Endpoint analysis release notes

The endpoint analysis (EPA) release note captures the enhancements, new features, fixed issues, and known issues in the EPA client for various platforms.

V26.6.1.4 for Windows (24 Aug 2026)

What’s new

• Updated OPSWAT libraries that resolve memory leaks during device posture scans

  The EPA client now includes updated OPSWAT (OESIS) libraries that resolve memory leaks during third-party product detection. Devices that perform frequent or continuous device posture scans no longer experience gradual memory buildup in the scanning process. The update also expands detection support for third-party security products, including ALYac, WatchGuard Endpoint Security Prime, and Trellix EDRF.

Fixed issues

• Users might be denied access to resources during each scan cycle. This issue occurs when the local Device Posture admin service cannot consistently resolve the signed-in user while saving and reading context during periodic scans.

  [DPS-4639]

• Launching Citrix Secure Access from a browser might fail to load the home page when Full tunnel is selected on the Client Choices page. This issue occurs because EPA sends an incorrectly terminated HTTP header that is rejected by NetScaler Gateway.

  [DPS-5100]

• The device posture scan might not complete, leaving the client stuck on the “Checking your device…” message. This issue occurs when the scan configuration returned by the Device Posture service exceeds the client’s capacity, such as when an administrator enables a registry scan policy.

  [DPS-4639]

V26.5.1.7 for Windows (08 Jul 2026)

Fixed issues

• On some devices, the EPA client incorrectly reports the Windows version. For example, a Windows 11 device was reported as an older Windows version, causing OS-based scan checks to evaluate incorrectly. This issue affects the EPA v1 (classic, on-premises) scan flow on certain Windows 10 and Windows 11 devices.

  [DPS-3919]

• In admin mode deployments, device certificate posture checks might fail because the EPA admin service does not automatically select a device certificate during evaluation. On affected setups, this causes periodic (continuous) device-certificate checks to fail repeatedly.

  [DPSHELP-154]

• For certain security products, such as CrowdStrike Falcon and OPSWAT-based products, scans do not correctly apply the Ignore Internet Check setting. As a result, checks such as virus-definition last-update time might fail even when the product is healthy.

  This issue occurs in OPSWAT-based antivirus and definition scans for affected products.

  [DPSHELP-153]

• Users might experience device posture context read failures. For example, a browser extension might report that it cannot fetch device posture context because the stored EPA context file is not decrypted and read back reliably. This issue occurs when the Device Posture service writes and later re-reads encrypted posture context and periodic scan files.

  [DPSHELP-144]

V26.03.31 for macOS (14 May 2026)

What’s new

• Deprecation of independent library update

  Starting with this release, runtime-dependent library updates are no longer supported. All future updates to these components will be delivered exclusively through new versions of the CitrixEndpointAnalysis application.

• Static library integration with EPA appliaction

  The core libraries required for system scanning are now bundled directly with the CitrixEndpointAnalysis application for both cloud and on-premises deployments.

  This integration provides the following benefits:

  • The integrated libraries now subjected to rigorous signature verification during application launch.
  • By bundling these assets, the application no longer needs to download and extract libraries at runtime, resulting in faster initialization and more reliable startup.