Report a vulnerability
To report a vulnerability in a HARDAC product or website, or one you believe falls within our scope, email [email protected] with the affected product, version, and steps to reproduce.
Security advisories
What we have found, and what contractors need to know.
Two kinds of advisory. Guidance advisories set out a rule, a change or a cost from primary sources, with the steps a contractor can act on; each carries a version and a change log. Vulnerability advisories cover weaknesses HARDAC has identified, with CVE IDs, affected versions and remediation, published after the vendor has had the opportunity to release a fix.
AdvisoryTitleTypePublished
HARDAC-ADV-2026-01
FIPS 140-2 Certificates Are Now Historical: What Changes for CMMC Control 3.13.11
On 21–22 September 2026, NIST's Cryptographic Module Validation Program (CMVP) moved every FIPS 140-2 certificate to its Historical List.
What a Cryptographic Inventory for CMMC Control 3.13.11 Actually Costs
CMMC control SC.L2-3.13.11 requires FIPS-validated cryptography wherever cryptography protects the confidentiality of CUI.
Why "FIPS Mode Enabled" Is Not 3.13.11 Evidence: How FIPS Validation Status Gets Reported Wrongly
NIST SP 800-171 control 3.13.11, carried into CMMC as SC.L2-3.13.11, asks whether FIPS-validated cryptography is employed to protect the confidentiality of CUI.
The Post-Quantum Deadlines That Now Bind Federal Contractors and Vendors
Between November 2025 and October 2026 the federal post-quantum cryptography (PQC) requirements turned from targets into dated obligations with gates.
About these advisories
Reporting, CVE IDs, and reuse.
CVE IDs
Each advisory lists the CVE ID assigned to the vulnerability. The corresponding CVE Record is published on cve.org.
Free to use
Advisories are public, require no account, and may be copied, redistributed, and used for any purpose, consistent with the CVE Program Terms of Use.