diff --git a/docs/docs.json b/docs/docs.json
index 43a2111f..fa9bf602 100644
--- a/docs/docs.json
+++ b/docs/docs.json
@@ -916,14 +916,15 @@
"group": "Release Notes",
"pages": [
"resources/release-notes/summary",
+ "resources/release-notes/2026-07-28",
"resources/release-notes/2026-07-07",
- "resources/release-notes/2026-06-17",
{
"group": "Archive",
"pages": [
{
"group": "2026",
"pages": [
+ "resources/release-notes/2026-06-17",
"resources/release-notes/2026-05-28",
"resources/release-notes/2026-05-06",
"resources/release-notes/2026-04-13",
diff --git a/docs/resources/release-notes/2026-07-28.mdx b/docs/resources/release-notes/2026-07-28.mdx
new file mode 100644
index 00000000..aa3034bd
--- /dev/null
+++ b/docs/resources/release-notes/2026-07-28.mdx
@@ -0,0 +1,184 @@
+---
+title: 2026-07-28 Release Notes
+description: Learn about new features, enhancements, and fixed issues in BloodHound.
+sidebarTitle: "2026-07-28"
+---
+
+import FeatureFlagNote from '/snippets/feature-flag.mdx';
+
+| | | | | |
+| --- | --- | --- | --- | --- |
+| **Release** | **BloodHound** | **OpenHound** | **SharpHound** | **AzureHound** |
+| 2026-07-28 | v9.5.0 | v0.2.12 | v2.14.0 | v3.0.0 |
+
+
+ Use the filters on the right side of this page to narrow down the updates by component. You can select multiple filters at the same time to refine your results.
+
+
+
+ {/*BED-6155*/}
+ ## Analyze ADCS ESC14 Scenario A attack paths
+
+ BloodHound now models ADCS ESC14 Scenario A attack paths, helping you identify explicit certificate-mapping abuse paths that rely on `altSecurityIdentities`.
+
+ In ESC14 Scenario A, an attacker who can modify a target principal's `altSecurityIdentities` attribute, or who has equivalent control through the `Public-Information` property set, can add an explicit certificate mapping that points to a certificate they control and authenticate as the target.
+
+ This release adds graph coverage for the following edges:
+
+ - [`WriteAltSecurityIdentities`](/resources/edges/write-alt-security-identities)
+ - [`WritePublicInformation`](/resources/edges/write-public-information)
+
+
+ This requires upgrading to SharpHound v2.14.0 to collect the new edges.
+
+
+
+
+ {/*BED-8858, BED-8764, BED-8763, BED-8762, BED-8613, BED-8961*/}
+ ## OpenGraph Entity Info
+
+ Provide richer OpenGraph entity details by defining markdown-based information for node and relationship kinds.
+
+ OpenGraph extensions can now define [custom entity panel content](/opengraph/developer/graph-definition#custom-entity-panel-content) for node and relationship kinds, including:
+
+ - Accordion sections
+ - Section titles
+ - Markdown content
+ - Display order
+
+ These schema-level definitions let extension authors publish reusable context once and apply it across matching nodes or relationships without storing duplicate information on each entity.
+
+ BloodHound can return extension-authored entity information from the OpenGraph entity lookup APIs when `include-info=true`, allowing the UI and integrations to render curated context instead of relying only on raw property lists. This release establishes the framework for custom entity panel accordion content and supports deep links to sections within OpenGraph-defined entity panels.
+
+ Related API reference:
+
+ - [`PUT /api/v2/extensions`](/reference/opengraph-experimental/upserts-the-opengraph-extension)
+ - [`GET /api/v2/nodes/{node_id}`](/reference/opengraph-experimental/get-node-by-graph-node-id)
+ - [`GET /api/v2/relationships/{relationship_id}`](/reference/opengraph-experimental/get-relationship-by-graph-relationship-id)
+
+
+
+ {/*BED-8616, BED-8614, BED-8611, BED-8610, BED-8607, BED-8685, BED-9031*/}
+ ## OpenGraph Data Quality Statistics
+
+ Validate uploaded OpenGraph data without writing custom Cypher queries by reviewing node-count statistics on the **Data Quality** page.
+
+ BloodHound now expands data quality statistics beyond the existing Active Directory and Azure/Entra ID views to include OpenGraph environments. You can review object-type breakdowns for data from SpecterOps-supported extensions (such as GitHub, Jamf, and Okta), as well as community and custom extensions.
+
+ BloodHound also stores OpenGraph data quality statistics after analysis, exposes environment and aggregate statistics through API endpoints, and returns OpenGraph environment kind metadata from the environment selector API so Data Quality workflows can distinguish environments more clearly.
+
+
+
+ Related API reference:
+
+ - [`GET /api/v2/data-quality-stats`](/reference/data-quality/get-environment-specific-data-quality-stats)
+ - [`GET /api/v2/data-quality-stats-aggregations`](/reference/data-quality/get-data-quality-aggregations-by-environment-kind)
+ - [`GET /api/v2/available-domains`](/reference/search/get-available-domains)
+
+
+
+ {/*BED-8939, BED-8943, BED-8968, BED-8944, BED-9020*/}
+ ## Case-Sensitive OpenGraph Object IDs
+
+ Preserve distinct OpenGraph objects whose `objectid` values differ only by case while keeping Active Directory and Microsoft Entra ID ingest behavior case-insensitive.
+
+
+
+ BloodHound can now store OpenGraph object IDs exactly as supplied by an extension. The latest versions of SharpHound and AzureHound now send all Active Directory and Microsoft Entra ID object IDs as fully uppercased values, which ensures consistent data as BloodHound removes server-side object ID normalization.
+
+
+
+ {/*BED-7221, BED-8275, BED-7787, BED-8950*/}
+ ## Accessibility and Contrast Improvements
+
+ Navigate BloodHound with improved contrast, clearer focus states, and visual indicators that do not rely on color alone.
+
+ This release improves color and non-text contrast across key UI surfaces, updates the Data Quality chart palette, and makes Attack Path timeline graphs easier to interpret for users with low vision or color vision deficiencies.
+
+
+
+ {/*BED-8838*/}
+ ## Separate OpenHound Configuration and Secrets
+
+ 
+
+ Store the BloodHound Enterprise destination URL as [configuration](/openhound/configuration) instead of a secret when you set up scheduled OpenHound collectors.
+
+ OpenHound now reads `destination.bloodhoundenterprise.url` through DLT configuration, so you can define the tenant URL in `config.toml`, an environment variable, or Helm values while keeping `token_id` and `token_key` in `secrets.toml`.
+
+ The sample Docker Compose, Helm, and collector configuration files now follow this split and remove the stale Helm `interval` example.
+
+
+ This is a non-breaking change. Existing collector secrets files that still define `destination.bloodhoundenterprise.url` continue to work because DLT configuration lookup can read the value from `secrets.toml`.
+
+
+
+
+ {/*BED-7937*/}
+ ## Upload-Only Role Access Enforcement
+
+
+
+ Prevent users with the **Upload-only** role from accessing analysis pages that are outside their role permissions.
+
+ BloodHound Enterprise now blocks upload-only users from the **Posture** and **Attack Paths** pages.
+
+
+
+ {/*BED-8587*/}
+ ## Auditor SSO Configuration Access
+
+
+
+ Allow users with the **Auditor** role to review SSO provider configuration without granting provider management permissions.
+
+ Auditors can now view the **SSO Configuration** page in a read-only state while create and management actions remain restricted to users with the **Admin** role.
+
+
+
+ {/*BED-8728*/}
+ ## Attack Path Findings API Availability
+
+
+
+ BloodHound Enterprise now exposes the [`GET /api/v2/attack-paths/findings`](/reference/attack-paths/list-attack-path-findings) endpoint so API clients can retrieve a unified, paginated list of Attack Path findings.
+
+
+
+ {/*BED-8830, BED-8828, BED-8773, BED-8772, BED-8259, BED-7760*/}
+ ## Privilege Zone Review Improvements
+
+
+
+ Review Privilege Zone certifications and rules with clearer table behavior, more usable layouts, and better validation feedback.
+
+ BloodHound now lets you fully close the certification entity panel area, improves certification table sizing and result-count terminology, makes kind-count summaries easier to read, and shows a clear error when an object ID-based rule contains an invalid object ID.
+
+
+
+ ## API and Access Control
+
+ - {/*BED-8970*/} Added missing authorization checks to the `/api/v2/custom-nodes` API endpoint.
+ - {/*BED-8945*/} Added Environment Targeted Access Control checks to the OpenGraph node and relationship lookup APIs so restricted users cannot access graph entity data outside their allowed environments.
+ - {/*BED-8998*/} Resolved an issue where parameter input fields in the API Explorer could render too small or hide typed values.
+
+ ## Explore
+
+ - {/*BED-8026*/} Resolved an issue where selecting a node with an `id` property from the table layout on the **Explore** page failed to load object information in the entity panel.
+ - {/*BED-8138*/} Removed extra whitespace from graph node labels so selected nodes are centered more consistently.
+
+ ## Development
+
+ {/*BED-8971*/} Resolved an issue where UI source code changes in Docker Compose development stacks were not reflected in the browser without restarting containers.
+
+ ## Zone Builder
+
+
+
+ - {/*BED-8771*/} Resolved an issue on the **Certifications** page where select input borders could appear clipped in the **Additional Filters** modal.
+ - {/*BED-8766*/} Fixed an issue where the **Summary** view displayed object counts for a previously selected environment because the object count request retained the `environmentId` parameter from the **Details** view.
+
+
+
+ {/*BED-8837*/} Resolved an issue where running `scheduler.py` from the command line could produce a logging error on Windows operating systems.
+
diff --git a/docs/resources/release-notes/summary.mdx b/docs/resources/release-notes/summary.mdx
index 59e0887e..b8f76b2d 100644
--- a/docs/resources/release-notes/summary.mdx
+++ b/docs/resources/release-notes/summary.mdx
@@ -20,6 +20,43 @@ SpecterOps is heading to Black Hat USA 2026 with training courses, technical bri
We're excited to share that SO-CON talks are now available [online](https://ghst.ly/SOCON26YT). We've also published the presentation slide decks in a public [GitHub repository](https://github.com/SpecterOps/presentations/tree/main/SO-CON%202026).
+## 2026-07-28
+
+| | | | | |
+| --- | --- | --- | --- | --- |
+| **Release** | **BloodHound** | **OpenHound** | **SharpHound** | **AzureHound** |
+| 2026-07-28 | v9.5.0 | v0.2.12 | v2.14.0 | v3.0.0 |
+
+This release expands OpenGraph development and analysis workflows, adds ADCS ESC14 Scenario A coverage, and improves collector configuration. Key highlights include:
+
+- **OpenGraph**: Define and retrieve markdown-based entity information for node and relationship kinds.
+- **ADCS**: Identify new certificate-mapping takeover paths with `WriteAltSecurityIdentities` and `WritePublicInformation`.
+- **Data Quality**: Review OpenGraph environment statistics and extension-level aggregate counts.
+
+### New Features
+
+| Component | Update | Summary |
+| --- | --- | --- |
+| Data Collection | [Analyze ADCS ESC14 Scenario A attack paths](/resources/release-notes/2026-07-28#analyze-adcs-esc14-scenario-a-attack-paths) | Identify certificate-mapping takeover paths involving write access to `altSecurityIdentities` or the Public-Information property set. |
+| OpenGraph | [OpenGraph Entity Info](/resources/release-notes/2026-07-28#opengraph-entity-info) | Define and retrieve markdown-based context for OpenGraph node and relationship kinds. |
+
+### Enhancements
+
+| Component | Update | Summary |
+| --- | --- | --- |
+| OpenGraph | [OpenGraph Data Quality Statistics](/resources/release-notes/2026-07-28#opengraph-data-quality-statistics) | Review node-count statistics for OpenGraph environments and aggregate counts across extension kinds. |
+| Data Collection | [Case-Sensitive OpenGraph Object IDs](/resources/release-notes/2026-07-28#case-sensitive-opengraph-object-ids) | Preserve distinct OpenGraph objects whose `objectid` values differ only by case while keeping AD and Entra ID ingest behavior case-insensitive. |
+| Accessibility | [Accessibility and Contrast Improvements](/resources/release-notes/2026-07-28#accessibility-and-contrast-improvements) | Navigate BloodHound with improved contrast, clearer focus states, and indicators that do not rely on color alone. |
+| Administration | [Separate OpenHound Configuration and Secrets](/resources/release-notes/2026-07-28#separate-openhound-configuration-and-secrets) | Define the BloodHound Enterprise destination URL as configuration while keeping collector credentials in secrets files. |
+| Administration | [Upload-Only Role Access Enforcement](/resources/release-notes/2026-07-28#upload-only-role-access-enforcement) | Prevent upload-only users from accessing analysis pages outside their role permissions. |
+| Administration | [Auditor SSO Configuration Access](/resources/release-notes/2026-07-28#auditor-sso-configuration-access) | Allow auditors to review SSO provider configuration without granting provider management permissions. |
+| API | [Attack Path Findings API Availability](/resources/release-notes/2026-07-28#attack-path-findings-api-availability) | Retrieve unified, paginated Attack Path findings without enabling an early-access feature flag. |
+| Zone Builder | [Privilege Zone Review Improvements](/resources/release-notes/2026-07-28#privilege-zone-review-improvements) | Review certifications and rules with clearer table behavior, more usable layouts, and better validation feedback. |
+
+### Fixed Issues
+
+See the [release notes](/resources/release-notes/2026-07-28#api-and-access-control) for a full list of fixed issues in this release.
+
## 2026-07-07
| | | | | |