> For the complete documentation index, see [llms.txt](https://eaclouddoc.eauditor.eu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://eaclouddoc.eauditor.eu/eacloud-docs-en/features/it-infrastructure/software/software-vulnerabilities.md).
# Software vulnerabilities
eAuditor Cloud analyzes information about detected software and compares products and their versions with information about publicly known vulnerabilities.
This feature helps identify applications that may require an update, removal, or additional verification.
{% hint style="warning" %}
The detection of a vulnerability does not automatically mean the computer has been attacked. It indicates that the detected program version has been linked to a known vulnerability.
{% endhint %}
### Where can vulnerabilities be found?
Go to:
**IT Infrastructure > Software > Details**
The information is located in the column **Detected vulnerabilities**.
If vulnerabilities are found for the detected product and its version, their identifiers will appear in the table.
No entries may mean that:
* no known vulnerability was found for the detected version,
* the program version was not identified unambiguously,
* the software information is incomplete,
* the vulnerability is not yet available in the sources used.
{% hint style="danger" %}
The absence of detected vulnerabilities is not confirmation that the application is secure. The result depends on correct identification of the product and version, as well as on the scope of data available in external databases.
{% endhint %}
### Vulnerability details
After selecting a vulnerability identifier, the system displays the available information, such as:
* vulnerability description,
* CVE identifier,
* EUVD identifier,
* CVSS score,
* EPSS indicator,
* the product and version to which the entry applies,
* publication or update date,
* links to external sources.
The scope of data may vary for individual vulnerabilities. It depends on the information provided by the source.
### How should CVSS be interpreted?
**CVSS - Common Vulnerability Scoring System** defines the technical severity of a vulnerability on a scale from 0 to 10.
Typical interpretation of the score:
* **0** - no threat rating,
* **0,1-3,9** - low,
* **4,0-6,9** - medium,
* **7,0-8,9** - high,
* **9,0-10,0** - critical.
The higher the score, the greater the potential impact of exploiting the vulnerability may be.
{% hint style="info" %}
CVSS describes the technical severity of a vulnerability. It does not, on its own, determine the likelihood that the vulnerability will be exploited in a given organization.
{% endhint %}
### How should EPSS be interpreted?
**EPSS - Exploit Prediction Scoring System** helps assess the likelihood of a vulnerability being exploited in real-world attacks.
In simplified terms:
* a low EPSS indicates a lower likelihood of exploitation,
* a high EPSS indicates a higher likelihood of exploitation.
CVSS and EPSS should be analyzed together:
* a high CVSS and a high EPSS usually require urgent verification,
* a high CVSS and a low EPSS may still indicate significant risk, especially for a critical system,
* a lower CVSS and a high EPSS may require a quick response if the vulnerability is actively exploited or affects many devices.
The final priority should also be influenced by:
* the number of computers with the vulnerable version,
* the importance of the devices to the organization,
* internet accessibility of the system,
* existing security controls,
* availability of a patch or newer version,
* the impact of the update on application operation.
### Recommended procedure
{% stepper %}
{% step %}
#### Locate vulnerable installations
In the **Details** view, apply a filter in the column **Detected vulnerabilities**. Enter the value **"\*"**to display only items for which at least one vulnerability was detected.
{% endstep %}
{% step %}
#### Check details
Open the vulnerability entry and review the description, CVSS, EPSS, product, version, and sources.
{% endstep %}
{% step %}
#### Verify the match
Make sure the vulnerability actually applies to the detected product, version, and its usage context.
{% endstep %}
{% step %}
#### Set the priority
Consider CVSS, EPSS, the importance of the computer, the number of installations, and the availability of a patch.
{% endstep %}
{% step %}
#### Choose an action
Depending on the situation:
* update the software,
* uninstall the unnecessary application,
* apply the vendor's recommendations,
* restrict access to the vulnerable function or service,
* accept the risk in accordance with the organization's procedure.
{% endstep %}
{% step %}
#### Verify the result
After performing the action, refresh the inventory and check whether the vulnerable version is still detected.
{% endstep %}
{% endstepper %}
### External sources
The vulnerability details may include links to:
* the NVD database,
* vendor entries,
* CVE or EUVD databases,
* security bulletins,
* update information.
Before taking action, it is advisable to confirm the vulnerability in the vendor's source, especially when an update may affect the production system.
### Frequently asked questions
Does eAuditor Cloud automatically remove the detected vulnerability?
No. The view identifies known vulnerabilities and provides the information needed to assess the risk. The update, uninstallation, or other corrective action must be performed separately.
Why do I still see the vulnerability after the update?
The computer may not have sent the current inventory yet. It is also possible that the update did not change the vulnerable component or that the new version is still covered by the vulnerability entry.
Does every application with a high CVSS require immediate removal?
No. Before making a decision, verify the EPSS, how the software is used, the availability of a patch, the importance of the device, and the possibility of applying compensating security controls.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://eaclouddoc.eauditor.eu/eacloud-docs-en/features/it-infrastructure/software/software-vulnerabilities.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.