Web Application Scanning Engine Release 10.18
July 31, 2026
New Detection - QID 150607: Network Connection and Timeout Error Reporting
We have introduced a new information gathering (IG) detection to identify and report network connection failures and timeout errors encountered during web application crawling. The scanner now captures resources that fail to load due to network errors from the browser's rendering engine, giving you clear visibility into connectivity issues that may affect scan coverage.
QID 150607 reports up to 20 URLs by default, along with a summary showing the total error counts across all affected URLs. Use this detection to pinpoint connectivity gaps and confirm that your target application is fully reachable during scans.
New Detection - QID 150609: OAuth2 State Parameter CSRF Protection Check
We have added a security validation to detect missing state parameters in OAuth2 authorization requests. The scanner now reports when OAuth2 flows lack the state parameter, which is essential for cross-site request forgery (CSRF) protection.
This detection covers both the Authorization Code and Implicit grant types. It supports standard OAuth2 configurations as well as Selenium-based authentication scripts in API Security scans. Use QID 150609 to confirm that your OAuth2 implementations enforce CSRF safeguards.
New Detection - QID 150611: Redirect Response Code Reporting
We have introduced a new information gathering (IG) detection to identify and report URLs that return redirect status codes during web application crawling. The scanner now tracks redirect responses in the 300 to 399 range, helping you understand how your application handles redirection.
QID 150611 reports up to 50 URLs by default. Use this detection to review redirect behavior and identify potential misconfigurations or unexpected redirect chains.
New Detection - QID 150608: Third-Party Cookie Excluded From Cookie Testing
We have added a new detection to report all third-party cookies that are excluded from cookie testing. QID 150608 provides transparency into which cookies fall outside the scope of cookie testing, so you can confirm that exclusions align with your security expectations.
Cookie Testing Optimization
We have extended the cookie exclusion mechanism to skip fuzzing of infrastructure-related cookies, such as those managed by load balancers, content delivery networks (CDNs), and security services. These cookies are controlled by infrastructure components rather than application logic, so fuzzing them adds little security value.
By excluding these cookies from testing, the scanner reduces scan time significantly while maintaining thorough coverage of application-managed cookies.
Issues Addressed
The following important and notable customer issues are fixed in this release.
| Category/Component | Description |
|---|---|
|
Retest Scan for QID 151070 |
We fixed an issue where a vulnerability fixed on one URL, but still present on another URL, was incorrectly reported as ACTIVE instead of FIXED during retest. The scanner now tests the originally reported URL individually and assigns the correct status. When the vulnerability is resolved on that URL, it is marked as FIXED, even if the same vulnerability remains on other URLs of the web application. This is a behavior change for QID 151070. |
|
Retest Cookie Detections |
We fixed an issue where a cookie with a dynamically generated name (for example, IHYOIYUOIW_) was reported as NOT_TESTED during retest when the cookie was not found in a subsequent scan. When the scan completes successfully and the scanner now marks the vulnerability as FIXED (test_failed) instead of NOT_TESTED. This applies only to dynamic cookies that are never found in subsequent scans. This is a behavior change visible in the user interface, and it applies to the following QIDs:
|
Qualys Notifications: Application Security Detections Published in May 2026 | Application Security Detections Published in June 2026