This release includes the following enhancements.
Release date: April 28, 2026
Latest SOAtest and Virtualize release: 2026.1.3 (August 24, 2026)
Latest CTP release: 2026.1.3 (August 24, 2026)
Virtual Service Creation Using Agentic AI Workflows
You can now create virtual services directly from your LLM client, including tools like Copilot in VS Code and Claude Code, without using Virtualize Desktop. You can also create and update virtual services from agentic CLI or CI/CD workflows with tools such as Copilot CLI. Simply connect the Virtualize MCP server to your LLM client and ask it to create REST-based virtual services. Provide a service definition, request and response pairs, or even a simple description of the service, and Virtualize will generate a usable virtual service for you. After creation, the Virtualize MCP server also lets you edit or delete virtual services. See Using Parasoft Tools as an MCP Server for more information.
Note: If you are upgrading from an earlier version, you will need an updated license from Parasoft to use the new MCP functionality.
Code Coverage Reporting and Test Impact Analysis for Partial Automated Functional Test Runs
Code coverage reporting and test impact analysis (TIA) in CTP and DTP now support automated test workflows where each run includes only a subset of the full test suite. This enhancement helps teams that cannot execute all tests in a single run against one build. Previously, code coverage reporting required all tests to run against a single build, and TIA required at least one baseline build with a complete test run to identify impacted tests for later builds. Now, the data needed for code coverage and impacted test reporting can be built incrementally across multiple test runs against different builds. See Collecting Coverage for Microservices Guide for more information.
Coverage Agent Self-Registration and Enhanced Cloud Environment Support
The Java and .NET coverage agents can now self-register with CTP when they start up. This simplifies setup by allowing the required configuration to be handled as part of your build and deployment process, reducing the need for manual configuration in CTP from the web interface or REST API. This enhancement also improves support for load-balanced and cloud-based environments where coverage agents cannot be contacted directly. See Connecting CTP to Coverage Agents for more information.
Visual Regression Testing for Web Applications
You can now perform visual regression testing as part of your automated web UI testing workflow. During playback, screenshots are captured and compared to validate the full page or specific areas of the page, with any differences detected and reported. This can reduce reliance on flaky locator-based assertions and make it easier to verify both the appearance and content of your application. See Visual Regression Testing for more information.
Improved URL Path Parameter Matching in Virtualize
You can now configure URL path parameter matching in request correlation, REST URL data banks, and inline expressions using parameter names as well as parameter indices. Using parameter names makes path matching more stable, even when the deployment path of the virtual asset changes. See Message Responder Overview: Request URL Paths, Customizing Request Matching and Correlations, REST URL Data Bank, and Extracting Request Values to Populate Responses in Virtualize for more information.
Customized SQL Responder Data Storage
SQL Responders can now be configured to store recorded data in a folder of your choosing, allowing you greater customization and the ability to manage multiple teams on a shared server where each team has their own directory on the server for assets and data. See SQL Responder and JDBC Driver Configuration for more information.
Breaking Changes
- The SOAtest MCP server now requires a license that includes the new MCP Server license feature. If you are upgrading, you must obtain an updated license to continue using the MCP server.
Additional Updates
You can now constrain your GraphQL Message Responders, Clients, and Query Validators using an introspection URL instead of an SDL. See GraphQL Message Responder, GraphQL Query Validator and GraphQL Client for more information.
The AI Assistant has been updated to require explicit instructions before it will add an AI Assertor to tests it creates. You can also describe specific values for payload elements in your prompt and they will be applied as appropriate. See Creating Tests with the AI Assistant for more information.
If you use AWS, you can now authenticate requests using AWS Signature Version 4, allowing you to make AWS API requests from a TST or PVA. See Adding Global Properties for more information.
- Assertor tools and the Data Repository CRUD Tool can now be used for validation in pre-correlation inputs for virtual assets, allowing you to validate requests and respond using results from those tools.
Header details are now shown when creating message responders with the Virtualize traffic wizards, making it easier to assure that the request correlation you configure will produce the expected outcome. See Creating Parameterized Message Responders from Traffic and Creating Fixed Message Responders from Traffic for more information.
Added a new option to the Request/Response Files mode of a Message Responder to make the server keep searching for a matching responder if none of the request files match the incoming search. In addition, wildcard matches are now supported in the following parts of the request: URL path, URL query parameter, and payload. See Request Response Files for more information.
- New endpoints in the Virtualize REST API have been added to work with individual message proxy connections. These connections can also now be named.
- The throughput limitation on Message Proxies for Runtime Server has been removed.
- JDBC Driver Hybrid mode has been given robust handling when Virtualize or the original database is not available.
- When a TST is copied to a remote server, all associated dependencies are automatically detected and uploaded to the remote server alongside the TST.
Added support for including environment and test output details in the XML report from SOAtest desktop. This was previously only supported in SOAtest server. See Configuring Settings for more information
- The CTP REST API can now publish coverage results asynchronously, improving support for large volumes of coverage data.
- You can now configure the Diff tool so it won't flag a difference just because an XPath element's position/index changes in relation to the parent node (or when it "moves" relative to the parent node). See Diff Tool: Understanding XPaths for more information.
When running Load Test from the command line, you can now run it with a
-failoption to fail the command by returning a non-zero exit code if QoS metric failures or other errors are reported. See Load Test Command Line Exit Codes for a complete table of exit codes.Load Test Continuum has been updated with improved graphs that now allow you to get data for specific dates and include a threshold graph that can be toggled on and off. See Load Test Continuum for more information.
- The
defaultTransportattribute in custom message formats now supports the usage of custom transports. See Adding a Custom Message Format for more information. For the Fixed Length Client and Fixed Length Call Back tool, you can now define a field that is of variable length, so that the data model can read the last field of your message when it contains fewer characters than its defined length. See Fixed Length Client and Fixed Length Call Back for more information.
- SOAtest and Virtualize now ships with Eclipse 2026-03.
- CTP now supports Oracle AI Database 26ai.
Resolved PRs and FRs
SOAtest and Virtualize
| ID | Description |
|---|---|
| LT-1644 | Do not rewrite paths for resources that are not synchronized with remote machines |
| LT-1645 | Individual hits traffic gets recorded beyond the configured recording limit |
| SOA-15091 | Include binary BLOB content in Result Set XML as base64 instead of empty string |
| SOA-15852 | Issues when array in diff contains more elements than input |
| SOA-19243 | Data Source Payloads Containing Environment Variables No Longer Resolve |
| VIRT-8038 | REST API - log asset ID when error reading asset data |
VIRT-8070 | JDBC Driver - Hybrid mode more roboust when Virtualize is offline |
| VIRT-8076 | JDBC Driver - Hybrid mode more robust when database is offline |
| VIRT-8297 | XML Validator to not show Warning messages in the console by default |
| VIRT-8337 | CRUD Tool - unable to replace a primitive array |
CTP
| ID | Description |
|---|---|
| CTP-10637 | Unable to refresh virtual asset with unconfigured repository data source |
| CTP-10871 | Delay when editing proxy instance / any component Instance in CTP System > Environment |
Updates in 2026.1.1
SOAtest and Virtualize
Resolved FRs and PRs
| ID | Description |
|---|---|
| CVE-2026-33701 | Critical vulnerability resolved by updating opentelemetry to 2.28.1 |
| CVE-2026-39304 CVE-2026-40466 CVE-2026-41044 CVE-2026-45505 | High-severity vulnerabilities resolved by updating activemq to 5.19.7 |
| CVE-2026-41293 CVE-2026-43515 | Critical vulnerability resolved by updating tomcat to 10.1.55 |
| CVE-2026-41838 CVE-2026-41842 CVE-2026-41848 CVE-2026-41850 CVE-2026-41851 | High-severity vulnerabilities resolved by updating spring framework to 6.2.19 |
| CVE-2026-42402 CVE-2026-42403 CVE-2026-42404 | High-severity vulnerabilities resolved by updating neethi to 3.2.2 |
| CVE-2026-44930 | Critical vulnerability resolved by updating CXF to 4.1.7 |
| SOA-19368 | Data source variables no longer resolve when they are used inside another column from the same data source |
CTP
Resolved FRs and PRs
| ID | Description |
|---|---|
| CVE-2026-33701 | Critical vulnerability resolved by updating opentelemetry to 2.28.1 |
| CVE-2026-39304 CVE-2026-40466 CVE-2026-41044 CVE-2026-45505 | High-severity vulnerabilities resolved by updating activemq to 6.2.6 |
| CVE-2026-41838 CVE-2026-41842 CVE-2026-41848 CVE-2026-41850 CVE-2026-41851 | High-severity vulnerabilities resolved by updating spring framework to 6.2.19 |
| CVE-2026-42402 CVE-2026-42403 CVE-2026-42404 | High-severity vulnerabilities resolved by updating neethi to 3.2.2 |
| CVE-2026-44930 | Critical vulnerability resolved by updating CXF to 4.1.6 |
Updates in 2026.1.2
SOAtest and Virtualize
Resolved FRs and PRs
| ID | Description |
|---|---|
| CVE-2026-9563 | High-severity vulnerability resolved by updating parsson to 1.1.9 |
| CVE-2026-53917 CVE-2026-50734 | High-severity vulnerabilities resolved by updating activemq to 5.19.8 |
| CVE-2026-54512 CVE-2026-54513 | High-severity vulnerabilities resolved by updating jackson-databind to 2.21.4 |
| CVE-2026-55276 CVE-2026-53434 CVE-2026-59083 CVE-2026-59084 | Critical vulnerabilities resolved by updating tomcat to 10.1.57 |
| SOA-19300 | Infinite loop when passing dataSourceRow 1 with "Multiple data source iteration" set to "Flat (lockstep)" |
| SOA-19342 | DELETE testExecutions does not interrupt parallel test execution in the WAR |
| SOA-19415 | java.lang.NoClassDefFoundError: javax/xml/ws/http/HTTPException |
| VIRT-8474 | SOAVirt REST API - Progressive performance decreases over time when creating extensionTools |
| VIRT-8528 | JSON Sequence Responder in File mode fails Responder Correlation |
| VIRT-8529 | SQL Responders are not allowing failover |
CTP
Resolved FRs and PRs
| ID | Description |
|---|---|
| CTP-10993 | Deep-Clone when Duplicating object in TDM |
| CVE-2026-9563 | High-severity vulnerability resolved by updating parsson to 1.1.9 |
| CVE-2026-50734 CVE-2026-53917 | High-severity vulnerabilities resolved by updating activemq to 6.2.7 |
| CVE-2026-54399 CVE-2026-54428 | High-severity vulnerabilities resolved by updating httpcore to 5.4.3 |
| CVE-2026-54512 CVE-2026-54513 | High-severity vulnerabilities resolved by updating jackson-databind to 2.21.4 |
Updates in 2026.1.3
SOAtest and Virtualize
Resolved FRs and PRs
| ID | Description |
|---|---|
| CVE-2026-8763 CVE-2026-58062 | Critical vulnerabilities resolved by updating bc-fips to 2.1.3 |
| CVE-2026-54225 CVE-2026-64958 CVE-2026-65432 | High-severity vulnerabilities resolved by updating CXF to 4.1.8 |
| CVE-2026-59878 | High-severity vulnerability resolved by updating activemq to 5.19.9 |
| CVE-2026-66142 CVE-2026-66143 CVE-2026-66144 | High-severity vulnerabilities resolved by updating neethi to 3.2.3 |
CTP
Resolved FRs and PRs
| ID | Description |
|---|---|
| CVE-2026-8763 CVE-2026-58062 | Critical vulnerabilities resolved by updating bc-fips to 2.1.3 |
| CVE-2026-54225 CVE-2026-64958 CVE-2026-65432 | High-severity vulnerabilities resolved by updating CXF to 4.1.8 |
| CVE-2026-59878 | High-severity vulnerability resolved by updating activemq-client 6.2.8 |
| CVE-2026-66142 CVE-2026-66143 CVE-2026-66144 | High-severity vulnerabilities resolved by updating neethi to 3.2.3 |
