> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2025-releases/release-29-april-2025.md).

# Release 2.9 (April 2025)

The table below describes the features and enhancements introduced in the Cortex Xpanse Expander 2.9 (April 2025) release.

Cortex Xpanse typically upgrades customers over a three-week time frame. Contact customer success to find out your specific upgrade date.

| Feature                         | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| CISA KEV Vulnerability Testing  | Cortex Xpanse now supports Attack Surface Tests for all [CISA KEV CVEs](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) that are externally detectable, do not require authentication, and can be exploited without any risks to the availability or integrity of the running application. In all this totals over 260 different vulnerabilities known to be actively exploited in the wild, 190 of which have a CVSS score of 9.0 or higher. As with all Attack Surface Tests, these checks perform full benign exploitation of a given vulnerability to produce confirmations of exploitation with near certainty. |
| Default Credential Testing      | The Cortex Xpanse 2.9 release also includes roughly 40 new attack surface tests focused on the detection of applications leveraging manufacturer default credentials. These tests include checks for default credentials on a number of business operations systems as well as IT and networking devices.                                                                                                                                                                                                                                                                                                                          |
| Operating System Identification | Cortex Xpanse now supports fingerprinting multiple different operating systems and version details for internet-facing applications.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| Asset Removal API               | Manage your inventory more efficiently with a new API that enables you to remove IP address ranges, paid-level domains, subdomains, and certificates from your inventory, as needed.                                                                                                                                                                                                                                                                                                                                                                                                                                               |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2025-releases/release-29-april-2025.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.