> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2025-releases/release-29-april-2025.md).

# Release 2.9 (April 2025)

The table below describes the features and enhancements introduced in the Cortex Xpanse Expander 2.9 (April 2025) release.

Cortex Xpanse typically upgrades customers over a three-week time frame. Contact customer success to find out your specific upgrade date.

| Feature                         | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| CISA KEV Vulnerability Testing  | Cortex Xpanse now supports Attack Surface Tests for all [CISA KEV CVEs](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) that are externally detectable, do not require authentication, and can be exploited without any risks to the availability or integrity of the running application. In all this totals over 260 different vulnerabilities known to be actively exploited in the wild, 190 of which have a CVSS score of 9.0 or higher. As with all Attack Surface Tests, these checks perform full benign exploitation of a given vulnerability to produce confirmations of exploitation with near certainty. |
| Default Credential Testing      | The Cortex Xpanse 2.9 release also includes roughly 40 new attack surface tests focused on the detection of applications leveraging manufacturer default credentials. These tests include checks for default credentials on a number of business operations systems as well as IT and networking devices.                                                                                                                                                                                                                                                                                                                          |
| Operating System Identification | Cortex Xpanse now supports fingerprinting multiple different operating systems and version details for internet-facing applications.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| Asset Removal API               | Manage your inventory more efficiently with a new API that enables you to remove IP address ranges, paid-level domains, subdomains, and certificates from your inventory, as needed.                                                                                                                                                                                                                                                                                                                                                                                                                                               |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2025-releases/release-29-april-2025.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.