Operating System Updates and Qualys

When reviewing vulnerability scan results in the Qualys VMDR dashboard, system administrators often observe multiple active detection entries (QIDs) covering consecutive months of Microsoft Security Updates (e.g., April through September). This article explains the underlying mechanism Qualys uses to detect Microsoft vulnerabilities, why multiple historical updates appear simultaneously, and how patch supersedence functions in reporting views.

1. Detection Mechanism: Binary & File Version Auditing
2. Detection Logic Across System Components
3. Understanding Cumulative Updates & Multiple Active QIDs
4. Patch Supersedence & Reporting Filters

Detection Mechanism: Binary & File Version Auditing

Unlike patch management tools that check Windows Update installation history or installed KB IDs, Qualys performs authenticated vulnerability checks by evaluating actual binary file versions present on the host system.
When auditing a target endpoint, Qualys checks core system files against the minimum file version required by Microsoft's security advisories:

• File Target: For Windows Operating System Cumulative Updates, Qualys primarily checks core kernel binaries, such as ntoskrnl.exe.
• File Location: C:\Windows\System32\ntoskrnl.exe
• Evaluation Criteria: If the file build version on the system is lower than the minimum required version specified by a monthly patch QID, the QID is flagged as Active.

Detection Logic Across System Components

Different components and software frameworks utilize specific inspection rules based on where binaries and configuration attributes reside:

Windows Operating System Updates

• Inspects system binaries (e.g., ntoskrnl.exe).
• Compares the host build number against Microsoft build baselines.
• Example: If a September update requires version 10.0.26100.9444 and the endpoint is on10.0.26100.8653, the host is identified as missing all cumulative patches that required a build higher than .8653.

Microsoft .NET Security Updates

For framework updates, Qualys inspects assembly versions and registry keys:

• Assembly DLL Versions: Inspects core runtime binaries such as clr.dll or mscorlib.dll located under C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ (for .NET Framework) or runtime binaries under C:\Program Files\dotnet\shared\ (for .NET Core / .NET 6+).
• Registry Keys: Queries system registry keys (e.g., HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full) to confirm servicing levels and release DWORDs.

Understanding Cumulative Updates & Multiple Active QIDs

Microsoft updates are cumulative, meaning each monthly release incorporates all fixes from preceding updates. However, in raw vulnerability scan data:

1. Individual QID Evaluation: Every monthly security bulletin corresponds to a specific Qualys ID (QID) with its own target binary version threshold.
2. Missing Patch Baselines: If an endpoint has not been updated for several months, its current file version will fail the version check for each missed monthly update (April through September).
3. Multi-QID Flagging: Because the local file version satisfies the vulnerability criteria for all those individual checks, Qualys flags every unapplied monthly QID as Active.

Applying the latest cumulative update (e.g., September) updates the target system binaries to the highest required version, which automatically closes and resolves all previous months' QIDs upon the next scan.

Patch Supersedence & Reporting Filters

To prevent historical QIDs from inflating raw vulnerability counts, Qualys provides reporting mechanisms to account for patch supersedence:

• Raw Scan View (VMDR Default): Displays all QIDs that meet the specific binary condition, regardless of whether a newer cumulative update exists.
• Exclude Superseded Patches Filter: When configured in Qualys Report Templates, enabling the Exclude Superseded Patches setting filters out older monthly QIDs, displaying only the latest cumulative patch required to remediate the endpoint.