JSCAPE 2026.4 is a security and reliability release shaped by customer feedback. Alongside several quality-of-life improvements for both self-hosted and SaaS customers, this update strengthens your defenses against insider threats, closes several third-party CVEs and keeps your environment on supported libraries by retiring end-of-life components.
What’s new?
Faster file discovery in large SFTP folders
If your users land in large folders, the SFTP server now returns up to 200 entries per directory read, making file discovery much faster. In testing, a folder of about 90,000 files listed in under three minutes, ensuring you find what you need much more quickly.
AWS GovCloud (US-East) support for Amazon S3
If you’re a government or regulated organization on AWS GovCloud, the region list now includes “AWS GovCloud (US-East)” for both Amazon S3 Trading Partners and Amazon S3 Network Storage, so you can set up US-East buckets directly in the JSCAPE interface. For clarity, the previously existing AWS GovCloud option is now labeled “AWS GovCloud (US-West)”.
UX refresh on Quotas and Ad-Hoc activity screens
The Configure > Quotas screens have a refreshed layout covering bandwidth and directory monitor quotas, and you can now filter and sort directory monitor records. A new Ad-Hoc Activity table gives you one place to view all your on-demand file shares.
Admin-to-user email visibility
If you’re a domain admin who emails your JSCAPE user base, you now have more control over who appears as the recipient. Previously, a message sent to everyone in the domain showed the first user in login order as the visible recipient, exposing that user’s email address to all recipients. The Email Users dialog now includes a To field, prefilled with a no-reply style address that you can edit before sending, so individual users’ addresses stay private.
Security updates to address third-party CVEs
To keep your environment secure, this release applies the following security updates on upgrade:
- FreeMarker 2.3.35 (from 2.3.30): CVE-2026-84939 (CVSS 9.1)
- Log4j 2.25.5: CVE-2026-49844
- HttpClient 5.6.4 and httpcore5 5.4.3: CVE-2026-71290, CVE-2026-54399, CVE-2026-54428
- Bouncy Castle 1.85 (from 1.84): CVE-2026-58062
- Apache Ant 1.10.18: CVE-2026-78254
- Additional open-source dependency updates, including Jackson and Netty
Core library updates
To keep key components current, this release upgrades OpenSAML (SSO), PDFBox (PDF and Office document handling), Gson and Lucene to their newest versions. The Gson and Lucene upgrades also address critical and high-severity open-source findings.
MFT Gateway: Library updates to retire end-of-life components
MFT Gateway 2026.4 now runs on JDK 17 (updated from Java 11) and Jetty 12 (updated from Jetty 9). These updates retire components that have reached end of life, keeping your Gateway on supported, actively maintained software.
Security hardening for insider threats
For self-hosted customers, help reduce the likelihood of a successful insider threat with additional protections for cluster authentication, OIDC sign-ins, ZIP extraction and the handling of links within SFTP home directories.
More detailed FTP error replies
For self-hosted customers who automate on their FTP server, error replies for missing paths now make it clearer whether a problem is temporary or permanent. The FTP server returns the standard 550 reply for a missing file or directory, clearly identifying a permanent path error. This applies to uploads (STOR, APPE, STOU), directory listings (LIST, NLST, MLSD) and rename (RNTO), so your workflows run as planned.
Additional fixes and improvements
We’ve also made a number of quality-of-life fixes across JSCAPE, for both self-hosted and SaaS customers. See the release notes for full details.
Download JSCAPE version 2026.4 today
Download the latest version of JSCAPE to get access to all the newest enhancements.
If you aren’t currently using JSCAPE, it’s time to talk to our experts about how you can make your file transfer processes more resilient and future-proofed.
