> ## Documentation Index
> Fetch the complete documentation index at: https://bloodhound.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# 2026-10-26 Release Notes

> Learn about new features, enhancements, and fixed issues in BloodHound.

> [!TIP]
>
> Use the filters on the right side of this page to narrow down the updates by component. You can select multiple filters at the same time to refine your results.

| | | | | |
| - | - | - | - | - |
| **Release** | **BloodHound** | **OpenHound** | **SharpHound** | **AzureHound** |
| 2026-10-26 | v9.9.0 | No release | v2.17.1 | No release |

> [!WARNING]
>
> BloodHound Enterprise will soon ingest collector property values exactly as collectors send them instead of normalizing values during ingest. Older AzureHound and OpenHound versions depend on server-side normalization and can create duplicate nodes or identity mismatches when this change is enabled.
>
> Upgrade to AzureHound v3.1.0 or later and OpenHound v0.3.0 or later to keep data collection compatible with future versions of BloodHound Enterprise.

**BloodHound**

New Feature

## Extension bundles

An extension bundle packages an OpenGraph extension's schema with supported components, such as saved queries and Privilege Zone rules.

Administrators can install an extension with a single file and have all the necessary components put in the correct place for a streamlined installation experience.

* **Administrators:** Upload a bundle to [install an extension](https://bloodhound.specterops.io/opengraph/extensions/manage.md) and its supported components together.
* **Users:** Explore extension data using its [saved queries](https://bloodhound.specterops.io/analyze-data/explore/cypher-search/search) and apply its Privilege Zone [rules](https://bloodhound.specterops.io/analyze-data/privilege-zones/rules.md).
* **Extension developers:** Learn how to [package](https://bloodhound.specterops.io/opengraph/developer/extension-bundles.md) an extension's schema and supported components for administrators to install together.

**SharpHound**

Enhancement

## Collect Azure VM IDs from Windows computers

Correlate domain-joined Windows computers with their [Azure VM identity](https://bloodhound.specterops.io/collect-data/sharphound-data-permissions.md#azure-vm-identity) using the Azure guest VM ID (`VmId`).

When [`AzureRegistry`](https://bloodhound.specterops.io/collect-data/ce-collection/sharphound-flags) collection is enabled, SharpHound reads the ID from domain-joined Windows computers and stores it in the Active Directory computer's `azvmid` property.

**BloodHound**

Enhancement

## Faster object searches

The [`/api/v2/search`](https://bloodhound.specterops.io/reference/search/search-for-objects) endpoint now matches `objectid` values exactly, including uppercase and lowercase variants, while name searches remain fuzzy.

It passes the requested result limit to the graph database for domain lookups and honors the limit when results are filtered by [Environment Targeted Access Control (ETAC)](https://bloodhound.specterops.io/manage-bloodhound/auth/environment-targeted-access-control.md).

These changes improve search performance, especially on the **Explore** page, and reduce unnecessary work on large result sets.

**BloodHound**

Enhancement

## Accurate audit log counts for date ranges

The [`/api/v2/audit`](https://bloodhound.specterops.io/reference/audit/list-audit-logs) endpoint now applies the requested date range (including its documented 365-day default) to both the returned events and the `count`, so pagination totals match the results.

> [!NOTE]
>
> It also returns HTTP 400 when the `after` value is later than the `before` value.

**BloodHound**

Enhancement

## Distinguish non-traversable graph edges

Easily distinguish between [traversable and non-traversable](https://bloodhound.specterops.io/resources/edges/traversable-edges.md) edges in the graph.

The graph on the **Explore** page now uses dashed lines for non-traversable edges, making it easier to distinguish them from edges that can be traversed.

**BloodHound**

Enhancement

## Additional PostgreSQL storage optimization

The **Optimize** stage of the [data pipeline](https://bloodhound.specterops.io/analyze-data/findings/analysis.md#when-analysis-runs) now includes additional PostgreSQL storage optimization steps.

These steps help reclaim index bloat and keep graph query performance consistent over time.

**BloodHound**

Enhancement

## Analysis performance improvements

All [post-processed](https://bloodhound.specterops.io/analyze-data/findings/analysis.md#show-post-processed-edges) edges now use optimized processing logic, significantly reducing time in analysis and improving overall performance.

Post-processed edges no longer display the **Last Seen by BloodHound** field in Entity panels.

**BloodHound**

Enhancement

![Applies to BloodHound Enterprise only](https://mintcdn.com/specterops/tTIczgde9H07oLXf/assets/enterprise-edition-pill-tag.svg?fit=max\&auto=format\&n=tTIczgde9H07oLXf\&q=85\&s=b682a26b342bde12302ec829e265bdb6)

## Control graph direction and spacing

Choose whether the graph on the **Explore** page flows left, right, up, or down, and adjust horizontal and vertical spacing.

These [new controls](https://bloodhound.specterops.io/analyze-data/explore/graph-controls.md#graph-direction) help you arrange complex graphs so their relationships are easier to inspect.

**BloodHound**

Enhancement

![Applies to BloodHound Enterprise only](https://mintcdn.com/specterops/tTIczgde9H07oLXf/assets/enterprise-edition-pill-tag.svg?fit=max\&auto=format\&n=tTIczgde9H07oLXf\&q=85\&s=b682a26b342bde12302ec829e265bdb6)

## Findings Prioritization improvements

[Findings Prioritization](https://bloodhound.specterops.io/analyze-data/findings/table-view.md#prioritize-findings) now considers proximity to Tier Zero alongside exposure, impact, and starting objects. Findings targeting objects in or near Tier Zero receive a stronger priority signal, helping you identify larger remediation opportunities.

During analysis, BloodHound Enterprise uses a synthetic [Zone](https://bloodhound.specterops.io/resources/nodes/zone.md) node to calculate the shortest traversable path from each finding's target to Tier Zero. Findings without a path to Tier Zero (or with a path beyond the maximum traversal depth) use a maximum-hop fallback and are de-prioritized.

**BloodHound**

Enhancement

![Applies to BloodHound Enterprise only](https://mintcdn.com/specterops/tTIczgde9H07oLXf/assets/enterprise-edition-pill-tag.svg?fit=max\&auto=format\&n=tTIczgde9H07oLXf\&q=85\&s=b682a26b342bde12302ec829e265bdb6)

## Export Findings Table results

[Export findings](https://bloodhound.specterops.io/analyze-data/findings/table-view.md#export-findings) to a CSV file, including all findings that match the current filters and sort order (up to 200,000 findings).

> [!NOTE]
>
> When **Findings Prioritization** is enabled, the export also includes the prioritization score and rank.

**BloodHound**

Enhancement

![Applies to BloodHound Enterprise only](https://mintcdn.com/specterops/tTIczgde9H07oLXf/assets/enterprise-edition-pill-tag.svg?fit=max\&auto=format\&n=tTIczgde9H07oLXf\&q=85\&s=b682a26b342bde12302ec829e265bdb6)

## Identify new findings

The [Findings Table](https://bloodhound.specterops.io/analyze-data/findings/table-view.md#identify-new-findings) marks findings added in the past 24 hours with a New badge, helping you spot recently surfaced results during triage.

**BloodHound**

Enhancement

![Applies to BloodHound Enterprise only](https://mintcdn.com/specterops/tTIczgde9H07oLXf/assets/enterprise-edition-pill-tag.svg?fit=max\&auto=format\&n=tTIczgde9H07oLXf\&q=85\&s=b682a26b342bde12302ec829e265bdb6)

## Faster ingest reconciliation

Updated the node-table trigger that cascade-deletes edges connected to a deleted node to use index scans instead of table scans.

This reduces database work during ingest reconciliation and helps maintain ingest throughput.

## Fixed issues

**BloodHound**

## Search and performance

*  Resolved an issue where a second `OPTIONAL MATCH` clause could be treated as required, causing Cypher queries to omit expected results.

*  Resolved an issue where parallel graph path processing could corrupt path segment sizes.

## Findings Table

![Applies to BloodHound Enterprise only](https://mintcdn.com/specterops/tTIczgde9H07oLXf/assets/enterprise-edition-pill-tag.svg?fit=max\&auto=format\&n=tTIczgde9H07oLXf\&q=85\&s=b682a26b342bde12302ec829e265bdb6)

*  Resolved an issue where finding types with only remediated findings were missing from the filter options.

*  Resolved an issue where findings filter dropdown text and hover styling appeared incorrectly in light mode and the cell hover effect was missing in dark mode.