> ## Documentation Index
> Fetch the complete documentation index at: https://bloodhound.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# 2026-10-07 Release Notes

> Learn about new features, enhancements, and fixed issues in BloodHound.

> [!TIP]
>
> Use the filters on the right side of this page to narrow down the updates by component. You can select multiple filters at the same time to refine your results.

| | | | | |
| - | - | - | - | - |
| **Release** | **BloodHound** | **OpenHound** | **SharpHound** | **AzureHound** |
| 2026-10-07 | v9.8.0 | No release | v2.17.0 | No release |

> [!WARNING]
>
> **Upcoming collector deprecation**
>
> BloodHound Enterprise will soon ingest collector property values exactly as collectors send them instead of normalizing values during ingest. Older AzureHound and OpenHound versions depend on server-side normalization and can create duplicate nodes or identity mismatches when this change is enabled.
>
> Starting with the November 2026 release, BloodHound Enterprise will reject client and file ingest uploads from deprecated AzureHound and OpenHound versions.
>
> Upgrade to AzureHound v3.1.0 or later and OpenHound v0.3.0 or later before then to keep data collection compatible with future versions of BloodHound Enterprise.

**BloodHound**

New Feature

## Findings Table General Availability

![Applies to BloodHound Enterprise only](https://mintcdn.com/specterops/tTIczgde9H07oLXf/assets/enterprise-edition-pill-tag.svg?fit=max\&auto=format\&n=tTIczgde9H07oLXf\&q=85\&s=b682a26b342bde12302ec829e265bdb6)

The [Findings Table](https://bloodhound.specterops.io/analyze-data/findings/table-view.md) feature is now generally available. Triage findings more efficiently with clearer state and platform indicators, and new copy actions.

Findings display a cross-platform badge when appropriate, use distinct muted styling and status icons for accepted, remediated, deprecated, and orphaned findings, and provide a floating action bar.

**BloodHound**

New Feature

## Findings Prioritization Early Access

![Applies to BloodHound Enterprise only](https://mintcdn.com/specterops/tTIczgde9H07oLXf/assets/enterprise-edition-pill-tag.svg?fit=max\&auto=format\&n=tTIczgde9H07oLXf\&q=85\&s=b682a26b342bde12302ec829e265bdb6)

Use the [Findings Prioritization](https://bloodhound.specterops.io/analyze-data/findings/table-view.md#prioritize-findings) feature as guidance to triage and remediate results in the **Findings Table**. When enabled, the **Risk** column replaces **Severity** and ranks findings by priority.

> [!NOTE]
>
> This feature is available through Early Access. Enable **Findings Prioritization** on the **Administration** > **Early Access Features** page to access it.

**BloodHound**

Enhancement

## Active Directory Sites support

BloodHound now ingests and analyzes Active Directory [Sites](https://bloodhound.specterops.io/resources/nodes/site.md), [SiteServer](https://bloodhound.specterops.io/resources/nodes/site-server.md), and [SiteSubnet](https://bloodhound.specterops.io/resources/nodes/site-subnet.md) objects, including their containment, ACLs, site-linked GPOs, and [ServerIs](https://bloodhound.specterops.io/resources/edges/server-is.md) relationships.

**Community contribution**

Thank you to [Quentin Roland](https://www.linkedin.com/in/quentin-roland-07b944179/) for contributing this enhancement!

### Tier Zero zone rules

Zone Builder now include two corresponding [default rules](https://bloodhound.specterops.io/analyze-data/privilege-zones/default-rules.md) for the Tier Zero zone:

* **Sites:** Classifies Active Directory Site objects as Tier Zero because control over a site can enable compromise of the assets associated with it through linked Group Policy Objects.
* **Domain Controller Site Servers:** Classifies Site Server objects that reference Domain Controllers as Tier Zero because a malicious Group Policy Object linked to the Site could compromise the Domain Controller and its domain.

### API endpoints

The API exposes the following endpoints:

* **Site**
  * Entity details: [`/api/v2/sites/{object_id}`](https://bloodhound.specterops.io/reference/sites/get-site-entity-info)
  * Controllers: [`/api/v2/sites/{object_id}/controllers`](https://bloodhound.specterops.io/reference/sites/get-site-entity-controllers)
  * Linked GPOs: [`/api/v2/sites/{object_id}/linked-gpos`](https://bloodhound.specterops.io/reference/sites/get-site-entity-linked-gpos)
  * Site servers: [`/api/v2/sites/{object_id}/siteservers`](https://bloodhound.specterops.io/reference/sites/get-site-entity-site-servers)
  * Site subnets: [`/api/v2/sites/{object_id}/sitesubnets`](https://bloodhound.specterops.io/reference/sites/get-site-entity-site-subnets)
* **Site Server:** Entity details at [`/api/v2/siteservers/{object_id}`](https://bloodhound.specterops.io/reference/site-servers/get-site-server-entity-info)
* **Site Subnet:** Entity details at [`/api/v2/sitesubnets/{object_id}`](https://bloodhound.specterops.io/reference/site-subnets/get-site-subnet-entity-info)
* **GPO-to-Site:** Affected Sites at [`/api/v2/gpos/{object_id}/sites`](https://bloodhound.specterops.io/reference/gpos/get-gpo-entity-sites)

> [!NOTE]
>
> **Dependency**
>
> This enhancement requires upgrading to SharpHound v2.17.0 to collect the corresponding [Active Directory Sites data](https://bloodhound.specterops.io/resources/release-notes/2026-10-07.md#active-directory-sites-collection).

### Findings

![Applies to BloodHound Enterprise only](https://mintcdn.com/specterops/tTIczgde9H07oLXf/assets/enterprise-edition-pill-tag.svg?fit=max\&auto=format\&n=tTIczgde9H07oLXf\&q=85\&s=b682a26b342bde12302ec829e265bdb6)

BloodHound Enterprise additionally surfaces the **Tier Zero Computer Identified by Non-Tier Zero Site Server** finding when a non-Tier Zero Site Server references a Tier Zero computer.

**SharpHound**

Enhancement

## Active Directory Sites collection

Collect Active Directory Sites data with SharpHound v2.17.0.

SharpHound now collects Active Directory [Sites](https://bloodhound.specterops.io/resources/nodes/site.md), [SiteServer](https://bloodhound.specterops.io/resources/nodes/site-server.md), and [SiteSubnet](https://bloodhound.specterops.io/resources/nodes/site-subnet.md) objects, including site-to-server and site-to-subnet mappings, site-linked GPOs, and ACLs on Site objects.

**Community contribution**

Thank you to [Quentin Roland](https://www.linkedin.com/in/quentin-roland-07b944179/) for contributing this enhancement!

See [Active Directory Sites support](https://bloodhound.specterops.io/resources/release-notes/2026-10-07.md#active-directory-sites-support) to learn about how BloodHound handles the collected Active Directory Sites data.

**SharpHound**

Enhancement

## Active Directory collection coverage

Collect additional Active Directory structure and metadata with SharpHound v2.17.0.

SharpHound now collects the `Builtin` object and models it as a `Container`, including its well-known principal handling.

Collected Active Directory nodes also expose the directory object's `objectClass` as a node property.

**BloodHound**

Enhancement

## More useful Explore search results

Distinguish duplicate node names in the suggested results shown while typing in the **Explore** search or pathfinding text field.

Suggested results now include the node's distinguished name when multiple nodes share the same display name, making it easier to identify the correct object before opening it.

**BloodHound**

Enhancement

## Explicit empty values in the Entity Panel

See when a collected node property has an explicit empty value in the Entity Panel.

The Entity Panel now preserves and displays empty arrays as `NONE`, and empty strings and null values as `—`, instead of hiding the properties outright.

Accessible labels identify each placeholder as an empty array with zero values, an empty string, or a null value, making states such as empty `EffectiveEKUs` visible during investigation.

**BloodHound**

Enhancement

## Database Management access control

Keep the **Database Management** page limited to administrators.

Read-only users can no longer discover or open a page that presents destructive data-wipe controls that they cannot use.

**BloodHound**

Enhancement

## Parameterized PostgreSQL query formatting

BloodHound now extracts string literal values from queries into bound parameters, reducing injection risk while preserving query behavior.

These generated parameters are carried through query execution and translation caching, including values used in predicates, inserts, updates, and arrays.

**BloodHound**

Enhancement

## Responsive and accessible workflows

Use key BloodHound workflows more reliably at smaller widths, higher zoom levels, and with assistive technology.

*  The main navigation now automatically expands or contracts when the viewport crosses the `xl` breakpoint while respecting the user's expansion or collapse preference.
*  Explore and Zone Builder now expose clearer page and table headings for screen-reader navigation.
*  Explore table sorting now retains keyboard focus after a column is sorted.

![Applies to BloodHound Enterprise only](https://mintcdn.com/specterops/tTIczgde9H07oLXf/assets/enterprise-edition-pill-tag.svg?fit=max\&auto=format\&n=tTIczgde9H07oLXf\&q=85\&s=b682a26b342bde12302ec829e265bdb6)

The following changes apply to BloodHound Enterprise only:

*  Attack Paths finding rows now reflow their content at smaller widths.
*  The Manage Clients table now preserves semantic cell navigation for JAWS users.
*  Attack Paths graph and information panels now respond more reliably to smaller viewport widths.

**BloodHound**

Enhancement

## Custom client identifiers for IWA authentication

![Applies to BloodHound Enterprise only](https://mintcdn.com/specterops/tTIczgde9H07oLXf/assets/enterprise-edition-pill-tag.svg?fit=max\&auto=format\&n=tTIczgde9H07oLXf\&q=85\&s=b682a26b342bde12302ec829e265bdb6)

Configure an optional **Custom Client Identifier** to control how BloodHound Enterprise resolves SharpHound Enterprise [collector clients](https://bloodhound.specterops.io/collect-data/enterprise-collection/create-collector.md#sharphound-enterprise) from Integrated Windows Authentication (IWA) bearer tokens.

BloodHound Enterprise stores the identifier, reads the configured claim (or `sub` when no custom claim is configured), requires an exact non-empty string match, and then applies the existing issuer, audience, signature, and time-based token validation before authenticating the resolved client.

**BloodHound**

Enhancement

## Cleaner collector scheduling dialogs

![Applies to BloodHound Enterprise only](https://mintcdn.com/specterops/tTIczgde9H07oLXf/assets/enterprise-edition-pill-tag.svg?fit=max\&auto=format\&n=tTIczgde9H07oLXf\&q=85\&s=b682a26b342bde12302ec829e265bdb6)

Manage SharpHound, AzureHound, and OpenHound schedules from refreshed dialogs on the **Manage Clients** page.

The dialogs now have clearer spacing and field styling, with date, time, and recurrence controls that wrap cleanly at narrower widths.

Time zone information appears directly in the time field, while SharpHound's collection options and **Advanced Options** section use clearer labels, descriptions, and layout.

**SharpHound**

Enhancement

## Faster support bundle creation

![Applies to BloodHound Enterprise only](https://mintcdn.com/specterops/tTIczgde9H07oLXf/assets/enterprise-edition-pill-tag.svg?fit=max\&auto=format\&n=tTIczgde9H07oLXf\&q=85\&s=b682a26b342bde12302ec829e265bdb6)

BloodHound Enterprise now creates SharpHound Enterprise [support bundles](https://bloodhound.specterops.io/collect-data/enterprise-collection/collector-support-bundles.md) faster by skipping recompression of existing `log_archive` ZIP files.

This avoids unnecessary CPU work while preserving the archived logs in the bundle.

**BloodHound**

Enhancement

## Archived finding timestamps in the API

![Applies to BloodHound Enterprise only](https://mintcdn.com/specterops/tTIczgde9H07oLXf/assets/enterprise-edition-pill-tag.svg?fit=max\&auto=format\&n=tTIczgde9H07oLXf\&q=85\&s=b682a26b342bde12302ec829e265bdb6)

Use the `archived_at` response field in the [List attack path findings](https://bloodhound.specterops.io/reference/attack-paths/list-attack-path-findings.md) API to distinguish findings that have been archived from active findings. See [Finding status lifecycle](https://bloodhound.specterops.io/analyze-data/findings/table-view.md#finding-status-lifecycle) for more information.

The field is returned as a timestamp when a finding has been archived and is omitted when it has not.

**BloodHound**

## Fixed Issues

The following issues have been fixed in this release:

### Administration

![Applies to BloodHound Enterprise only](https://mintcdn.com/specterops/tTIczgde9H07oLXf/assets/enterprise-edition-pill-tag.svg?fit=max\&auto=format\&n=tTIczgde9H07oLXf\&q=85\&s=b682a26b342bde12302ec829e265bdb6)

 Resolved an issue where interrupted collector support bundle uploads could leave unfinished operations or artifacts behind.

### API

 Resolved an issue where Entity Panels failed to render linked nodes after node information was enriched by the API at runtime.

### Cypher

*  Resolved an issue where the Cypher-to-SQL translator could generate invalid SQL for a mixed predicate after a variable-length traversal.
*  Resolved an issue where canceled request contexts could prevent the Cypher query audit log from being created.

### Explore

*  Resolved an issue where a node's non-display kind could take precedence over its display kind, causing the Entity Panel header to show the wrong icon.
*  Resolved an issue where node kind tooltip labels were not consistently visible above the search and pathfinding results list.

### Zone Builder

*  Resolved an issue where the node count table could overlap the zone details description on small screens.