Here are the new features and enhancements.

Private Access Cloud

UDP Traffic Support by NPA for Android

Netskope Private Access on Android now tunnels UDP traffic to private apps, including applications defined by hostname or wildcard domain with Publisher DNS enabled, bringing Android to parity with Windows, macOS, and iOS for UDP‑based private apps such as VoIP, video conferencing, and real‑time data feeds. No configuration changes are required.

NPA AI Agent for Generating App Segments & Policies in Compliance

Use the Private Access AIOps Agent to generate narrow Application Segments and associated Real-time policies for least privileged access.

NPA AI Agent for App Audit in Netskope Console in Compliance

Use the Private Access AIOps Agent to audit and get recommendations for existing Application Segments within the tenant. The AIOps Agent’s audit tasks include:

Replacing broad network destinations and wildcard domains with narrower IP subnets or precise IP destinations and FQDNs in existing application definitions.
Identifying and removing unused destinations and ports.

NPA Traffic Filtering Enhancement in Client

Reduces the number of Private Access steering rules pushed to the macOS kernel by aggregating private (RFC-1918) app IPs into a few coarse subnet rules, with final steering decisions made in the Client. Improves stability and startup time for tenants with many private apps.

Skope IT > Private App Segments NGWeb Migration

The Skope IT > Private App Segments page has been migrated to the Next Gen UI, adhering to the latest UX standards based on UX research feedback and for a better user experience.

Publisher

Software Version: 142.0

Supported Publisher Versions: 142.0, 140.0, and 139.0.

General Availability Date: October 13, 2026

Updated Kernel Versions

Platform	Kernel Version
OVA VHDX AMI VHD QCOW2	5.15.0-194-generic 6.8.0-1068-azure 6.5.0-1024-aws 6.8.0-1068-azure 5.15.0-194-generic

SHA Hash for Publisher Images

Image Type	SHA256
OVA	a1bddec881505c6f231a25aaec7984cccee0cdd91645f61bd6ea2abb58be6510
VHDX	4ff6a56c2be1260da7b3f5d526d0bcbe8c0a591e14cd29f500fe3bc8142a115c
QCOW2	4db949d3d65036d3423a4bb409e0bffcb0d40fc74c90b079a41b605b21f0559b

OVA/VHDX Hosting on the Alicloud

OVA hosting on the AliCloud: https://npa-ova.oss-cn-shenzhen.aliyuncs.com/latest/NetskopePrivateAccessPublisher.ova
VHDX hosting on the AliCloud: https://npa-ova.oss-cn-shenzhen.aliyuncs.com/latest/NetskopePrivateAccessPublisher.vhdx
QCOW2 hosting on the Alicloud: https://npa-ova.oss-cn-shenzhen.aliyuncs.com/latest/NetskopePrivateAccessPublisher.qcow2

Secure Private Artifact Repository for NPA Publishers

Netskope Private Access (NPA) Publishers can now retrieve operating system packages and container images directly from authenticated, Netskope-controlled repository endpoints rather than public Ubuntu repositories and Docker Hub.

Key Highlights:

Enhanced Supply Chain Security: All packages and container images are cryptographically signed and verified by Netskope before installation or execution.
Restricted Egress & Tighter Firewall Rules: Consolidates outbound access from broad public registries to dedicated Netskope endpoints, ideal for highly regulated environments.
Zero-Touch Credential Management: Netskope automatically handles repository credentials and key rotation with no manual token configuration needed on Publishers.
Improved Reliability & Governance: Eliminates dependency on public mirror availability and rate limits while giving Netskope fine-grained control over artifact distribution.

For setup guidance and details, see the Secure Private Artifact Repository for Publishers Documentation.

Publisher-first DNS Validation for Exact-Match NPA Policies

You can now enable Publisher-first DNS validation for exact-match Netskope Private Access (NPA) policies, preserving DNS answer structure (such as CNAME chains) while maintaining Zero Trust Network Access steering. When enabled via a tenant-level toggle in the management web UI, DNS queries for all applications configured with use_publisher_dns: false are validated and resolved by the Publisher before the NS Client responds with the stub IP, ensuring that workloads relying on DNS aliasing, such as Microsoft SQL clusters with listener names or Kerberos-based authentication flows, continue to function correctly. This feature is off by default and extends the behavior for wildcard policy paths to all applications.

Important to note:

Enabling this toggle applies the wildcard-app validation policy to all applications, ensuring we can maintain intermediate records such as CNAME’s in the response, when enabled only the original host needs to be configured and not the intermediate CNAME records.
A records in the DNS response are rewritten to the NPA stub IP to enforce ZTNA steering; internal IP addresses are not exposed to endpoints.

Netskope Private Access Release Notes Version 142.0