<div dir="ltr"><h2 style="margin:0.25in 0in 6pt;line-height:115%;break-after:avoid;font-size:16pt;font-family:Arial,sans-serif;font-weight:normal">Release Summary</h2>
<h3 style="margin:16pt 0in 4pt;line-height:115%;break-after:avoid;font-size:14pt;font-family:Arial,sans-serif;color:rgb(67,67,67);font-weight:normal"><a name="_zfyrk3aq6t27"></a>Features and Enhancements</h3>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span>Dynamic deployments, with secure parameters no
longer required to run a scan</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span>New Health Dashboard for monitoring scan health</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span>Redesigned, application-centric Web Reports and
Kibana dashboards</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span>Databridge for centralized delivery of results
to Elasticsearch through the root server</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span>Separate system and filesystem scans, still
runnable from a single action</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span>Cryptographic Bill of Materials (CBOM)
collection to the root server</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span>Kerberos, SMB3, and SNMPv3 encryption detection</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span>OMB Memorandum M-23-02 cryptographic inventory
report</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span>Post-quantum cryptography (PQC) hardware
benchmarking</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span>Improved scans on firewall-filtered networks and
hosts with unresponsive local ports</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span>Defect fixes and security updates</p>
<h3 style="margin:16pt 0in 4pt;line-height:115%;break-after:avoid;font-size:14pt;font-family:Arial,sans-serif;color:rgb(67,67,67);font-weight:normal"><a name="_32l0owoveo8p"></a>Summary</h3>
<p class="MsoNormal" style="margin:0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif">HCL BigFix is pleased to announce the release of HCL BigFix
Quantum Risk Analyzer 2.0.4.10.</p>
<p class="MsoNormal" style="border-width:medium;border-style:none;border-color:currentcolor;margin:0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"> </p>
<p class="MsoNormal" style="margin:0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif">This release changes how Quantum Risk Analyzer fits into an
existing BigFix deployment, with dynamic deployments, centralized reporting
through the root server, and dashboards reorganized around applications. It
also deepens what the scan finds, adding Kerberos and non-TLS protocol
coverage, encrypted file and keystore discovery, and a federal cryptographic
inventory report.</p>
<p class="MsoNormal" style="border-width:medium;border-style:none;border-color:currentcolor;margin:0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"> </p>
<p class="MsoNormal" style="margin:0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif">The goal of Quantum Risk Analyzer remains the same: give you
a current inventory of the cryptography in your environment, with NIST-aligned
risk scoring, so you can get an accurate inventory of your quantum risks and
plan a post-quantum migration against facts rather than estimates.</p>
<h2 style="margin:0.25in 0in 6pt;line-height:115%;break-after:avoid;font-size:16pt;font-family:Arial,sans-serif;font-weight:normal"><a name="_ukfjbdhud1rc"></a>BigFix Reporting and Deployment</h2>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>Dynamic deployments.</b> Scans no longer
require secure parameters, which allows Quantum Risk Analyzer scans to be
deployed dynamically.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>Health Dashboard.</b> Monitors scan health
rather than only scan results, reporting last scan time, scan duration, and
scan completion, so you can find endpoints that are failing, stalling, or never
reporting.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>Application-centric dashboards.</b> The Web
Reports and Kibana dashboards are both redesigned to be application-centric,
matching how application teams own remediation. This pairs with the
application-centric scan output below.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>Databridge.</b> Results reach Elasticsearch
through a single system. Endpoints send results upstream to the root server
using the BigFix ArchiveManager, and the root server handles injection into
Elasticsearch. Only one system needs a path to Elasticsearch.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>Separate system and filesystem scans.</b> The
two scan types are now separate, giving you more control over which runs where
and how often. Both can still be run from a single action.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>CBOM collection.</b> Cryptographic Bill of
Materials output is collected to the root server using the BigFix
ArchiveManager, giving you a portable cryptographic inventory for audit and
supply chain reporting without gathering files endpoint by endpoint.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>Splunk dashboard updates.</b> Dashboard
Studio files are included, dashboard queries corrected, and alias fields added
so field names resolve correctly through Splunk field extraction. [Confirm
these artifacts ship in the BigFix package before publishing.]</p>
<h2 style="margin:0.25in 0in 6pt;line-height:115%;break-after:avoid;font-size:16pt;font-family:Arial,sans-serif;font-weight:normal"><a name="_mqqx1bulaj5q"></a>Cryptographic Discovery</h2>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>Application-centric scan output.</b> Local
scans consolidate TLS, certificate, in-memory library, and filesystem
certificate findings under the owning application process, each with its own
quantum readiness grade. Unattributed findings are reported separately. Remote
scans remain port-centric.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>Kerberos encryption types on Windows.</b>
Detects whether a host permits RC4, DES, AES128, or AES256. CNSA 2.0 prohibits
RC4-HMAC for Kerberos, RFC 8429 deprecates it, and Kerberoasting attacks target
it, so this closes a real compliance gap in federal and defense environments.
Where the configuration is not set explicitly, the operating system default is
reported and marked as inferred.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>Non-TLS protocol ciphers.</b> SMB3 dialect
and cipher from a probe against the local endpoint. SNMPv3 authentication and
privacy protocols from configuration on Linux and macOS, community string
authentication on Windows. Kerberos permitted encryption types from
configuration on Linux and macOS, from the registry on Windows. SNMPv3 and
Kerberos detection is passive. All three run in every scan mode.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>Encrypted files, keystores, and
configuration.</b> Detects password-protected Office documents, PGP and GPG
archives, and generic encrypted containers, with confidence scoring.
Inventories JKS, PKCS#12, PEM, and PKCS#7 keystores plus Windows certificate
stores, macOS Keychain, and Linux NSS and system stores, each with its
encryption profile. Extracts and assesses certificate and key references from
nginx, Apache, HAProxy, Java and Spring Boot, Envoy, environment variables, and
macOS property lists.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>IIS sites and TLS bindings.</b> Enumerates
IIS sites, SNI virtual hosts, application pools, and physical paths on Windows,
attaching site metadata to the matching port result.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>Stable identity for virtual desktops.</b>
Because non-persistent pools hand out a new machine name and security
identifier each session, the same desktop looks like a new asset on every scan.
Identity now resolves in order through a value you supply, a persistent profile
file, a hash of the logged-in username, then the hostname. VMware Horizon,
Citrix, and Microsoft Remote Desktop are detected automatically.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>In-memory keys and certificates.</b> On Linux
and macOS, reads heap and anonymous memory using native operating system
interfaces and detects RSA, EC and ECDSA, ED25519, DSA, and encrypted private
keys. Raw key material is no longer captured. Keys report type, bit length,
curve, and fingerprint only. Certificate reporting is limited to end-entity
certificates and deduplicated per process.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>Native macOS library scanner.</b> Inspects
the dyld shared cache and loaded libraries per process instead of pattern
matching against memory, improving identification of CommonCrypto,
SecureTransport, OpenSSL, and third-party libraries.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>OMB M-23-02 inventory report.</b> A
standalone cryptographic inventory in the 34 column layout aligned to OMB
Memorandum M-23-02 and NSM-10 agency reporting. Quantum readiness, operating
system, hosting and cloud provider, vendor and version, and FIPS status
populate automatically. FISMA identifiers, high value asset flags, and fiscal
year dates can be injected through tagging rules. Enabling password manager
detection adds vault inventory to the report. Can run alongside another output
format in the same scan.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>PQC hardware benchmarking.</b> Measures local
CPU throughput for ML-DSA-44, ML-DSA-65, ML-DSA-87, ML-KEM-768, and ML-KEM-1024
across 15 operations without running a scan, identifying systems likely to
struggle with PQC overhead and feeding the hardware component of the readiness
score.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>PQC-only server detection.</b> These servers
reject classical key shares before a handshake completes, so they previously
returned an empty cipher. The server hello is now inspected passively and the
cipher suite reported, covering BIKE-L1, BIKE-L3, BIKE-L5, FrodoKEM, and pure
ML-KEM-1024. Supported key exchange groups now number more than 35.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>New readiness indicators.</b> NTLM
compatibility level on Windows, Secure Boot firmware type, WiFi protocol and
cipher with TKIP and WEP flagged, and STARTTLS support for SMTP, IMAP, LDAP,
and PostgreSQL. None of these launch a system executable.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>Security hardening.</b> License keys and API
tokens are encrypted at rest with AES-256-GCM. Communication to Elasticsearch,
Splunk, and S3 requires HTTPS, and plain HTTP endpoints are rejected at
startup. Change tracking is opt-in and, when enabled, encrypted with owner-only
file permissions.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>Key severity.</b> An unencrypted private key
now generates a higher-severity finding than an encrypted one, and carries a
remediation recommendation in every output format.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>Scan performance.</b> A TCP reachability
check classifies each port before any TLS work begins, and where the first
probe times out the remaining probes for that port are skipped. A
firewall-filtered port now resolves in about 2 seconds rather than about 179.
Streaming report serialization cuts peak memory use by roughly 30 percent at
scale. Port scans also show a progress indicator, and startup logging is
quieter.</p>
<h2 style="margin:0.25in 0in 6pt;line-height:115%;break-after:avoid;font-size:16pt;font-family:Arial,sans-serif;font-weight:normal"><a name="_qonen2vho9fb"></a>Defect Fixes</h2>
<p class="MsoNormal" style="margin:0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif">This release resolves the following issues:</p>
<p class="MsoNormal" style="border-width:medium;border-style:none;border-color:currentcolor;margin:0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"> </p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>Windows asset identification.</b> Four
operating system fields returned the same raw kernel build string, the Active
Directory domain was not populated on domain-joined hosts, and serial number
retrieval failed on virtual machines and cloud instances. All three are fixed,
correcting asset grouping, unique device identification, and reporting by
domain.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>Scans under elevated accounts.</b> Browser
extension scans on macOS and Linux, and browser extension and installed
application scans on Windows under SYSTEM, searched only the privileged
account's own profile and returned no records. All user profiles are now
enumerated.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>Elasticsearch and Splunk delivery.</b> JSON
output combined with direct Elasticsearch delivery sent only the first batch of
roughly 200 documents. Six flat NDJSON datasets emitted no top-level
identifier, causing duplicate indexing and broken deduplication. A mapping
conflict on the upgrade pathway field caused indexing failures on first write.
Seventeen fields were misaligned between the Elasticsearch connector mapping
and flat NDJSON output.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>Missing report data.</b> RHEL 9 hosts did not
report cost fields because the platform string did not match the benchmark
keyword table. Quantum readiness fields for FIPS mode and Secure Boot were not
populated on Windows.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>Scan reliability.</b> Splunk connectivity is
now verified before a scan starts rather than after. Local TLS, SSH, and ARP
timeouts no longer stall scans. Invalid output formats are rejected at startup.
Split output combined with minimal detail no longer produces empty files. S3
uploads no longer succeed with zero bytes when the output file does not yet
exist. The 1,000 port limit can no longer be bypassed with multiple
comma-separated ranges. Filesystem detectors now share a single directory walk
per scan.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>Delivery failure handling.</b> When a
delivery target is unreachable and a local output file is specified, the scan
completes, writes the file, and exits with code 2 so automation can retry
delivery instead of losing the scan. Where no file output is specified, the
scan aborts with exit code 1 as before.</p>
<h2 style="margin:0.25in 0in 6pt;line-height:115%;break-after:avoid;font-size:16pt;font-family:Arial,sans-serif;font-weight:normal"><a name="_yxmh0ftmk6io"></a>Security Vulnerability Resolution</h2>
<p class="MsoNormal" style="margin:0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif">This release resolves the following vulnerabilities:</p>
<p class="MsoNormal" style="border-width:medium;border-style:none;border-color:currentcolor;margin:0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"> </p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>CVE-2026-21807: </b><span style="font-size:10.5pt;line-height:115%;color:rgb(41,42,46)">A security analysis of the executable
using the checksec utility revealed that the binary lacks several critical,
industry-standard hardening protections.</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b><span style="font-size:10.5pt;line-height:115%;color:rgb(41,42,46)">CVE-2026-21808:</span></b><span style="font-size:10.5pt;line-height:115%;color:rgb(41,42,46)"> The application includes a feature to generate
a log file during execution. However, the current implementation is configured
to output highly detailed information by default, effectively operating in a
"DEBUG" or "Verbose" mode without explicit user activation.</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b><span style="font-size:10.5pt;line-height:115%;color:rgb(41,42,46)">CVE-2026-21809:</span></b><span style="font-size:10.5pt;line-height:115%;color:rgb(41,42,46)"> The application’s license-key validation
process provides overly descriptive error messages when it encounters malformed
input.</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b><span style="font-size:10.5pt;line-height:115%;color:rgb(41,42,46)">CVE-2026-21810</span></b><span style="font-size:10.5pt;line-height:115%;color:rgb(41,42,46)">: The application utilizes an embedded version
of the OpenSSL binary, which is extracted during execution. Testing revealed that when the application is
executed with certain command-line parameters or when it terminates under
specific conditions, the cleanup routine fails. </span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>CVE-2026-21807</b>: A security analysis of
the executable using the checksec utility revealed that the binary lacks
several critical, industry-standard hardening protections.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>CVE-2026-21808</b>: The application includes
a feature to generate a log file during execution. However, the current
implementation is configured to output highly detailed information by default,
effectively operating in a "DEBUG" or "Verbose" mode without
explicit user activation.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>CVE-2026-21809</b>: The application’s
license-key validation process provides overly descriptive error messages when
it encounters malformed input.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>CVE-2026-21810</b>: The application’s HTML
report generation feature includes a hardcoded reference to a CSS stylesheet
/Javascripts hosted on an external Content Delivery Network (CDN). Security
testing revealed that this URL is "baked" directly into the executable
file.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>CVE-2026-34181</b>. A PKCS#12 authentication
bypass. The PBMAC1 message authentication code defined in RFC 9579 was accepted
with an HMAC key as short as one byte, making the code feasible to forge
offline and allowing a keystore file to authenticate under the wrong password.
Because PKCS#12 keystores are a primary format read during endpoint scans, a
forged file could have caused the scanner to report certificate inventory that
misrepresented the material actually present. Keystores using PBMAC1 with a key
length below 20 octets are now rejected. Files using the standard legacy
HMAC-SHA1 code, the default for most certificate export tooling, were never
affected.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>CVE-2025-61726</b>. A memory exhaustion flaw
in URL query parsing in the Go runtime, triggerable by a malformed query string
and causing unbounded memory growth. Resolved by upgrading the runtime to Go
1.25.9. Deployments scanning externally controlled hosts in remote mode were
the most exposed.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>CVE-2025-9230</b>. An out-of-bounds read and
write in RFC 3211 key encryption key unwrapping in OpenSSL, reachable when
processing a malformed wrapped key.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>CVE-2025-9231</b>. A timing side channel in
the OpenSSL SM2 elliptic curve implementation on 64-bit ARM, which could allow
an attacker with local access to recover private key material.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><b>CVE-2025-9232</b>. An out-of-bounds read in
OpenSSL HTTP client proxy exclusion list parsing.</p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span>OpenSSL has been removed as a runtime
dependency. If anything in your environment depended on the bundled OpenSSL
binary for a purpose outside the scanner, note its removal.</p>
<p class="MsoNormal" style="border-width:medium;border-style:none;border-color:currentcolor;margin:0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"> </p>
<h2 style="margin:0.25in 0in 6pt;line-height:115%;break-after:avoid;font-size:16pt;font-family:Arial,sans-serif;font-weight:normal"><a name="_3rk5v1wmbvyo"></a>Known Issues</h2>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span>Remote scans returning more than roughly 30,000
findings can exceed the 16 MB default memory allocation. Raise the allocation
before processing result sets of that size.</p>
<p class="MsoNormal" style="border-width:medium;border-style:none;border-color:currentcolor;margin:0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"> </p>
<h2 style="margin:0.25in 0in 6pt;line-height:115%;break-after:avoid;font-size:16pt;font-family:Arial,sans-serif;font-weight:normal"><a name="_adiqedbjmb7l"></a>How to Update</h2>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif">Stop any existing scan jobs,
configure the QRA License Key and redeploy with the new scan tool. Make sure
analysis is activated. </p>
<p class="MsoNormal" style="border-width:medium;border-style:none;border-color:currentcolor;margin:0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"> </p>
<div class="MsoNormal" align="center" style="text-align:center;margin:0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif">
<hr size="0" width="100%" align="center">
</div>
<h2 style="margin:0.25in 0in 6pt;line-height:115%;break-after:avoid;font-size:16pt;font-family:Arial,sans-serif;font-weight:normal"><a name="_ru9amo12w785"></a>Resources</h2>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span>HCL BigFix Quantum Risk Analyzer product page: <a href="https://www.hcl-software.com/bigfix/products/quantum-risk-analyzer">https://www.hcl-software.com/bigfix/products/quantum-risk-analyzer</a></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span>HCL BigFix Quantum Risk Analyzer for US federal
agencies: <a href="https://www.hclfederal.com/hcl-bigfix-quantum-risk-analyzer/">https://www.hclfederal.com/hcl-bigfix-quantum-risk-analyzer/</a></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span>HCL BigFix documentation: <a href="https://help.hcl-software.com/bigfix/landing/index.html">https://help.hcl-software.com/bigfix/landing/index.html</a></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span style="color:black">-<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span>Quantum Risk Analyzer documentation and output
schema reference: <a href="https://help.hcl-software.com/bigfix/add-ons/Add-Ons/BigFix_Quantum_Risk_Analyzer/qra_add_on.html">https://help.hcl-software.com/bigfix/add-ons/Add-Ons/BigFix_Quantum_Risk_Analyzer/qra_add_on.html</a></p>
<h2 style="margin:0.25in 0in 6pt;line-height:115%;break-after:avoid;font-size:16pt;font-family:Arial,sans-serif;font-weight:normal"><a name="_ro5w6ngpxrig"></a>Site Versions</h2>
<p class="MsoNormal" style="margin:0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif">HCL BigFix Quantum Risk Analyzer: 2.0.4.10</p>
<p class="MsoNormal" style="border-width:medium;border-style:none;border-color:currentcolor;margin:0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"> </p>
<p class="MsoNormal" style="margin:0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif">BigFix Quantum Risk Analyzer: Site version 2</p>
<p class="MsoNormal" style="border-width:medium;border-style:none;border-color:currentcolor;margin:0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"> </p>
<p class="MsoNormal" style="margin:0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"> </p>
<p class="MsoNormal" style="margin:0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif">Thanks,</p>
<p class="MsoNormal" style="border-width:medium;border-style:none;border-color:currentcolor;margin:0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"> </p>
<p class="MsoNormal" style="margin:0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif">– The BigFix Quantum Risk Analyzer Team</p></div>