Summary

In December 2020 I published an advisory covering thirteen vulnerabilities in Quest Policy Authority for Unified Communications. The product had been end-of-life for over seven years at the time of the report. Quest acknowledged the findings and confirmed no patches would be issued. The disclosure went public the same day Quest closed the case.

This post is a five-year retrospective. I am not revisiting the technical findings. The vulnerabilities are still listed in NVD, the product is still unsupported, and the recommendations from the original advisory have not changed. What has changed is the broader ecosystem around how a researcher discloses, how a vendor responds, and how a downstream operator becomes aware of a vulnerability they need to patch. In late 2020 most of the institutional plumbing that exists today did not. This post documents what is different now, and asks the simple question: if I disclosed those same findings in 2026, would the outcome be any better?

Quick recap of the 2020 disclosure

   
Product Quest Policy Authority for Unified Communications
Affected version 8.1.2.200
Vulnerabilities reported 13 (CVE-2020-35203 through CVE-2020-35206, CVE-2020-35719 through CVE-2020-35727)
Vendor response time Within 24 hours on first contact
Patch status None. End-of-life product.
Public disclosure Same day as vendor closure of the case

The disclosure timeline ran from December 9 to December 16, 2020. Seven days from first email to public posting. Quest’s communication was professional throughout. The reason no patch arrived was not vendor neglect, it was vendor honesty about the product lifecycle.

What has actually changed since 2020

Five things, in roughly the order they happened:

Date Change Effect on the disclosure pipeline
2021-11 CISA published Binding Operational Directive 22-01 and the Known Exploited Vulnerabilities catalog Federal agencies must remediate listed CVEs by hard deadlines. The catalog is now widely cited as a downstream prioritisation source by private organisations as well. As of 2025 it covers roughly 1,500 entries.
2023-11-01 FIRST.org published CVSS v4.0 New base, threat, environmental, and supplemental metric groups. Replaces CVSS v3.1 as the recommended scoring framework. Adoption in NVD records is still partial as of 2026.
2024-02-12 NVD began slowing CVE enrichment (CPE matching, CVSS scoring, references). Backlog grew past 18,000 CVEs in 2024. Researchers and downstream consumers can no longer assume that an NVD record will arrive enriched within days. In April 2026 NIST formally changed policy to enrich only the subset of CVEs meeting risk criteria, leaving the rest as raw records.
2024-12-10 The EU Cyber Resilience Act entered into force Manufacturers of products with digital elements sold in the EU must support security updates for a defined period and handle vulnerabilities throughout the product lifecycle. Reporting obligations apply from 2026-09-11. Full obligations from 2027-12-11.
2025-04-16 The MITRE CVE program funding lapsed and was rescued at the deadline by an 11-month CISA contract extension. The CVE Foundation was launched in response. The institutional foundation that researchers depend on to assign CVE IDs is now visibly contingent. The Foundation exists to provide a non-governmental backstop.

These are the structural changes. There are also softer shifts in researcher practice that are harder to date precisely. More researchers now post first to a personal blog or GitHub gist and assign a CVE later. More vendors run formal bug bounty programs. More downstream consumers track vulnerability databases directly rather than waiting for NVD enrichment.

Would the Quest disclosure play out the same way today?

Probably yes for the technical content, but the surrounding context would be different in three concrete ways.

1. NVD enrichment is no longer guaranteed

In 2020 I submitted to Quest’s security inbox. MITRE assigned CVE identifiers within days. NVD enriched the records (CPE strings, CVSS vector, references) within roughly two weeks. By 2024 that pipeline had broken in a way that has not fully recovered. If I disclosed thirteen CVEs against an end-of-life Quest product in 2026, only the subset NIST classified as high-risk would receive prompt enrichment. The rest would sit as raw CVE records. For an attacker, that is meaningful: less context for downstream tooling, less visibility for defenders relying on automated CPE matching.

The ironic effect is that the Quest 2020 disclosure was easier to document and act on than an equivalent 2026 disclosure would be. The bottleneck has moved from vendor patch availability to public-record quality.

2. The CRA changes the EOL conversation in Europe

The Quest response in 2020 was that the product had been unsupported for over seven years and no patch would be issued. That is a defensible position for a US-headquartered vendor selling a product that has reached genuine end-of-life and was never relabelled as supported.

Under the EU Cyber Resilience Act, this position becomes harder to maintain for products sold into the EU after the regulation applies. Manufacturers must define a support period, handle vulnerabilities during it, and document the security update lifecycle. The Quest UC product would not be subject to the CRA retroactively, and Quest may not have continued to sell into the EU at the time of disclosure. But for a comparable product on sale in 2026 and beyond, the answer “no patch, end of life” is a regulatory question, not just a customer-relations question.

In practice this means EU researchers reporting issues against EU-sold products now have a clearer escalation path when a vendor declines to patch. ENISA reporting obligations from September 2026 onwards will further shift the disclosure paperwork.

3. KEV listing is the new severity signal

In 2020 a researcher disclosed, NVD enriched, and downstream operators decided what to patch based on CVSS and their own risk assessment. By 2026 the practical question for many defenders is not “what is this CVE’s CVSS score” but “is it on KEV”. That is a narrower question and a more actionable one.

The Quest UC vulnerabilities would not have made KEV. There is no public evidence of exploitation, the affected product population is small, and the product is end-of-life. CISA’s listing criteria reasonably exclude this category. The same logic applies to most XSS, CSRF, and SSRF findings in niche enterprise software. KEV is a useful signal precisely because it is narrow. The downside is that the CVE-but-not-KEV middle band has become harder for defenders to triage.

The 2020 advisory recommended decommissioning the product. That recommendation still holds, and the absence from KEV does not change it.

The 2026 disclosure workflow, briefly

For comparison with the 2020 timeline, here is what the same disclosure flow looks like now:

Step 2020 2026
Initial vendor contact [email protected] Same. Some vendors now run a HackerOne or Bugcrowd program instead.
Triage Vendor confirms within days Variable. Established vendors meet the same SLA. Smaller vendors have moved to “we will respond when we can”.
CVE assignment Vendor or MITRE Vendor CNA where one exists, MITRE root otherwise. The CVE Foundation now provides a contingent backstop.
NVD enrichment Within ~2 weeks Variable. Top-tier risk: enriched. Everything else: raw record only.
KEV consideration N/A Only if active exploitation evidence exists
Public disclosure After patch or after coordinated period Same. 90 days remains the de facto norm.
Defender pickup NVD feed or vendor advisory NVD feed (with caveats above), KEV catalog, vendor advisory, vulnerability-management vendors that re-enrich raw CVEs

The end-to-end time from researcher-finds-bug to defender-aware-of-bug is not dramatically different. What is different is how much context arrives with the CVE record, how confidently a defender can rank it against thousands of others, and how much regulatory machinery now applies to the vendor.

Closing thoughts

The Quest UC disclosure was a small piece of routine vulnerability research. Five years later the same routine still works, but the surrounding ecosystem has had a turbulent half-decade. The CVE program nearly went dark for a week in April 2025. NVD has effectively conceded that it cannot enrich every record. The EU has decided that “end-of-life, no patch” is no longer a complete answer for products sold into its market. CISA has pulled the most operationally important subset of CVEs into a separate catalog with hard deadlines.

For researchers, the practical guidance is unchanged. Document carefully. Coordinate with the vendor. Cite primary sources. Publish when the responsible-disclosure window closes. The infrastructure around these steps is less stable than it was in 2020. Plan accordingly.

For organisations still running Quest Policy Authority for Unified Communications in 2026, the original recommendation stands. The product is unpatched and unsupported. Decommission it.

References