These are the new features and enhancements with NPA:

Private Access Cloud

NPA Source IP Egress Criteria for Client

Private Access now supports source IP (Egress IP) as a criteria in policy for NPA applications steered via the Client access method.

Mixed Content Private Apps

We’re improving Enterprise Browser support for Private Apps to handle pages that mix secure and insecure content. This update helps internal apps load fully and safely without requiring customers to rework legacy components.
Summary.

Improved reliability: Pages with mixed content now render consistently in Enterprise Browser.
Admin-friendly: Simple per-app control in Private App settings.
Security by default: Insecure resources are upgraded to secure requests when possible.

Key Changes

Simple enablement: Controlled via Private App settings; no major architecture changes required.

Periodic Authentication for Real-time Policy Framework

Netskope Private Access introduces a new feature for Per-App Authentication as part of Real-Time policy controls (Learn more). Customers can now define authentication requirements based on a wide range of source and destination criteria and configure the appropriate timer. Whenever a user tries to access, the user will receive a customizable End-User Notification and afterwards be requested to authenticate or re-authenticate (Learn more). We recommended you use Per-App Authentication or Device Level Re-authentication, instead of both.

Supported minimum Client version: 131.0.0

Updated the NPA Tunnel Re-auth Behavior

If NPA re-authentication is triggered when Windows Desktop is in hibernate mode (AOAC support), users had to refresh a authentication window with a session expired error on wake-up. Netskope Private Access is now aware of system status and ensures a clean refreshed authentication is started on wake up.

Supported minimum Client version: 133.0.0

NPA Data Plane Publisher Gateway (Stitcher) Performance Improvements

Improved the Netskope NPA Data Plane Publisher Gateway (Stitcher) to process faster and scale better for high-demand workloads, increasing overall performance.

Since R133, this improvement has been rolled out to specific Data Planes and will extend to all Data Planes in upcoming releases.

Publisher

Software Version: 133.0

Supported Publisher Versions: 133.0, 132.0, and 131.0.

General Availability Date: December 10, 2025

Updated Kernel Versions

Platform	Kernel Version
OVA VHDX AMI VHD	5.15.0-161-generic 6.8.0-1041-azure 6.5.0-1024-aws 6.8.0-1041-azure

SHA Hash for Publisher Images

Image Type	SHA256
OVA	5b6938ae609327c4b86bfb0d676dc82331e21321b4c39951116d6052fde7ecac
VHDX	dd34595dd0afcaa88f69f75db33ad67d1626c8ee577ec08ec831d15d1b14acb3

OVA/VHDX Hosting on the Alicloud

OVA hosting on the AliCloud: https://npa-ova.oss-cn-shenzhen.aliyuncs.com/latest/NetskopePrivateAccessPublisher.ova
VHDX hosting on the AliCloud: https://npa-ova.oss-cn-shenzhen.aliyuncs.com/latest/NetskopePrivateAccessPublisher.vhdx

Enhanced Publisher bind9 Settings

This change improved container stability by retrying to retrieve the DNS servers from /etc/hosts on the host OS.

Local Broker

Software Version: 133.0

Supported Local Broker Versions: 133.0 and 131.0.

General Availability Date: December 16, 2025

Restrict Local Broker Name Change

Starting with release R133, the tenant user interface restricts changes to the Local Broker name after the initial configuration save.

POP Name in Network Events

Prior to this release, Network Events generated from a Local Broker did not show the pop_name. With this enhancement, all Network Events generated from a Local Broker will show the pop_name as a keyword prefixed to the Local Broker name.

Netskope Private Access Release Notes Version 133.0