Qualys Patch Management

No entries match these filters. Clear filters

1. changelog Oct 28, 2026 · issue 124
   • New vulnerability check Node.js vulnerability detections (QIDs)
2. changelog Oct 14, 2026 · issue 112

   TruRisk Eliminate 2.0 debuts TruConfidence AI orchestration engine and Agent Sara for autonomous, ring-based patch remediation at scale.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢
   • Introduces TruRisk Eliminate 2.0, an Autonomous RemOps platform that replaces ticket-driven patching with a continuous Decide → Execute → Prove cycle across the full attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces TruConfidence, an AI-powered Remediation and Orchestration Intelligence engine that selects the safest remediation action — patch, mitigation, uninstall, or existing control — per validated exposure.
   • Introduces Agent Sara, Qualys' autonomous AI agent, which executes TruConfidence remediation plans in customer-defined waves and progressive rings with automatic rollback on anomaly detection.
   • Extends scanner-based remediation to edge and perimeter devices using existing Qualys scanners, closing coverage gaps that agent-only approaches miss.
   • Supports zero-touch automation for high-reliability patches on low-impact applications alongside ring-based deployment for higher-risk changes, with operational health monitoring and sub-0.1% rollback rate.

   5 details in Everything

3. changelog Oct 14, 2026 · issue 017

   TruRisk Eliminate 2.0 debuts TruConfidence AI orchestration engine and Agent Sara for autonomous, ring-based patch remediation at scale.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢
   • Introduces TruRisk Eliminate 2.0, an Autonomous RemOps platform that replaces ticket-driven patching with a continuous Decide → Execute → Prove cycle across the full attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces TruConfidence, an AI-powered Remediation and Orchestration Intelligence engine that selects the safest remediation action — patch, mitigation, uninstall, or existing control — per validated exposure.
   • Introduces Agent Sara, Qualys' autonomous AI agent, which executes TruConfidence remediation plans in customer-defined waves and progressive rings with automatic rollback on anomaly detection.
   • Extends scanner-based remediation to edge and perimeter devices using existing Qualys scanners, closing coverage gaps that agent-only approaches miss.
   • Supports zero-touch automation for high-reliability patches on low-impact applications alongside ring-based deployment for higher-risk changes, with operational health monitoring and sub-0.1% rollback rate.

   5 details in Everything

4. changelog Sep 29, 2026 · issue 089

   Qualys TruRisk Eliminate adds Patch Blocking Rules and AI-Powered Patch Reliability Scoring to keep bad patches out of automation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Immediately stop a vendor-paused or known-bad Windows patch from deploying across your entire environment without touching individual patch jobs.
   📍In TruRisk Eliminate, go to TE › Configuration › Patch Blocking Rules, select Windows, click Create Rule. Enter a name (e.g. Block paused Sep-2026 updates) and a blocking reason. Under Criteria (QQL), enter: patch.kb: [KB5002907, KB5124008, KB5124012, KB5123099] and click Preview to confirm the match. Leave asset tags empty to cover all assets, then save.
   Protect production assets while a test group validates a new patch by scoping a blocking rule to production asset tags.
   📍In TruRisk Eliminate, go to TE › Configuration › Patch Blocking Rules, select Windows, click Create Rule. Enter a name (e.g. Hold KB5002907 from prod during validation) and a blocking reason. Under Criteria (QQL), enter: patch.kb: [KB5002907] and click Preview. Under asset scope, add up to five production asset tags to restrict the block to production only, then save.
   Keep zero-touch patch jobs running while automatically skipping low-reliability patches by adding reliability intelligence to the job's patch-selection query.
   📍In the zero-touch patch job's Select Patches step, update the QQL to include reliability criteria alongside your existing filters so that Low-reliability patches — such as those currently rated Low by AI-Powered Patch Reliability Scoring — are excluded from automatic deployment while all other patches continue to deploy.
   • Adds Patch Blocking Rules in TE > Configuration > Patch Blocking Rules (available for Windows, Linux, and Mac in release 4.2), letting you define patches via a QQL query and block them across every deployment job at once without editing individual jobs; scope is controlled by up to five asset tags per rule, with up to 10 rules per platform, and each rule requires a name and blocking reason.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds AI-Powered Patch Reliability Scoring that combines LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. analysis of real-world internet feedback with Qualys rollback and vulnerability-reopen telemetry to rate each patch High, Medium, Low, or Unidentified — automatically skipping Low-reliability patches from zero-touch jobs when reliability intelligence is added to the job's QQL in the Select Patches step.
   • Introduces Qualys-curated mitigations as a complementary layer to reduce exposure while a blocked or low-reliability patch is held in testing and staging.

   3 details in Everything

5. changelog Sep 29, 2026 · issue 014

   Qualys TruRisk Eliminate adds Patch Blocking Rules and AI-Powered Patch Reliability Scoring to keep bad patches out of automation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Immediately stop a vendor-paused or known-bad Windows patch from deploying across your entire environment without touching individual patch jobs.
   📍In TruRisk Eliminate, go to TE › Configuration › Patch Blocking Rules, select Windows, click Create Rule. Enter a name (e.g. Block paused Sep-2026 updates) and a blocking reason. Under Criteria (QQL), enter: patch.kb: [KB5002907, KB5124008, KB5124012, KB5123099] and click Preview to confirm the match. Leave asset tags empty to cover all assets, then save.
   Protect production assets while a test group validates a new patch by scoping a blocking rule to production asset tags.
   📍In TruRisk Eliminate, go to TE › Configuration › Patch Blocking Rules, select Windows, click Create Rule. Enter a name (e.g. Hold KB5002907 from prod during validation) and a blocking reason. Under Criteria (QQL), enter: patch.kb: [KB5002907] and click Preview. Under asset scope, add up to five production asset tags to restrict the block to production only, then save.
   Keep zero-touch patch jobs running while automatically skipping low-reliability patches by adding reliability intelligence to the job's patch-selection query.
   📍In the zero-touch patch job's Select Patches step, update the QQL to include reliability criteria alongside your existing filters so that Low-reliability patches — such as those currently rated Low by AI-Powered Patch Reliability Scoring — are excluded from automatic deployment while all other patches continue to deploy.
   • Adds Patch Blocking Rules in TE > Configuration > Patch Blocking Rules (available for Windows, Linux, and Mac in release 4.2), letting you define patches via a QQL query and block them across every deployment job at once without editing individual jobs; scope is controlled by up to five asset tags per rule, with up to 10 rules per platform, and each rule requires a name and blocking reason.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds AI-Powered Patch Reliability Scoring that combines LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. analysis of real-world internet feedback with Qualys rollback and vulnerability-reopen telemetry to rate each patch High, Medium, Low, or Unidentified — automatically skipping Low-reliability patches from zero-touch jobs when reliability intelligence is added to the job's QQL in the Select Patches step.
   • Introduces Qualys-curated mitigations as a complementary layer to reduce exposure while a blocked or low-reliability patch is held in testing and staging.

   3 details in Everything

6. changelog Aug 18, 2026 · issue 050

   Qualys Patch Management adds AI-Powered Patch Reliability Scoring combining LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. sentiment analysis and telemetry signals.

   ⤢ ⤢ ⤢
   • New Qualys AI-Powered Patch Reliability Scoring predicts patch deployment success before rollout by combining LLM-analyzed global public sentiment (technical discussions, release feedback) with Qualys telemetry on patch rollback rates and vulnerability reopen rates into a single reliability score.
   • TruRisk Eliminate now reports true remediation state — including reboot completion — so teams can verify KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. deadline compliance after deploying cumulative updates.

   2 details in Everything

7. changelog Jul 21, 2026 · issue 021

   Qualys TruRisk Eliminate adds AI-Powered Patch Reliability Score and zero-touch automation for low-risk application patching.

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Use Patch Now to immediately deploy patches for a specific CVE directly from the vulnerability finding in Qualys Patch Management.
   📍In the Qualys Patch Management console, locate CVE-2026-8933 in the vulnerability list, then click Patch Now (to the right of the vulnerability) to add it to a patch job targeting vulnerable assets.
   • New AI-Powered Patch Reliability Score uses crowd-sourced signals from patch deployments across the internet to assess whether a patch is safe to deploy before rollout.
   • New zero-touch patch automation enables low-risk applications (e.g., browsers and standalone software) to receive patches automatically after a one-time job setup, with no manual intervention required.
   • Supports autonomous remediation workflow: high-reliability patches deploy with confidence while low-reliability patches are flagged for review, balancing speed and production safety.

   3 details in Everything

8. changelog Jul 8, 2026 · issue 009

   Qualys Patch Management adds autonomous zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. remediation via TruRisk Eliminate and Windows 11 upgrade orchestration through QQL and CAR scripts.

   ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Identify and deploy Windows 11 enablement packages at scale to upgrade endpoints already running recent Windows 11 builds with minimal operational impact.
   📍In TruRisk Eliminate Patch Catalog, run QQL: patch.title:"Enablement" — select the matching patch, create a patch job, and target the relevant asset groups.
   Find ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability.-based Windows feature update patches for environments where enablement packages are unavailable (e.g., 23H2 → 24H2 transition).
   📍In TruRisk Eliminate Patch Catalog, run QQL: patch.isFeatureUpdate:true AND patch.vendor:Microsoft — enable the required ISO package, then create and deploy a patch job to the target asset groups.
   Directly upgrade Windows 10 endpoints to the latest Windows 11 build without intermediate steps using a pre-built CAR library script.
   📍In TruRisk Eliminate, navigate to Script Library → System Updates and Upgrades → Windows OS Upgrades, select the Windows 10 to Windows 11 upgrade script, import it in approved mode, and execute it on the required asset groups.
   • New autonomous remediation workflows via Qualys TruRisk Eliminate enable machine-speed patching, mitigation, container image replacement, workload isolation, and firewall policy updates triggered directly from confirmed vulnerability findings.
   • Supports patchless/compensating mitigation actions when immediate patching is not feasible, reducing exposure window while permanent fixes are prepared.
   • Enables enterprise-wide Windows 11 upgrade orchestration through TruRisk Eliminate, covering three paths: enablement packages, ISO-based feature updates, and direct Windows 10-to-Windows 11 upgrades.
   • New QQL filters for patch targeting: patch.title:"Enablement" for enablement packages and patch.isFeatureUpdate:true AND patch.vendor:\Microsoft\ for ISO-based feature updates.
   • Windows 10-to-Windows 11 upgrade scripts now available in the Custom Assessment and Remediation (CAR) library under Script Library → System Updates and Upgrades → Windows OS Upgrades.

   5 details in Everything