Traws Pharma, Inc.

Managements’ Evaluation of our Disclosure Controls and Procedures

Our management, with the participation of our principal executive and principal financial officers, evaluated the effectiveness of our disclosure controls and procedures as of September 30, 2025. The term “disclosure controls and procedures,” as defined in Rules 13a-15(e) and 15d-15(e) promulgated under the Securities Exchange Act of 1934, as amended (the “Exchange Act”), means controls and other procedures of a company that are designed to ensure that information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is accumulated and communicated to the company’s management, including its principal executive and principal financial officers, as appropriate to allow timely decisions regarding required disclosure. Based on the evaluation of our disclosure controls and procedures as of September 30, 2025, and due to the identification of material weaknesses in our internal controls over financial reporting as of December 31, 2024, as discussed in additional detail in our Annual Report, which had not been remediated as of September 30, 2025, our principal executive and principal financial officers concluded that, as of such date, our disclosure controls and procedures were not effective.

Inherent Limitations on Effectiveness of Controls

Our management does not expect that our disclosure controls and procedures or our internal control over financial reporting will prevent or detect all errors and all fraud. A control system, no matter how well-designed and operated, can provide only reasonable, not absolute, assurance that the control system’s objectives will be met. The design of a control system must reflect the fact that there are resource constraints, and the benefits of controls must be considered relative to their costs. Further, because of the inherent limitations in all control systems, no evaluation of controls can provide absolute assurance that misstatements due to error or fraud will not occur or that all control issues and instances of fraud, if any, have been detected. The design of any system of controls is based in part on certain assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its stated goals under all potential

future conditions. Projections of any evaluation of the effectiveness of controls to future periods are subject to risks. Over time, controls may become inadequate because of changes in conditions or deterioration in the degree of compliance with policies or procedures.

Changes in Internal Control Over Financial Reporting

Our management, with the participation of our principal executive and principal financial officers, evaluated any changes in our internal control over financial reporting (as such term is defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) that occurred during our most recently completed fiscal quarter. Based on that evaluation, our principal executive and principal financial officers concluded that, other than those remediation efforts discussed in “Management’s Plan for Remediation,” no change in our internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) occurred during the fiscal quarter ended September 30, 2025 that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting.

Management's Plan for Remediation

As previously disclosed in Item 9A of our Annual Report, management identified material weaknesses in our internal control over financial reporting due to the fact that our controls were not effectively updated and implemented to reflect the changes in processes and staffing as a result of the Merger. This is the result of not having a sufficient risk assessment process in place post-Merger to identify and analyze risks of misstatement due to fraud and/or error. Additionally, management determined that there was an inadequate segregation of duties over the preparation, review and posting of manual journal entries.

As of September 30, 2025, we have made progress against the remediation plan that we previously disclosed under Item 9A. Controls and Procedures in our Annual Report. In furtherance of such remediation efforts, we have engaged various consultants with finance and accounting experience; taken steps to educate our employees and consultants with respect to their respective responsibilities under our policies and procedures to ensure that such policies and procedures are properly implemented and followed; engaged with the Audit Committee, our independent accounting firm and our SOX advisors to identify breakdowns in our processes and procedures and risks associated therewith, as well as to identify areas for improvement. While we believe that our remediation plan, once fully implemented, will be sufficient to remediate the material weaknesses prior to December 31, 2025, such a conclusion cannot be reached until applicable controls have been designed, implemented and have operated for a sufficient period of time and management has concluded, through testing, that these controls are operating effectively. As of September 30, 2025, this evaluation remains ongoing.