XDR Collectors 1.5.3 (Major)

The XDR Collectors major release for Windows 1.5.3.2503 and Linux 1.5.3.2371 was released as part of the following releases of Cortex Cloud:

• 2.2 on July 20, 2026

The following table describes the changes integrated for this release:

ISSUE	DESCRIPTION
CPATR-38430, CPATR-38431	Upgraded OpenSSL to version 3.5.0, Python to version 3.13.1, and SQLite to version 3.53.2 for Linux XDR Collectors, and upgraded OpenSSL to version 3.5.0, Python to version 3.12.13, and SQLite to version 3.53.2 for Windows XDR Collectors to address known vulnerabilities and enhance system stability. This update also resolves intermittent status reporting failures and improves metric accuracy during high-volume log ingestion.
CPATR-36278	Fixed an issue where Winlogbeat or Filebeat services could fail to start after upgrading the XDR Collectors, ensuring consistent log collection across versions.
CPATR-35140	Fixed an issue where a failure to correctly read the current software version could cause the Winlogbeat or Filebeat services to stop unexpectedly on the XDR Collector.
CPATR-35180, CRTX-221926	Cortex XDR/XSIAM/Cloud now supports version 9.3.2 Filebeat and Winlogbeat for 64-bit XDR Collectors. Live 64-bit XDR Collectors receive this update automatically, while 32-bit XDR Collectors remain unaffected, as this independent update is not tied to any specific XDR Collectors version.
CPATR-38862, CPATR-35424	Addressed security vulnerabilities and applied hardening measures to ensure the ongoing security and integrity of XDR Collectors.
CPATR-37182	Fixed an issue where the XDR Collectors service failed to start on certain Linux distributions (RHEL, Oracle, Rocky, and Alma) when SELinux was enabled in Enforcing mode.
CPATR-37025	Fixed an issue in high-volume environments where log data could be deleted before upload due to disk space limits being reached within the default reporting interval. The default upload interval has been reduced from 60 seconds to 3 seconds to ensure more frequent data delivery and prevent data loss.
CPATR-36949	Fixed an issue where log rotation for specific internal processes did not function correctly, which could lead to increased disk space usage on the host machine.
CPATR-36650	Fixed an issue where XDR Collectors failed to resolve their local IP address when using a Broker VM or proxy without direct internet access.
CPATR-36400	Fixed an issue where the XDR Collectors installation script failed to execute correctly on Rocky Linux.
CPATR-35857	Fixed a logic error where an uninitialized variable in the SSL utility script could cause secondary errors during exception handling.
CPATR-35472	Fixed a race condition issue where concurrent database access could result in database locks or data inconsistencies during log processing.
CPATR-34985	Fixed an issue where the XDR Collectors could repeatedly attempt to upload a corrupted ZIP file, improving the reliability of data synchronization.
CPATR-33916	Fixed a rare issue where the XDR Collectors could crash during the registration process if no network connection was available.