Qualys VMDR
2026-10-21-c6c470e7 commercialThe section your link pointed to isn't on Qualys VMDR's page any more, so we've brought you to the top.
Qualys VMDR is a cloud-based vulnerability management platform that continuously discovers, assesses, prioritizes, and remediates security vulnerabilities across IT assets.
Summary
Qualys VMDR is a commercial vulnerability-management platform, run as a cloud-delivered service, that scans an organisation's assets for known vulnerabilities and prioritizes them for remediation. It is aimed at vulnerability-management and SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. teams responsible for patch prioritization across mixed operating-system and application estates rather than at individual developers. Coverage is driven by a continuously updated knowledgebase of QIDs, searchable to check whether a given host is affected; recent additions cover a high-severity Local Privilege Escalation in snap-confine on Ubuntu Desktop and the Oracle July 2026 Critical Patch Update spanning Java SE, WebLogic, E-Business Suite, MySQL, and Solaris, giving a sense of how broadly it tracks vendor advisories. It sits in the vulnerability-management category alongside asset-scanning and patch-prioritization tools generally.
Qualys VMDR is a cloud-based vulnerability management platform that continuously discovers, assesses, prioritizes, and remediates security vulnerabilities across IT assets.
Qualys VMDR publishes no documentation we track, so the description above is written from general knowledge rather than the vendor's own words.
How Qualys VMDR helps
Which of our hosts are running software affected by a newly disclosed vulnerability?
matches the asset inventory against the knowledgebase entry for the new QID and lists every host whose installed version falls in the affected range
Which vulnerabilities on our network should get patched first?
scores each detected flaw by severity and exploitability and ranks affected assets so remediation effort goes to the highest-risk exposures first
Is a given host affected by a specific CVE we just read about?
looking up the CVE in the knowledgebase surfaces its QID, and checking that QID against the host's scan history gives a yes or no
Have we already been patched against last month's vendor advisories?
cross-references the CPU or advisory's associated QIDs against each asset's latest scan result, showing which systems remain unpatched
Which of our mixed Windows, Linux, and application estates share the same unpatched flaw?
aggregates QID matches across the whole inventory regardless of operating system, grouping affected assets under the one vulnerability they have in common
Are our Ubuntu Desktop machines exposed to the latest privilege-escalation flaw?
the corresponding QID detection flags any default 24.04, 25.10, or 26.04 installation still missing the fix, pointing at the exact hosts needing attention
Features
Built from Qualys VMDR's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date.
No capabilities match.
All capabilities 3 capabilities
Vulnerability detection coverage shipped Detects vulnerabilities across Linux distributions and enterprise vendor patch cycles by adding QIDs for CVEs and vendor critical patch updates.
release
-
Introduces InstaScan, a scanless scanning capability that delivers a finding within an hour of a vendor disclosure.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
changelog · Sep 2026
· source
· release history
- Adds QID detections for Oracle July 2026 Critical Patch Update (CPUJUL2026) covering JDeveloper, Java SE, Coherence, VirtualBox, HTTP Server, Solaris 11.4, WebLogic Server, E-Business Suite, and MySQL Server. changelog · Jul 2026 · source · release history
- New QID detection(s) for CVE-2026-8933, a high-severity Local Privilege Escalation in snap-confine affecting default Ubuntu Desktop 24.04, 25.10, and 26.04 installations. changelog · Jul 2026 · source · release history
Exploitability prioritization shipped Tests exploitability against an environment's actual firewall and EDR controls to prioritize vulnerabilities beyond theoretical scoring.
release
-
Adds hyper-prioritization that tests exploitability against a given environment's actual firewall and EDR controls, rather than using theoretical scoring.
changelog · Sep 2026
· source
· release history
Vulnerability knowledge base shipped A searchable knowledge base of QIDs that lets users verify vulnerability coverage and prioritize remediation.
example
-
Search the Qualys Vulnerability Knowledgebase for the new QIDs to verify coverage and prioritize patching of affected Ubuntu systems.
In the Qualys VMDR console, go to Vulnerabilities > Knowledgebase and search for CVE-2026-8933 to retrieve the associated QIDs and confirmed detection status.changelog · Jul 2026 · source
Lines in monospace are the tool's own words: help text
parsed from its source, or an endpoint from its API document. Under
release, a line is our summary of a dated release. Under
docs, it is quoted from the tool's own documentation or
website. Each links back to the source it came from.
Media
Videos from the release notes, newest first. They play right here.Score card
-
Shipping velocity releases a month, last 12 months
-
Documentation quality release-notes rubric, 0–100
-
Breaking-change discipline how rarely a release breaks users, and notice given
-
Maintenance risk quiet time against its own cadence, maintainers
-
Innovation & surface new capabilities, API and MCP surface
Five scores for Qualys VMDR, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.
Score cards are part of every paid plan.
See plans → Already subscribed? Sign in →Trajectory
Blank means never measured; nothing here is a filled-in zero.
Peer standings are included with Researcher and Business. See how this tool ranks against its competitors, using data we don't publish anywhere else.
See plans →Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.
How this is scored
- Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
- Documentation quality — the release-notes rubric published on the analytics page, unchanged.
- Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
- Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
- Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
- Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
- Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
- Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.
Release-note detail over time
See how much detail Qualys VMDR puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.
Checking release-note history…
Website history
qualys.com, every changeQualys's home page and 40 more pages as they looked each month from August 2021 to October 2026: 155 renders, 84 changes of tagline or palette. Step through them, play them, or put any two months side by side.
Website history is included with Researcher and Business.
See plans → Already subscribed? Sign in →← → or h l a month · Shift a year · [ ] previous / next change · Space play · 1 2 3 page · T whole page · C compare · F full size
← → or h l the right month · Shift the left · S swap · W wipe · T whole page · Esc back
Rebranding timeline
Dates bound when a change appeared between captures. Possible rebrands are AI suggestions; a redesign alone does not establish a rebrand.
Coverage
Missing something? Tell us
What Qualys VMDR connects to, runs on and detects, read from its release notes and docs. So far: 1 new vulnerability check, 1 new supported platform.
2 changes, tracked since Oct 21, 2026.
-
Oct 212026
new PHP vulnerability detection QIDs (PHP2Shell, distribution advisories, CVE-2026-109618/CVE-2026-109619)
With QID 389102
Detection QIDs Qualys released the following detection QIDs, which are now available. We will add distribution-specific detection QIDs to this blog as they are released.
-
Oct 212026
new InstaScan advisory sources for PHP vulnerability coverage
With Red Hat, Ubuntu, Debian, Oracle Linux
Supported advisory sources include Red Hat, Ubuntu, Debian, and Oracle Linux, helping teams respond across mixed Linux environments.
Operating systems 4
Nothing first seen in this window. That doesn't mean Qualys VMDR shipped nothing, only that we found no record of it.
How we count
Read from 1 of 5 release notes and docs updates we hold for Qualys VMDR. "First seen" is the earliest note that names something; "last" is the latest. Our history may start partway through Qualys VMDR's life, so an old integration can show a recent first-seen date.
Each change counts once: "added 40 checks" is one line, so the numbers measure how often coverage moves, not how big the catalogue is or how well it detects.
Releases
5 entries
No entries match these filters.
- October 20261
- September 20262
- July 20262
Add the badge to your README
Maintain this project? The badge links readers straight to this page, so they can follow every release here.
Choose a badge style and copy the code →