Does a CVE match mean the device is vulnerable?
Not necessarily. A match means that information in the device inventory corresponds to information in the CVE record. Device configuration, enabled features, and other conditions may determine whether the vulnerability applies or can be exploited.
Treat a match as a starting point for investigation.
Why might a relevant CVE be missing?
CVE matching depends on the information available in the National Vulnerability Database (NVD) and the device inventory in Auvik.
A match may be unavailable when:
- The CVE has not been published in the NVD.
- The public CVE record does not contain enough affected product information.
- The device inventory does not include sufficient vendor, model, firmware, or operating system information.
Does CVE Monitoring Agent fix vulnerabilities?
No. CVE Monitoring Agent identifies potentially affected devices and provides information to support investigation. Your organization remains responsible for selecting, approving, and carrying out remediation.
Which third-party sources does Auvik use?
Currently, Auvik uses the National Vulnerability Database (NVD) from NIST. Additional sources are under consideration.
How frequently is vulnerability information updated?
Auvik typically refreshes NVD records and device matches every two hours.
What should I do if a match appears incorrect?
Review the device inventory, version information, configuration, CVE record, and vendor advisory first.
Then contact Auvik Support. Include the site URL, device information, CVE ID, and any evidence that may help the support team investigate.