PCI & SSL/Early TLS QIDs 38601, 42366 | Qualys
Summary: Qualys announced that QIDs 38601 and 42366 will be marked as PCI Fail on May 1, 2019, per the ASV Program Guide, which requires automatic failure for components supporting SSL or early TLS, or strong cryptography alongside them due to forced-downgrade risk. ASV scan customers were previously told in an April 18, 2017 Qualys blog post to migrate away from SSL/early TLS by June 30, 2018, with compensating controls or an approved false positive/exception available where a system is not susceptible to particular vulnerabilities.
What you should know: A scan result that reads as a PCI failure can put a merchant's compliance standing on the line, and the migration deadline of June 30, 2018 had already passed before the May 1, 2019 marking took effect.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026