Here is the list of the new features and enhancements.

Private Access Cloud

Pattern Matching Support in Application Definition

Private application definitions now support pattern matching for host (FQDN) entries. This is useful for environments where application hostnames are dynamically generated and only partially predictable. For example, container platforms such as AWS ECS that create names like nginx.consumers.sandbox.internal-1e2cdc5, where only the middle segment (consumers.sandbox.internal) is stable. Instead of defining each host individually, administrators can define a single pattern that matches the stable portion of the name, reducing configuration overhead and keeping policy in sync as applications are created and destroyed.

Supported Operating Systems: All supported platforms

Minimum Netskope Client Version: 140.0.0 (Private Build: 139.0.0)

This is a Beta feature. Contact Netskope Support or your sales representative to enable this feature for your tenant.

Publisher

Software Version: 139.0

Supported Publisher Versions: 139.0, 138.0, and 137.0.

General Availability Date: July 16, 2026

Updated Kernel Versions

Platform	Kernel Version
OVA VHDX AMI VHD QCOW2	5.15.0-181-generic 6.8.0-1059-azure 6.5.0-1024-aws 6.8.0-1059-azure 5.15.0-181-generic

SHA Hash for Publisher Images

Image Type	SHA256
OVA	d7d603fecce0322903726f76c740451216be994282c6d7abedd64786b55ba046
VHDX	55a90afc831fac9151a6cc0e1a3540cfa3dadb0c0806c2a16ebd9cdf9aa48591
QCOW2	b2396819e17baa4ed220125d93c2182ad59dde2d92cd9616a7ccb183fe65ad24

OVA/VHDX Hosting on the Alicloud

OVA hosting on the AliCloud: https://npa-ova.oss-cn-shenzhen.aliyuncs.com/latest/NetskopePrivateAccessPublisher.ova
VHDX hosting on the AliCloud: https://npa-ova.oss-cn-shenzhen.aliyuncs.com/latest/NetskopePrivateAccessPublisher.vhdx
QCOW2 hosting on the Alicloud: https://npa-ova.oss-cn-shenzhen.aliyuncs.com/latest/NetskopePrivateAccessPublisher.qcow2

Validation of All DNS Records on Publisher

This release introduces a tenant-level option (disabled by default) to perform Publisher-first DNS validation and resolution for private applications matched by an exact FQDN policy. Previously, exact-match apps configured with use_publisher_dns: false received an immediate locally generated stub IP without resolving through the Publisher, which did not preserve the DNS answer structure (for example, CNAME chains). This could disrupt workloads that rely on DNS aliasing and canonicalization, such as Microsoft SQL AlwaysOn listeners and Kerberos/SPN flows.

When the option is enabled, QTYPE A queries for exact-match policy hits are validated and resolved via the Publisher before the client responds. The returned DNS response preserves the full DNS structure (CNAME chain and other record sets) while still enforcing ZTNA steering by rewriting A-record data to the stub IP. Wildcard matching and validation behavior are unchanged. The toggle is available in the management UI with RBAC and audit support.

The initial release covers QTYPE A queries only (AAAA/HTTPS/SVCB are not in scope). This option is disabled by default; there are no behavioral changes unless you enable it.

Local Broker

Dedicated Local Broker Hostname Per Steering Configuration

Administrators can now assign a dedicated Local Broker hostname (FQDN) to individual Traffic Steering configurations. Instead of all users resolving a single tenant-wide hostname, different user groups can be mapped to distinct LBR hostnames.

For tenants using latency-based local broker selection (GSLB), the dedicated hostname also serves as a per-steering-config DNS fallback when GSLB is unavailable.

This is a Beta feature. Contact Netskope Support or your sales representative to enable this feature for your tenant.

Netskope Private Access Release Notes Version 139.0