Skip to main content

26.9.0 - Sep 25

Released: 2026-09-25

We're happy to announce the immediate release of Forward Enterprise version 26.9.0.

What's New 🚀​

Predict​

Predict is now generally available​

Forward Enterprise Predict is generally available in 26.9.0. Predict lets you model the impact of configuration changes in a digital twin before you apply them in production, so intent violations, connectivity breaks, and routing regressions can be caught ahead of a change window rather than after.

To learn more, see Predict.

Forward AI​

Model Context Protocol (MCP) server​

Forward Enterprise now exposes a Model Context Protocol (MCP) server, so AI assistants and agents can query the digital twin through a standard interface. The server is served at /api/mcp and is enabled by default for both SaaS and self-hosted deployments. On self-hosted deployments, an admin can turn it off with the Enable MCP server toggle in Org preferences; on SaaS, contact Forward support.

The tools list is filtered by license entitlements, so an organization only sees the tools it can actually use. Every tool call is authorized against the calling user's network-level permissions, and calls that the user is not entitled to make are rejected. MCP calls are subject to the same rate limits as direct API calls. Authentication currently uses basic auth; OAuth is not yet supported.

To learn more, see MCP Server.

Unified NQE Assist experience​

NQE Assist in the NQE Library is now unified into the Forward AI experience. Previously you had to switch tabs to choose between generating a query and searching documentation, the intent had to be specified manually, and the assistant did not carry the context of the full conversation.

With the 26.9 release the generate and documentation capabilities are now integrated into Forward AI.

You open it from the Forward AI icon on the NQE Library page, with the network and snapshot pre-selected and changeable. A documentation question returns a summary along with a list of sources; a request to build a query generates one you can execute inline and view the results for; and an out-of-scope prompt is declined gracefully with a reason. Starting a new conversation, viewing conversation history, and opening a new Forward AI panel are all supported.

Follow-up prompt suggestions​

Forward AI now generates follow-up prompt suggestions after a response is complete rather than while it is being produced, which reduces the time it takes to display an answer.

Security & Compliance​

  • Config-based CVE analysis for Citrix NetScaler: configuration-based vulnerability analysis is now supported for Citrix NetScaler.
  • OS-based CVE analysis for Juniper Mist access points: OS-based vulnerability analysis now covers Juniper Mist APs.
  • Expanded end-of-life coverage: software end-of-life support is added for Juniper SRX, and hardware and software end-of-life support is added for the Cisco C91 series of access points.

Topology​

Network Maps folder structure​

Network Maps now support a folder structure, matching the methods already available for intent checks and the NQE Library. You can create directories, move maps between them, duplicate a map within its parent directory, remove directories, and search for a map or directory by name. Pinned maps stay at the top of the page, and pinned maps within a directory stay near the top of that directory. Managing directories requires the network operator role, and there are no directory-level access controls.

Create a network map from a location topology​

You can now create a network map directly from a location topology using a quick action in the top-right corner. The map preserves the layout you curated for the location, so you can start annotating immediately instead of rebuilding the layout. The export-as-image action is next to this action.

Dashboards​

NQE-based dashboard panels​

Custom dashboards can now include panels built directly from NQE queries. A new Manage Panel Library view lists every available panel, separates the predefined panels from users' custom ones, and organizes panels and scorecards separately.

Panels support two visualization types:

  • A tabular panel lets you choose which columns to display, hide the ones you do not need, and reorder them by drag and drop.
  • A metric panel lets you pick a column and a calculation such as average or count, set the numeric precision and an optional unit, and apply threshold-based coloring so a value renders as good, warning, or critical. You can create a panel inline on a dashboard or in the library.

Editing a panel from a dashboard applies only to that dashboard through overrides, while editing it in the library updates the shared definition, and a single override can be restored to the library value at any time.

Integrations​

Splunk integration​

Forward Enterprise adds a native Splunk integration, so the data it collects from the network and the insights it generates land in the operational hub many enterprises already run and admins can keep their observability data in one place.

The integration pushes intent verification check results, NQE check results, and raw NQE query data to Splunk automatically on every network collection, with no manual step. You can send all results or only failures; when only failures are selected, a check is sent only when it transitions from pass to fail or is newly introduced, not repeatedly while it stays failed. Configuration uses a HEC token with a built-in connectivity test, targets a specific index or the default, and lets you choose which fields to include or exclude, for example omitting serial numbers. You can preview the exact payload in table or JSON form before pushing, review a full history of pushes, and download any pushed payload. Profiles can be disabled to pause automatic pushes while preserving their configuration.

Collection & Platform Updates​

Collector observability​

Collectors now report their own health and utilization, so customers can now easily know when a collector has high CPU usage, low memory, or low disk space.

The collector page shows CPU, memory including heap, and disk usage, with 30 days of history for every online collector. Periods of high CPU, high memory, or low disk are tagged on the charts, and alerts from the last 24 hours are surfaced on the page. A collector tasks view shows concurrency and thread-pool usage, in-progress task counts, and queue sizes over time. You can now enable and disable SSH debug logging and download thread dumps directly from the UI, both of which previously required the CLI or API.

NQE Analysis​

NQE Library quality-of-life improvements​

This release adds several quality-of-life improvements to the NQE Library and NQE:

  • Collapse all and expand all: collapse or expand the entire library tree in one click, which makes navigating a large library with many open directories much faster.
  • Search results tree view: search hits can now be viewed in the library's tree structure instead of only a flat list, so you can see where matches live and jump straight to them.
  • Hidden whitespace indicator: cells whose value contains non-visible whitespace, such as leading or trailing spaces, tabs, or newlines, now show an information icon. Two values that look identical but do not match are easy to spot, and hovering the icon reveals the exact value so you can copy it.

Network Setup​

Redesigned network creation and onboarding​

Creating a new network now uses the redesigned onboarding wizard instead of the older multi-step flow. The steps are the same but simplified: name the network, install a new collector or choose an existing one, and select devices from the same list already used for free trials. The guided onboarding flow, previously reserved for the first network, is now reused for every network, populated with the devices you selected.

Seed discovery is now available in the new onboarding flow for networks beyond the first. Device discovery can be stopped and restarted for both seed discovery and subnet scan, and a review table of discovered devices is presented so you can choose which to add as sources.

Modeling​

  • vCenter and controller inventory devices: Forward Enterprise now creates inventory devices for vCenter and for SD-WAN controllers and orchestrators, so they appear in inventory with details such as software version. This lays the groundwork for vulnerability and end-of-life analysis on these devices in future releases.