HCL BigFix Quantum Risk Analyzer 2.0.4.10 Release Notes

Release Announcements QRA
1

Release Summary

Features and Enhancements

  • Dynamic deployments, with secure parameters no longer required to run a scan
  • New Health Dashboard for monitoring scan health
  • Redesigned, application-centric Web Reports and Kibana dashboards
  • Databridge for centralized delivery of results to Elasticsearch through the root server
  • Separate system and filesystem scans, still runnable from a single action
  • Cryptographic Bill of Materials (CBOM) collection to the root server
  • Kerberos, SMB3, and SNMPv3 encryption detection
  • OMB Memorandum M-23-02 cryptographic inventory report
  • Post-quantum cryptography (PQC) hardware benchmarking
  • Improved scans on firewall-filtered networks and hosts with unresponsive local ports
  • Defect fixes and security updates

Summary

HCL BigFix is pleased to announce the release of HCL BigFix Quantum Risk Analyzer 2.0.4.10.

This release changes how Quantum Risk Analyzer fits into an existing BigFix deployment, with dynamic deployments, centralized reporting through the root server, and dashboards reorganized around applications. It also deepens what the scan finds, adding Kerberos and non-TLS protocol coverage, encrypted file and keystore discovery, and a federal cryptographic inventory report.

The goal of Quantum Risk Analyzer remains the same: give you a current inventory of the cryptography in your environment, with NIST-aligned risk scoring, so you can get an accurate inventory of your quantum risks and plan a post-quantum migration against facts rather than estimates.

BigFix Reporting and Deployment

  • Dynamic deployments. Scans no longer require secure parameters, which allows Quantum Risk Analyzer scans to be deployed dynamically.

  • Health Dashboard. Monitors scan health rather than only scan results, reporting last scan time, scan duration, and scan completion, so you can find endpoints that are failing, stalling, or never reporting.

  • Application-centric dashboards. The Web Reports and Kibana dashboards are both redesigned to be application-centric, matching how application teams own remediation. This pairs with the application-centric scan output below.

  • Databridge. Results reach Elasticsearch through a single system. Endpoints send results upstream to the root server using the BigFix ArchiveManager, and the root server handles injection into Elasticsearch. Only one system needs a path to Elasticsearch.

  • Separate system and filesystem scans. The two scan types are now separate, giving you more control over which runs where and how often. Both can still be run from a single action.

  • CBOM collection. Cryptographic Bill of Materials output is collected to the root server using the BigFix ArchiveManager, giving you a portable cryptographic inventory for audit and supply chain reporting without gathering files endpoint by endpoint.

  • Splunk dashboard updates. Dashboard Studio files are included, dashboard queries corrected, and alias fields added so field names resolve correctly through Splunk field extraction. [Confirm these artifacts ship in the BigFix package before publishing.]

Cryptographic Discovery

  • Application-centric scan output. Local scans consolidate TLS, certificate, in-memory library, and filesystem certificate findings under the owning application process, each with its own quantum readiness grade. Unattributed findings are reported separately. Remote scans remain port-centric.

  • Kerberos encryption types on Windows. Detects whether a host permits RC4, DES, AES128, or AES256. CNSA 2.0 prohibits RC4-HMAC for Kerberos, RFC 8429 deprecates it, and Kerberoasting attacks target it, so this closes a real compliance gap in federal and defense environments. Where the configuration is not set explicitly, the operating system default is reported and marked as inferred.

  • Non-TLS protocol ciphers. SMB3 dialect and cipher from a probe against the local endpoint. SNMPv3 authentication and privacy protocols from configuration on Linux and macOS, community string authentication on Windows. Kerberos permitted encryption types from configuration on Linux and macOS, from the registry on Windows. SNMPv3 and Kerberos detection is passive. All three run in every scan mode.

  • Encrypted files, keystores, and configuration. Detects password-protected Office documents, PGP and GPG archives, and generic encrypted containers, with confidence scoring. Inventories JKS, PKCS#12, PEM, and PKCS#7 keystores plus Windows certificate stores, macOS Keychain, and Linux NSS and system stores, each with its encryption profile. Extracts and assesses certificate and key references from nginx, Apache, HAProxy, Java and Spring Boot, Envoy, environment variables, and macOS property lists.

  • IIS sites and TLS bindings. Enumerates IIS sites, SNI virtual hosts, application pools, and physical paths on Windows, attaching site metadata to the matching port result.

  • Stable identity for virtual desktops. Because non-persistent pools hand out a new machine name and security identifier each session, the same desktop looks like a new asset on every scan. Identity now resolves in order through a value you supply, a persistent profile file, a hash of the logged-in username, then the hostname. VMware Horizon, Citrix, and Microsoft Remote Desktop are detected automatically.

  • In-memory keys and certificates. On Linux and macOS, reads heap and anonymous memory using native operating system interfaces and detects RSA, EC and ECDSA, ED25519, DSA, and encrypted private keys. Raw key material is no longer captured. Keys report type, bit length, curve, and fingerprint only. Certificate reporting is limited to end-entity certificates and deduplicated per process.

  • Native macOS library scanner. Inspects the dyld shared cache and loaded libraries per process instead of pattern matching against memory, improving identification of CommonCrypto, SecureTransport, OpenSSL, and third-party libraries.

  • OMB M-23-02 inventory report. A standalone cryptographic inventory in the 34 column layout aligned to OMB Memorandum M-23-02 and NSM-10 agency reporting. Quantum readiness, operating system, hosting and cloud provider, vendor and version, and FIPS status populate automatically. FISMA identifiers, high value asset flags, and fiscal year dates can be injected through tagging rules. Enabling password manager detection adds vault inventory to the report. Can run alongside another output format in the same scan.

  • PQC hardware benchmarking. Measures local CPU throughput for ML-DSA-44, ML-DSA-65, ML-DSA-87, ML-KEM-768, and ML-KEM-1024 across 15 operations without running a scan, identifying systems likely to struggle with PQC overhead and feeding the hardware component of the readiness score.

  • PQC-only server detection. These servers reject classical key shares before a handshake completes, so they previously returned an empty cipher. The server hello is now inspected passively and the cipher suite reported, covering BIKE-L1, BIKE-L3, BIKE-L5, FrodoKEM, and pure ML-KEM-1024. Supported key exchange groups now number more than 35.

  • New readiness indicators. NTLM compatibility level on Windows, Secure Boot firmware type, WiFi protocol and cipher with TKIP and WEP flagged, and STARTTLS support for SMTP, IMAP, LDAP, and PostgreSQL. None of these launch a system executable.

  • Security hardening. License keys and API tokens are encrypted at rest with AES-256-GCM. Communication to Elasticsearch, Splunk, and S3 requires HTTPS, and plain HTTP endpoints are rejected at startup. Change tracking is opt-in and, when enabled, encrypted with owner-only file permissions.

  • Key severity. An unencrypted private key now generates a higher-severity finding than an encrypted one, and carries a remediation recommendation in every output format.

  • Scan performance. A TCP reachability check classifies each port before any TLS work begins, and where the first probe times out the remaining probes for that port are skipped. A firewall-filtered port now resolves in about 2 seconds rather than about 179. Streaming report serialization cuts peak memory use by roughly 30 percent at scale. Port scans also show a progress indicator, and startup logging is quieter.

Defect Fixes

This release resolves the following issues:

  • Windows asset identification. Four operating system fields returned the same raw kernel build string, the Active Directory domain was not populated on domain-joined hosts, and serial number retrieval failed on virtual machines and cloud instances. All three are fixed, correcting asset grouping, unique device identification, and reporting by domain.

  • Scans under elevated accounts. Browser extension scans on macOS and Linux, and browser extension and installed application scans on Windows under SYSTEM, searched only the privileged account's own profile and returned no records. All user profiles are now enumerated.

  • Elasticsearch and Splunk delivery. JSON output combined with direct Elasticsearch delivery sent only the first batch of roughly 200 documents. Six flat NDJSON datasets emitted no top-level identifier, causing duplicate indexing and broken deduplication. A mapping conflict on the upgrade pathway field caused indexing failures on first write. Seventeen fields were misaligned between the Elasticsearch connector mapping and flat NDJSON output.

  • Missing report data. RHEL 9 hosts did not report cost fields because the platform string did not match the benchmark keyword table. Quantum readiness fields for FIPS mode and Secure Boot were not populated on Windows.

  • Scan reliability. Splunk connectivity is now verified before a scan starts rather than after. Local TLS, SSH, and ARP timeouts no longer stall scans. Invalid output formats are rejected at startup. Split output combined with minimal detail no longer produces empty files. S3 uploads no longer succeed with zero bytes when the output file does not yet exist. The 1,000 port limit can no longer be bypassed with multiple comma-separated ranges. Filesystem detectors now share a single directory walk per scan.

  • Delivery failure handling. When a delivery target is unreachable and a local output file is specified, the scan completes, writes the file, and exits with code 2 so automation can retry delivery instead of losing the scan. Where no file output is specified, the scan aborts with exit code 1 as before.

Security Vulnerability Resolution

This release resolves the following vulnerabilities:

CVE-2026-21807: A security analysis of the executable using the checksec utility revealed that the binary lacks several critical, industry-standard hardening protections.

CVE-2026-21808: The application includes a feature to generate a log file during execution. However, the current implementation is configured to output highly detailed information by default, effectively operating in a "DEBUG" or "Verbose" mode without explicit user activation.

CVE-2026-21809: The application’s license-key validation process provides overly descriptive error messages when it encounters malformed input.

CVE-2026-21810 : The application utilizes an embedded version of the OpenSSL binary, which is extracted during execution. Testing revealed that when the application is executed with certain command-line parameters or when it terminates under specific conditions, the cleanup routine fails.

CVE-2026-21807: A security analysis of the executable using the checksec utility revealed that the binary lacks several critical, industry-standard hardening protections.

CVE-2026-21808: The application includes a feature to generate a log file during execution. However, the current implementation is configured to output highly detailed information by default, effectively operating in a "DEBUG" or "Verbose" mode without explicit user activation.

CVE-2026-21809: The application’s license-key validation process provides overly descriptive error messages when it encounters malformed input.

CVE-2026-21810: The application’s HTML report generation feature includes a hardcoded reference to a CSS stylesheet /Javascripts hosted on an external Content Delivery Network (CDN). Security testing revealed that this URL is "baked" directly into the executable file.

CVE-2026-34181. A PKCS#12 authentication bypass. The PBMAC1 message authentication code defined in RFC 9579 was accepted with an HMAC key as short as one byte, making the code feasible to forge offline and allowing a keystore file to authenticate under the wrong password. Because PKCS#12 keystores are a primary format read during endpoint scans, a forged file could have caused the scanner to report certificate inventory that misrepresented the material actually present. Keystores using PBMAC1 with a key length below 20 octets are now rejected. Files using the standard legacy HMAC-SHA1 code, the default for most certificate export tooling, were never affected.

CVE-2025-61726. A memory exhaustion flaw in URL query parsing in the Go runtime, triggerable by a malformed query string and causing unbounded memory growth. Resolved by upgrading the runtime to Go 1.25.9. Deployments scanning externally controlled hosts in remote mode were the most exposed.

CVE-2025-9230. An out-of-bounds read and write in RFC 3211 key encryption key unwrapping in OpenSSL, reachable when processing a malformed wrapped key.

CVE-2025-9231. A timing side channel in the OpenSSL SM2 elliptic curve implementation on 64-bit ARM, which could allow an attacker with local access to recover private key material.

CVE-2025-9232. An out-of-bounds read in OpenSSL HTTP client proxy exclusion list parsing.

OpenSSL has been removed as a runtime dependency. If anything in your environment depended on the bundled OpenSSL binary for a purpose outside the scanner, note its removal.

Known Issues

Remote scans returning more than roughly 30,000 findings can exceed the 16 MB default memory allocation. Raise the allocation before processing result sets of that size.

How to Update

Stop any existing scan jobs, configure the QRA License Key and redeploy with the new scan tool. Make sure analysis is activated.

Resources

HCL BigFix Quantum Risk Analyzer product page: Quantum Cryptography Readiness & PQC Assessment | HCL BigFix

HCL BigFix Quantum Risk Analyzer for US federal agencies: HCL BigFix Quantum Risk Analyzer | HCL Federal

HCL BigFix documentation: HCL BigFix Documentation

Quantum Risk Analyzer documentation and output schema reference: BigFix Quantum Risk Analyzer

Site Versions

HCL BigFix Quantum Risk Analyzer: 2.0.4.10

BigFix Quantum Risk Analyzer: Site version 2

Thanks,

– The BigFix Quantum Risk Analyzer Team