November 2025

This section describes the new features and updates introduced in the Cortex XSOAR SaaS 8.12 release.

Release highlights

The Cortex XSOAR 8.12 release includes the following highlights:

Feature	Description
Conflict-free playbook editing	Prevent concurrent playbook editing with this enhancement, ensuring your team can build and modify automation workflows without conflicts.
Unique task logos	Boost clarity, quickly distinguish between integration commands, custom scripts, and system actions with playbook tasks that display unique logos and content pack indicators.
Unit 42 Threat Intelligence content pack	A new Unit 42 content pack provides high-value integrations that leverage Unit 42’s world-class threat intelligence, research, and analysis, replacing several deprecated packs (like AutoFocus and Unit 42 ATOMs Feed). To complete this migration, configure the new Unit 42 Feed and Enrichment integrations, update all related playbooks, and disable the old integrations.

Changed features

The Cortex XSOAR 8.12 release includes the following changed features:

Feature	Description
Threat Intel	The following pages and tabs have been removed: The Sample Analysis tab on the Threat Intel page The Sessions and Submissions tab on the Threat Intel tab The Unit 42 Intel tab on the indicator details page The Indicator search in the legacy Unit 42 library has been deprecated.

Marketplace content changes

This section describes the changes in content (integrations, playbooks, and indicators) from July to November.

Content	Description	Change Type
CVE-2025-49704 and CVE-2025-49706 and CVE-2025-53770 and CVE-2025-53771 - Microsoft SharePoint ToolShell vulnerability chain playbook	Automates the investigation and response to potential exploitation of four chained vulnerabilities (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771) in Microsoft SharePoint. This chain can allow unauthenticated threat actors to run arbitrary commands and gain remote execution capabilities.	New