diff --git a/docs/14.releasenotes/01.5x/01.5x.md b/docs/14.releasenotes/01.5x/01.5x.md
index 67816040..1d2d9ebc 100644
--- a/docs/14.releasenotes/01.5x/01.5x.md
+++ b/docs/14.releasenotes/01.5x/01.5x.md
@@ -13,6 +13,39 @@ To receive email notifications of new releases, please subscribe to this SUSE ma
 
 :::
 
+#### 5.6.3 October 2026
+
+:::note Critical CVE Stats After Upgrade
+Upgrading to NeuVector v5.6.3 or later from any version prior to v5.6.0 requires all existing NeuVector scanner pods to be restarted or redeployed to support CVE critical-level severity.
+
+Older scanner pods cache the controller's initial capability response. They will not recognize that the upgraded controller supports critical-level severity until they are restarted and re-query the controller on startup.
+:::
+
+##### Feature requests
+
+- **issue-2870**: Support authenticated webhook notifications in NeuVector.
+
+##### Enhancement
+
+- **issue-2833**: UI shows messaging when the mapped role of a server user is empty
+
+##### Bug fixes
+
+- **issue-2925**: Check the id instead of name, also enrich the fail log.
+- **issue-2750**: Process rules not always working.
+- **issue-2804**: Automated federation join failed with controller HA setup.
+- **issue-1310**: Newly added registry in "Assets -> Registries" is not displayed until manual page refresh.
+- **fix**: (nvbench) Correct RKE2 kubelet configuration checks.
+- **fix**: (crd) Allow dry-run admission requests instead of denying them.
+- **fix**: (RKE2) Read eventRecordQPS from kubelet configuration.
+- **fix**: (nvbench) Resolve RKE2 worker paths from process arguments.
+- **fix**: (RKE2) kubelet client CA check.
+- **fix**: (nvbench) Check RKE2 client CA ownership by path.
+- **fix**: Keep IPv6 client addresses intact in auth audit events.
+- **fix**: Add missing scanrunning caps.
+- **chore(deps)**: Dependency updates & golang upgrade.
+
+
 #### 5.6.2 September 2026
 
 :::note
diff --git a/versioned_docs/version-5.6/14.releasenotes/01.5x/01.5x.md b/versioned_docs/version-5.6/14.releasenotes/01.5x/01.5x.md
index fba07697..52336421 100644
--- a/versioned_docs/version-5.6/14.releasenotes/01.5x/01.5x.md
+++ b/versioned_docs/version-5.6/14.releasenotes/01.5x/01.5x.md
@@ -13,6 +13,38 @@ To receive email notifications of new releases, please subscribe to this SUSE ma
 
 :::
 
+#### 5.6.3 October 2026
+
+:::note Critical CVE Stats After Upgrade
+Upgrading to NeuVector v5.6.3 or later from any version prior to v5.6.0 requires all existing NeuVector scanner pods to be restarted or redeployed to support CVE critical-level severity.
+
+Older scanner pods cache the controller's initial capability response. They will not recognize that the upgraded controller supports critical-level severity until they are restarted and re-query the controller on startup.
+:::
+
+##### Feature requests
+
+- **issue-2870**: Support authenticated webhook notifications in NeuVector.
+
+##### Enhancement
+
+- **issue-2833**: UI shows messaging when the mapped role of a server user is empty
+
+##### Bug fixes
+
+- **issue-2925**: Check the id instead of name, also enrich the fail log.
+- **issue-2750**: Process rules not always working.
+- **issue-2804**: Automated federation join failed with controller HA setup.
+- **issue-1310**: Newly added registry in "Assets -> Registries" is not displayed until manual page refresh.
+- **fix**: (nvbench) Correct RKE2 kubelet configuration checks.
+- **fix**: (crd) Allow dry-run admission requests instead of denying them.
+- **fix**: (RKE2) Read eventRecordQPS from kubelet configuration.
+- **fix**: (nvbench) Resolve RKE2 worker paths from process arguments.
+- **fix**: (RKE2) kubelet client CA check.
+- **fix**: (nvbench) Check RKE2 client CA ownership by path.
+- **fix**: Keep IPv6 client addresses intact in auth audit events.
+- **fix**: Add missing scanrunning caps.
+- **chore(deps)**: Dependency updates & golang upgrade.
+
 #### 5.6.2 September 2026
 
 :::note Critical CVE Stats After Upgrades