Vulnerability Scanner

The problem

Patch currency is the single most-asked question in a CMMC assessment. The DoD takes the CISA KEV catalog seriously, and any KEV match on a contractor system is automatically a finding, regardless of CVSS score and regardless of how recent the entry is. Log4j 2.14.0 in production in 2026 is not a debate the contractor wins.

Commercial vulnerability scanners send package inventories to a SaaS backend. For environments handling CUI, that exfiltrates exactly the kind of asset data the contractor is trying to protect under the same controls the scan is supposed to support. The on-prem alternative is to bundle the database with the scanner and update it via signed fetch on explicit invocation, no scan-time network calls, no dependency on a vendor cloud, no exfiltration risk.

CPE matching is the harder half of the problem. Package names rarely match CPE product strings exactly, since openssl, python3, log4j-core, and dozens of others all need normalization tables. The bundled database covers the common cases; mismatches surface as INFO findings rather than silent misses, so the contractor is never falsely told their fleet is clean.

What CMMC requires

NIST SP 800-171 Rev 2 controls this agent verifies. Primary mappings drive the gap assessment; secondary mappings provide supporting evidence in the SSP.

How it works

Per-platform detection logic. The agent runs unprivileged where possible and falls back gracefully when raw access is unavailable.

What it finds

Concrete findings written to the assessor's mental model,not abstract categories. Severity drives POA&M priority and SPRS deduction.

• CRITICAL
  CISA KEV match on installed package

  Package version matches a CISA Known Exploited Vulnerabilities entry. Active exploitation in the wild,automatic CRITICAL regardless of CVSS score.
• CRITICAL
  CVSS 9.0+ vulnerability with no patch applied

  Installed package matches a CVE with CVSS v3 score 9.0 or higher. Days-since-published exceeds the 30-day DoD remediation window.
• HIGH
  Windows host more than one cumulative update behind

  Host build/UBR is two or more cumulative updates behind the current release. Multiple security fixes unapplied.
• HIGH
  End-of-life package with no upstream patches

  Installed package version is past EOL and receives no further security updates. The remediation is upgrade or removal, not patching.
• MEDIUM
  CVSS 4.0–6.9 medium-severity match

  Package matches a medium-severity CVE. Within remediation timeline tolerance but tracked toward the SPRS POA&M deadline.

How it hooks into the platform

Inventory and CVE correlation run on every discovered host on a cadence the platform sets, against the bundled NVD and CISA KEV database; no scan-time network calls. You decide whether the inventory and CVE matches stay on-prem or sync up, which keeps the agent workable in air-gapped enclaves. Inventory becomes the SSP's installed-software baseline under 3.4.1. Findings link to specific CVE IDs with CVSS vectors and KEV due dates across 3.11.2, 3.11.3, and 3.14.1. POA&M items track per-package remediation against the 30-day DoD window with overdue-day counts.

How we know it's working

Acceptance criteria from the engineering spec,what the agent must do to ship.

• ✓Inventories 1000+ packages per host in under 60 seconds
• ✓Normalizes openssl, curl, openssh, log4j, python, nodejs, nginx, apache2, and mysql to CPE
• ✓Flags any CISA KEV match as CRITICAL regardless of CVSS score
• ✓Returns CVSS score and vector with every CVE finding
• ✓Ships with three-plus years of NVD data bundled offline
• ✓Verifies SHA-256 of every database update against the NVD feed
• ✓Falls back to the bundled database if an updated copy is corrupt
• ✓Performs zero outbound network calls during the scan itself