Vulnerabilities

The Vulnerabilities section provides automated vulnerability detection across your fleet. TridentStack Control correlates installed software and system update status against known CVE databases to identify exposed endpoints.

How Vulnerability Detection Works

TridentStack Control continuously evaluates your fleet for known vulnerabilities by combining data from your agents with external CVE databases.

The process is fully automated. Each time an agent checks in and reports its software inventory and installed updates, the server re-evaluates that agent's vulnerability exposure. No manual scans are required.

Navigating the Vulnerabilities Page

The Vulnerabilities page is organized into five tabs, each providing a different perspective on your fleet's security posture.

All

A flat list of every detected vulnerability across all agents. Each row represents a unique CVE found on one or more endpoints.

You can sort and filter by:

• Severity (Critical, High, Medium, Low)
• CVE ID
• Affected agents count
• Discovery date

This view is useful when you need to find a specific CVE or want to see the complete picture of your exposure.

Overview

A high-level summary of your fleet's vulnerability status. This tab includes:

• Severity breakdown: How many vulnerabilities fall into each severity category (critical, high, medium, low)
• Trend charts: Visualize how your vulnerability count changes over time
• Top vulnerable endpoints: Quickly identify which agents have the most exposure

tip

Review the Overview tab regularly to track your fleet's vulnerability trend. A downward trend means your patching strategy is working.

By Agent

View vulnerabilities grouped by endpoint. This tab answers the question: "Which of my machines are most at risk?"

Each row shows an agent with its total vulnerability count and severity breakdown. Click any agent to drill into its individual vulnerability list, where you can see every CVE affecting that endpoint.

History

Track vulnerability discovery and remediation over time. The History tab shows:

• When each CVE was first detected in your environment
• When vulnerabilities were resolved (the missing patch was installed)
• Trends in time-to-remediation

This view is particularly useful for audit and reporting purposes, where you need to demonstrate that vulnerabilities are being addressed within defined SLAs.

Exceptions

Manage vulnerability exceptions from this tab. Exceptions suppress specific CVEs from reports and dashboards when you have determined they are not applicable or have mitigating controls in place.

See Creating Exceptions below for details.

Severity Levels

TridentStack Control uses the industry-standard CVSS (Common Vulnerability Scoring System) to categorize vulnerability severity:

Severity	CVSS Score Range	Description
Critical	9.0 - 10.0	Exploitation is straightforward and leads to full system compromise. Patch immediately.
High	7.0 - 8.9	Significant risk of exploitation or impact. Patch within your defined SLA.
Medium	4.0 - 6.9	Moderate risk, typically requiring specific conditions for exploitation.
Low	0.1 - 3.9	Limited risk or impact. Address during routine maintenance windows.

CVE Detail Page

Click any CVE ID to open its detail page. The detail page provides:

• Description: What the vulnerability is and how it can be exploited
• CVSS score: The numeric score and severity rating
• Affected products: Which software or OS components are vulnerable
• Exposed agents: A list of every agent in your fleet that is affected
• Remediation guidance: Which KB articles (patches) resolve the vulnerability
• External references: Direct links to the NVD (National Vulnerability Database) entry and vendor advisories

The remediation guidance is the critical piece: it tells you exactly which patch to deploy to eliminate the vulnerability.

Creating Exceptions

If a CVE is not applicable to your environment, you can create an exception to suppress it from reports. Common reasons for exceptions include:

• The vulnerable feature or component is disabled on your endpoints
• A compensating control is in place (e.g., network segmentation, firewall rules)
• The vulnerability applies to a software version you do not run
• A vendor has confirmed the vulnerability does not affect your configuration

To create an exception:

1. Navigate to the CVE detail page or the Exceptions tab.
2. Click Create Exception.
3. Select the scope: fleet-wide or specific agents.
4. Enter a justification note explaining why the exception is warranted.
5. Optionally set an expiration date, after which the CVE will reappear in reports.
6. Click Save.

warning

Vulnerability exceptions hide CVEs from reports but do not eliminate the risk. Only create exceptions when you have verified that a compensating control is in place.

Remediation

The fastest way to remediate vulnerabilities is to deploy the missing patches through your update policies.

The recommended workflow:

1. Review the Overview tab to identify your highest-severity vulnerabilities.
2. Open the CVE detail page for a critical or high-severity CVE.
3. Note the KB article listed in the remediation guidance.
4. Navigate to your Update Policies and verify the relevant KB is approved for deployment.
5. If the KB is not yet approved, add it to the appropriate policy.
6. Agents will install the patch on their next maintenance window.

After the patch is installed, the vulnerability is automatically marked as resolved during the agent's next check-in. No manual intervention is needed to clear remediated CVEs.

You can also remediate directly from an endpoint's Vulnerabilities tab: apply a verified one-click fix, or use Add to Policy when the fix needs to deploy through a configuration policy. After remediating, a CVE shows as awaiting re-scan until the next check-in confirms it; click Re-scan now to confirm right away. See the per-endpoint Vulnerabilities tab for the full set of actions.

Remediate a CVE Across Your Fleet

For an urgent vulnerability, you can push the fix to every affected endpoint from one place instead of working through endpoints one at a time.

1. Go to Reporting > Vulnerabilities, open the All tab, and select Remediate from the actions menu on the CVE you want to fix. This action is available whenever a fix exists.
2. Review the list of affected endpoints. Endpoints that can install the fix right now are already checked for you.
3. Endpoints that cannot be patched right now show why, with a link to that endpoint's own page so you can look into it. Common reasons include the endpoint being offline, the fix requiring a bigger upgrade than a patch, or the endpoint needing an Extended Security Updates (ESU) license to receive the fix. Because the reason is worked out per endpoint, a CVE can offer some endpoints you can patch today alongside others you cannot.
4. Confirm and push. Installs start right away, staggered across the endpoints you selected, rather than waiting for each endpoint's next maintenance window. Endpoints marked Outside policy get the update as a one-off: without adding it to any update policy and without changing any policy you already have. This is the fastest way to close out an urgent CVE without authoring policy around it first.

A push covers up to 100 endpoints at a time. If a CVE affects more than that, remediate in waves.

If an application is pinned to a specific version by one of your configurations, this action does not patch it. That is intentional: a pinned version is one you have deliberately locked in place, and remediation respects that choice. Update the configuration first if you want that endpoint to receive the fix.

This action currently covers Windows endpoints: Windows Update patches and Windows application updates. If a CVE also affects macOS or Linux endpoints, those endpoints appear in the list but cannot be selected here; remediate them from their own Vulnerabilities tab.