TLS 1.3

TLS Certificate Lifetime Reduction

What is Changing

Webhook URL
(required)
OAuth URL
(if applicable)
Health Check URL
(if applicable)

PENDING_REVIEW
BLOCKED

Status Descriptions

How the New Process Works

A webhook subscription is created or updated.
Submitted URLs are checked against existing approval records.
New or unknown URLs are evaluated through automated validation.
If additional review is required, the subscription status changes to
PENDING_REVIEW
.
If any URL is rejected or blocked, the subscription status changes to
BLOCKED
.
If all required URLs are approved, the subscription status changes to
INACTIVE
.

Impact on Existing Subscriptions

Existing subscription URLs will be assessed using the new validation framework.
URLs that require additional security review might change the status of the subscription to
PENDING_REVIEW
.
If any existing URL is identified as blocked, the associated subscription status will be updated to
BLOCKED
.

Review the affected endpoint(s).
Update the URL(s) to an acceptable endpoint.
Resubmit the subscription for processing.

For New Subscriptions

For Existing Subscriptions

If Your Subscription Is Marked BLOCKED

Why We Are Making this Change

Reduce security risk
by preventing outbound calls to unapproved endpoints.
Improve compliance
through stronger review and approval controls.
Increase transparency
with clearer client-visible statuses.
Support scale
through a standardized and repeatable validation process.

Overview of MLE

JSON Web Token Construction Update

HTTP Messaging Migration to JWT Messaging

Merchant Descriptior Name

| RM-44633

Description

Cybersource is updating validation for the

merchantInformation.merchantDescriptor.name

API field. Merchants can now submit merchant descriptor names that include either the asterisk (*) or hyphen (-) character. Transactions are no longer rejected solely because these characters are included in this descriptive field.

Mandate

Does not apply.

Audience

The updated validation is available to all merchants who use the

merchantInformation.merchantDescriptor.name

field.

Benefit

Improved merchant descriptor support.

Technical Details

Example:

{
  "merchantInformation": {
    "merchantDescriptor": {
      "name": "MERCHANT*STORE-NAME"
    }
  }
}

Important Dates

Released to Production May 20, 2026.

New Features for Pisma

| RM-44633

Description

Merchants who use Prisma can now use 3-D Secure 2.x, Network Tokens, and MIT/COF framework data. These capabilities are available to Prisma merchants who are enabled. This update allows Prisma merchants to support tokenized and authenticated card-not-present payment flows and submit the required transaction framework data for eligible use cases.

Mandate

Does not apply.

Audience

Merchants processing in Argentina through the Prisma connection.

Benefit

Prisma merchants can support tokenized, authenticated, and credential-on-file card-not-present payment flows.

Technical Details

Supported 3-D Secure-related values include:

pa_specification_version
directory_server_transaction_id
cavv
ucaf_collection_indicator
ucaf_authentication_data

Supported MIT/COF-related values include:

subsequent_auth_first
subsequent_auth_reason
subsequent_auth
subsequent_auth_transaction_id

Supported Network Token-related value:

network_token_cryptogram

Important Dates

Released to Production May 20, 2026.

Transaction Search in the Business Center

| EPS-37818

Description

For a similar search in the Business Center that has over 20 results (1 page), clicking the next page only shows 1 new result. Instead of returning results 21-40, results 2-21 are returned. When the user clicks page 3, results 3-22 are returned.

Audience

Global.

Technical Details

None.

Workaround

None.

Recurring Billing

| EPS-37751

Description

This issue affects subscriptions that fulfill these criteria:

A recurring payment fails or is skipped for the month of February.
The date of payment falls on the 29th - 31st of the month.
The payment is subsequently retried successfully.

For these subscriptions, the billing cycle is incorrectly recalculated such that the date of payment falls on the 28th of the month instead of the original date (29, 30 or 31).

Audience

Merchants who use Recurring Billing.

Technical Details

None.

Workaround

None.

Portfolio Management

| EPS-37583

Description

When a transacting organization is set to Inactive, it is still shown as a selectable option from its parent merchant organization.

Audience

Users of portfolio accounts.

Technical Details

None.

Workaround

None.

Virtual Terminal

| EPS-37322

Description

The postal code cannot be set as Required for any country except the US and Canada.

Audience

Global.

Technical Details

None.

Workaround

Set the postal code manually.

SDK

| EPS-37838

Description

When a merchant uses the Cybersource .NET SDK (NuGet CyberSource.Rest.Client v0.0.1.62) to perform a GET request, the SDK incorrectly adds a digest header and includes the digest in the HTTP Signature's signed-headers list. Per the HTTP Message Signatures specification, Digest should only be signed for requests that have a body, for example, POST or PUT. Merchants might receive validation failures for signed requests.

Audience

Merchants using the SDK.

Technical Details

None.

Workaround

None.