

Bug Fixes and Miscellaneous Updates

On September 8, 2026, Microsoft distributed KBs that conflict with existing Netwrix Threat Prevention agents. If these KBs are applied to your systems, they will conflict with current agents, as described in this announcement.

Netwrix has issued updated agent packages that have support for new Microsoft KBs.

The updated builds are:

  • 8.0.0.88
  • 7.5.0.317
  • 7.4.0.308

How to Upgrade Netwrix Threat Prevention Agents

There are two options to obtain the updated agents:

  1. Using the existing Netwrix Threat Prevention Console and the “Update Agent Installer” button on the Agents panel. Then verify the version obtained matches the relevant version listed at the top of this Product Notification email

–– or ––

  1. Manually obtain the latest Agent build(s) from the portal and place in the current “..\SIEnterpriseManager\Setup\” folder

Once one of the above two options is completed, use the Netwrix Threat Prevention Console to upgrade all agents.

Need help with this update?

There are many different ways to get help with our products!

Situation Action
If you feel the product is broken and not working as intended… Contact Support
If you have a question you’d like to ask other experts… Create a discussion in the community: Threat Prevention > Discussions & Questions
If you have a feature request… Let our product team know directly: Threat Prevention > Ideas
If you have something cool to show… Show everyone what you built: Threat Prevention > Show & Tell

What are your thoughts?

We are always happy to hear from our users on what you like, and what you hope to see in the future. Please, share your thoughts below!

1 Like

Is this something new for the agent upgrades? When I try to upgrade the agent to 8.0.0.88, it says that the agent needs to be softened first? This hasn’t been needed in the past? Moving forward are we to go back to softening the agent first then upgrading?

Hi Jay - looking into your question. I am not aware of anything having changed.

3 Likes

Hi Jay – Thank you for brining this to our attention. Behavior you are seeing is due to a change made to fix a different issue in which doing an agent settings change on a hardened agent that included an invalid EM IP address could leave the agent in an orphaned state that was hard to recover from since it was automatically doing auto soften then re-harden. Looking now into how to cover that case w/o requiring manual soften & harden for the agent self-upgrade case.

1 Like

Thanks Tony, much appreciated! Do you know if this was put in for just the 8 versions, or does this affect the 7.5 and 7.4 version as well?

Tony, does this affect the Enterprise Manager version as well as the Agent? Or my issue with just the agent. My Enterprise Manager is 8.0.0.88. I did notice, that I wasn’t able to upgrade any of these agents. I had to uninstall them all and then reinstall them to get the agents to deploy correctly. Just some feedback, i’ve been noticing.

Hi Jay - I asked QA to double check this. Can you please provide details / steps via a support escalation as there should be no need to do an uninstall / reinstall of agents? You do need to soften before doing agent upgrade.

1 Like

Ok, I’ll open a ticket. That’s why i thought that it was strange, I usually just select upgrade agent and it works. However, this release wouldn’t finish. So i had to uninstall and reinstall all of them in order to get the agents deployed.