[BESAdmin-Announcements] HCL BigFix Quantum Risk Analyzer 2.0.4.10 Release Notes

[Announcements for BES Administrators]

Release Summary Features and Enhancements

-        Dynamic deployments, with secure parameters no longer required to
run a scan

-        New Health Dashboard for monitoring scan health

-        Redesigned, application-centric Web Reports and Kibana dashboards

-        Databridge for centralized delivery of results to Elasticsearch
through the root server

-        Separate system and filesystem scans, still runnable from a single
action

-        Cryptographic Bill of Materials (CBOM) collection to the root
server

-        Kerberos, SMB3, and SNMPv3 encryption detection

-        OMB Memorandum M-23-02 cryptographic inventory report

-        Post-quantum cryptography (PQC) hardware benchmarking

-        Improved scans on firewall-filtered networks and hosts with
unresponsive local ports

-        Defect fixes and security updates
Summary

HCL BigFix is pleased to announce the release of HCL BigFix Quantum Risk
Analyzer 2.0.4.10.



This release changes how Quantum Risk Analyzer fits into an existing BigFix
deployment, with dynamic deployments, centralized reporting through the
root server, and dashboards reorganized around applications. It also
deepens what the scan finds, adding Kerberos and non-TLS protocol coverage,
encrypted file and keystore discovery, and a federal cryptographic
inventory report.



The goal of Quantum Risk Analyzer remains the same: give you a current
inventory of the cryptography in your environment, with NIST-aligned risk
scoring, so you can get an accurate inventory of your quantum risks and
plan a post-quantum migration against facts rather than estimates.
BigFix Reporting and Deployment

-        *Dynamic deployments.* Scans no longer require secure parameters,
which allows Quantum Risk Analyzer scans to be deployed dynamically.

-        *Health Dashboard.* Monitors scan health rather than only scan
results, reporting last scan time, scan duration, and scan completion, so
you can find endpoints that are failing, stalling, or never reporting.

-        *Application-centric dashboards.* The Web Reports and Kibana
dashboards are both redesigned to be application-centric, matching how
application teams own remediation. This pairs with the application-centric
scan output below.

-        *Databridge.* Results reach Elasticsearch through a single system.
Endpoints send results upstream to the root server using the BigFix
ArchiveManager, and the root server handles injection into Elasticsearch.
Only one system needs a path to Elasticsearch.

-        *Separate system and filesystem scans.* The two scan types are now
separate, giving you more control over which runs where and how often. Both
can still be run from a single action.

-        *CBOM collection.* Cryptographic Bill of Materials output is
collected to the root server using the BigFix ArchiveManager, giving you a
portable cryptographic inventory for audit and supply chain reporting
without gathering files endpoint by endpoint.

-        *Splunk dashboard updates.* Dashboard Studio files are included,
dashboard queries corrected, and alias fields added so field names resolve
correctly through Splunk field extraction. [Confirm these artifacts ship in
the BigFix package before publishing.]
Cryptographic Discovery

-        *Application-centric scan output.* Local scans consolidate TLS,
certificate, in-memory library, and filesystem certificate findings under
the owning application process, each with its own quantum readiness grade.
Unattributed findings are reported separately. Remote scans remain
port-centric.

-        *Kerberos encryption types on Windows.* Detects whether a host
permits RC4, DES, AES128, or AES256. CNSA 2.0 prohibits RC4-HMAC for
Kerberos, RFC 8429 deprecates it, and Kerberoasting attacks target it, so
this closes a real compliance gap in federal and defense environments.
Where the configuration is not set explicitly, the operating system default
is reported and marked as inferred.

-        *Non-TLS protocol ciphers.* SMB3 dialect and cipher from a probe
against the local endpoint. SNMPv3 authentication and privacy protocols
from configuration on Linux and macOS, community string authentication on
Windows. Kerberos permitted encryption types from configuration on Linux
and macOS, from the registry on Windows. SNMPv3 and Kerberos detection is
passive. All three run in every scan mode.

-        *Encrypted files, keystores, and configuration.* Detects
password-protected Office documents, PGP and GPG archives, and generic
encrypted containers, with confidence scoring. Inventories JKS, PKCS#12,
PEM, and PKCS#7 keystores plus Windows certificate stores, macOS Keychain,
and Linux NSS and system stores, each with its encryption profile. Extracts
and assesses certificate and key references from nginx, Apache, HAProxy,
Java and Spring Boot, Envoy, environment variables, and macOS property
lists.

-        *IIS sites and TLS bindings.* Enumerates IIS sites, SNI virtual
hosts, application pools, and physical paths on Windows, attaching site
metadata to the matching port result.

-        *Stable identity for virtual desktops.* Because non-persistent
pools hand out a new machine name and security identifier each session, the
same desktop looks like a new asset on every scan. Identity now resolves in
order through a value you supply, a persistent profile file, a hash of the
logged-in username, then the hostname. VMware Horizon, Citrix, and
Microsoft Remote Desktop are detected automatically.

-        *In-memory keys and certificates.* On Linux and macOS, reads heap
and anonymous memory using native operating system interfaces and detects
RSA, EC and ECDSA, ED25519, DSA, and encrypted private keys. Raw key
material is no longer captured. Keys report type, bit length, curve, and
fingerprint only. Certificate reporting is limited to end-entity
certificates and deduplicated per process.

-        *Native macOS library scanner.* Inspects the dyld shared cache and
loaded libraries per process instead of pattern matching against memory,
improving identification of CommonCrypto, SecureTransport, OpenSSL, and
third-party libraries.

-        *OMB M-23-02 inventory report.* A standalone cryptographic
inventory in the 34 column layout aligned to OMB Memorandum M-23-02 and
NSM-10 agency reporting. Quantum readiness, operating system, hosting and
cloud provider, vendor and version, and FIPS status populate automatically.
FISMA identifiers, high value asset flags, and fiscal year dates can be
injected through tagging rules. Enabling password manager detection adds
vault inventory to the report. Can run alongside another output format in
the same scan.

-        *PQC hardware benchmarking.* Measures local CPU throughput for
ML-DSA-44, ML-DSA-65, ML-DSA-87, ML-KEM-768, and ML-KEM-1024 across 15
operations without running a scan, identifying systems likely to struggle
with PQC overhead and feeding the hardware component of the readiness score.

-        *PQC-only server detection.* These servers reject classical key
shares before a handshake completes, so they previously returned an empty
cipher. The server hello is now inspected passively and the cipher suite
reported, covering BIKE-L1, BIKE-L3, BIKE-L5, FrodoKEM, and pure
ML-KEM-1024. Supported key exchange groups now number more than 35.

-        *New readiness indicators.* NTLM compatibility level on Windows,
Secure Boot firmware type, WiFi protocol and cipher with TKIP and WEP
flagged, and STARTTLS support for SMTP, IMAP, LDAP, and PostgreSQL. None of
these launch a system executable.

-        *Security hardening.* License keys and API tokens are encrypted at
rest with AES-256-GCM. Communication to Elasticsearch, Splunk, and S3
requires HTTPS, and plain HTTP endpoints are rejected at startup. Change
tracking is opt-in and, when enabled, encrypted with owner-only file
permissions.

-        *Key severity.* An unencrypted private key now generates a
higher-severity finding than an encrypted one, and carries a remediation
recommendation in every output format.

-        *Scan performance.* A TCP reachability check classifies each port
before any TLS work begins, and where the first probe times out the
remaining probes for that port are skipped. A firewall-filtered port now
resolves in about 2 seconds rather than about 179. Streaming report
serialization cuts peak memory use by roughly 30 percent at scale. Port
scans also show a progress indicator, and startup logging is quieter.
Defect Fixes

This release resolves the following issues:



-        *Windows asset identification.* Four operating system fields
returned the same raw kernel build string, the Active Directory domain was
not populated on domain-joined hosts, and serial number retrieval failed on
virtual machines and cloud instances. All three are fixed, correcting asset
grouping, unique device identification, and reporting by domain.

-        *Scans under elevated accounts.* Browser extension scans on macOS
and Linux, and browser extension and installed application scans on Windows
under SYSTEM, searched only the privileged account's own profile and
returned no records. All user profiles are now enumerated.

-        *Elasticsearch and Splunk delivery.* JSON output combined with
direct Elasticsearch delivery sent only the first batch of roughly 200
documents. Six flat NDJSON datasets emitted no top-level identifier,
causing duplicate indexing and broken deduplication. A mapping conflict on
the upgrade pathway field caused indexing failures on first write.
Seventeen fields were misaligned between the Elasticsearch connector
mapping and flat NDJSON output.

-        *Missing report data.* RHEL 9 hosts did not report cost fields
because the platform string did not match the benchmark keyword table.
Quantum readiness fields for FIPS mode and Secure Boot were not populated
on Windows.

-        *Scan reliability.* Splunk connectivity is now verified before a
scan starts rather than after. Local TLS, SSH, and ARP timeouts no longer
stall scans. Invalid output formats are rejected at startup. Split output
combined with minimal detail no longer produces empty files. S3 uploads no
longer succeed with zero bytes when the output file does not yet exist. The
1,000 port limit can no longer be bypassed with multiple comma-separated
ranges. Filesystem detectors now share a single directory walk per scan.

-        *Delivery failure handling.* When a delivery target is unreachable
and a local output file is specified, the scan completes, writes the file,
and exits with code 2 so automation can retry delivery instead of losing
the scan. Where no file output is specified, the scan aborts with exit code
1 as before.
Security Vulnerability Resolution

This release resolves the following vulnerabilities:



-        *CVE-2026-21807: *A security analysis of the executable using the
checksec utility revealed that the binary lacks several critical,
industry-standard hardening protections.

-        *CVE-2026-21808:* The application includes a feature to generate a
log file during execution. However, the current implementation is
configured to output highly detailed information by default, effectively
operating in a "DEBUG" or "Verbose" mode without explicit user activation.

-        *CVE-2026-21809:* The application’s license-key validation process
provides overly descriptive error messages when it encounters malformed
input.

-        *CVE-2026-21810*: The application utilizes an embedded version of
the OpenSSL binary, which is extracted during execution.  Testing revealed
that when the application is executed with certain command-line parameters
or when it terminates under specific conditions, the cleanup routine fails.

-        *CVE-2026-21807*: A security analysis of the executable using the
checksec utility revealed that the binary lacks several critical,
industry-standard hardening protections.

-        *CVE-2026-21808*: The application includes a feature to generate a
log file during execution. However, the current implementation is
configured to output highly detailed information by default, effectively
operating in a "DEBUG" or "Verbose" mode without explicit user activation.

-        *CVE-2026-21809*: The application’s license-key validation process
provides overly descriptive error messages when it encounters malformed
input.

-        *CVE-2026-21810*: The application’s HTML report generation feature
includes a hardcoded reference to a CSS stylesheet /Javascripts hosted on
an external Content Delivery Network (CDN). Security testing revealed that
this URL is "baked" directly into the executable file.

-        *CVE-2026-34181*. A PKCS#12 authentication bypass. The PBMAC1
message authentication code defined in RFC 9579 was accepted with an HMAC
key as short as one byte, making the code feasible to forge offline and
allowing a keystore file to authenticate under the wrong password. Because
PKCS#12 keystores are a primary format read during endpoint scans, a forged
file could have caused the scanner to report certificate inventory that
misrepresented the material actually present. Keystores using PBMAC1 with a
key length below 20 octets are now rejected. Files using the standard
legacy HMAC-SHA1 code, the default for most certificate export tooling,
were never affected.

-        *CVE-2025-61726*. A memory exhaustion flaw in URL query parsing in
the Go runtime, triggerable by a malformed query string and causing
unbounded memory growth. Resolved by upgrading the runtime to Go 1.25.9.
Deployments scanning externally controlled hosts in remote mode were the
most exposed.

-        *CVE-2025-9230*. An out-of-bounds read and write in RFC 3211 key
encryption key unwrapping in OpenSSL, reachable when processing a malformed
wrapped key.

-        *CVE-2025-9231*. A timing side channel in the OpenSSL SM2 elliptic
curve implementation on 64-bit ARM, which could allow an attacker with
local access to recover private key material.

-        *CVE-2025-9232*. An out-of-bounds read in OpenSSL HTTP client
proxy exclusion list parsing.

-        OpenSSL has been removed as a runtime dependency. If anything in
your environment depended on the bundled OpenSSL binary for a purpose
outside the scanner, note its removal.


Known Issues

-        Remote scans returning more than roughly 30,000 findings can
exceed the 16 MB default memory allocation. Raise the allocation before
processing result sets of that size.


How to Update

Stop any existing scan jobs, configure the QRA License Key and redeploy
with the new scan tool. Make sure analysis is activated.


------------------------------
Resources

-        HCL BigFix Quantum Risk Analyzer product page:
https://www.hcl-software.com/bigfix/products/quantum-risk-analyzer

-        HCL BigFix Quantum Risk Analyzer for US federal agencies:
https://www.hclfederal.com/hcl-bigfix-quantum-risk-analyzer/

-        HCL BigFix documentation:
https://help.hcl-software.com/bigfix/landing/index.html

-        Quantum Risk Analyzer documentation and output schema reference:
https://help.hcl-software.com/bigfix/add-ons/Add-Ons/BigFix_Quantum_Risk_Analyzer/qra_add_on.html
Site Versions

HCL BigFix Quantum Risk Analyzer: 2.0.4.10



BigFix Quantum Risk Analyzer: Site version 2





Thanks,



– The BigFix Quantum Risk Analyzer Team
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://bigmail.bigfix.com/pipermail/besadmin-announcements/attachments/20260828/f4de0d6f/attachment.html>