Unlock enhanced API scanning with Burp Suite

Summary: PortSwigger released four built-in API scanning features for Burp Suite Professional and Enterprise Edition, letting users upload OAS definition files directly, check for exposed hosted OAS definitions, add HTTP headers when crawling APIs, and scan APIs that require authentication. The company cites an ESG report finding organizations average 26 APIs per application, and says API endpoints had previously been scanned only as part of a wider web application crawl and audit.
Why it matters: With an average of 26 APIs per application, AppSec teams that scan APIs only inside a full web app crawl run slower, less targeted scans - and Burp's new check for exposed hosted OAS definitions flags a way attackers can reach your API surface directly.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026