Vulnerability scanner - no official fix

[German DiCasas]

Hi team,

I have the wazuh 4.14 and I can see all the vulnerabilities over my linux sistems. But I can see that sometimes the vulnerability is show but there are no fix to fix that .

There are any way to see the vulnerabilities list but with another column with that situation ? I mean, if the vulnerability have or not a fix?

Regards

German

[Alcides Moreno]

It is normal to see vulnerabilities listed without an available fix.

This happens because Wazuh synchronizes its database directly with the operating system vendors' security feeds. Sometimes vendors identify a security issue but have not yet released a patch for it, or they may still be working on the update.

The system shows you these alerts to ensure you have visibility into your risk profile, even if there isn't an immediate technical action you can take to resolve it via an update.

Whenever the vulnerability gets fixed, it will disappear from your Inventory.

Best regards,

Alcides.

[German DiCasas]

Yes, that is correct but what about to have another variable to check if exist or not the vendor fix? Its posible?

I mean, Wazuh can identify if the vendedor fix exist or not? If so, what variable is?

Regards

German

[Alcides Moreno]

Hello German,

You can open Vulnerability Detection -> Inventory -> Available Fields and toggle the field named vulnerability.under_evaluation, which indicates true when there is no fix, and indicates false when there is a fix.

Best regards,

Alcides

[German DiCasas]

Good to know that.. 

Does the vulnerability take into account the structure on which Linux is installed? I mean, is it a Linux AWS, Linux Azure, etc.

[Jose Camargo]

Hi German,

It takes the distro into consideration but not where it is installed. It's the same Red Hat (for example) if deployed in AWS or Azure.

[German DiCasas]

I have a CVE that is CVE-2025-9086 over a  Ubuntu 22.04.5 LTS (Jammy Jellyfish). Wazuh 4.14.1 show vulnerability.under_evaluation=false. But , the vendor have no fix for that CVE for now. So, I do not understand " the field named vulnerability.under_evaluation, which indicates true when there is no fix, and indicates false when there is a fix.  ". I added a image that show that cve
How can I filter if the fix exist or not? I would like to have a list of vulnerabilities that can be fixed and others that are still under review.

Regards,

German

[German DiCasas]

HI, there are any filter for that?

Regards

German

[German DiCasas]

Hi Jose, can you check it?

Let me know.

Regards

German