Detected CVEs in ServiceOps
Where the Vulnerabilities list groups findings by patch record, the Detected CVEs list is CVE-centric. Each record is a single CVE with its own severity rating, CVSS 3.1 score, exploit status, and affected endpoint count. Use this view to investigate a specific CVE ID, check patch availability, or assess exploit risk before escalating to the patch team.
Prerequisites
Before you access the Detected CVEs list, ensure:
- You have the Vulnerability Manager or Vulnerability Specialist Technician role, or your role has View Vulnerability enabled under Admin > Users > Roles
- A Vulnerability license is active in ServiceOps
- At least one endpoint is enrolled in Admin > Discovery and Agents > Endpoint Management > Endpoint Scopes
- The vulnerability database has synced at least once via Admin > Vulnerability Management > Vulnerability Settings
If the Detected CVEs list is empty after setup, confirm the local database has synced. Go to Admin > Vulnerability Management > Vulnerability Settings and click Update Now to trigger the first sync.
How Does the Detected CVEs List Work?
ServiceOps matches the OS and software inventory collected from each enrolled endpoint against the local vulnerability database. Every match between an installed software version and a known CVE creates a CVE record automatically. The Detected CVEs list shows all such records across your environment.
The list updates after each scan completes. Scans run automatically on four triggers: a database update, a new endpoint enrolled, new discovery data arriving, or an endpoint configuration change.
Each CVE record is read-only. ServiceOps updates it when CVE data changes in the central repository or when you add or remove enrolled endpoints.
Detected CVEs List Page
The Detected CVEs list page shows all individual CVE records detected across your enrolled endpoints, with severity, CVSS score, and exploit status visible at a glance.
Go to Vulnerability Management > Detected CVEs.
The page has the following controls:
- Filter dropdown: Switches between saved filters. Shows Detected Vulnerabilities by default. The out-of-the-box filters are:
| Filter | Condition |
|---|---|
| Detected Vulnerabilities (default) | No condition; shows all CVEs detected to date |
| Critical Vulnerabilities | Severity = Critical |
| Active Vulnerabilities | Status = Active |
| Resolved Vulnerabilities | Status = Resolved |
| Fixable Vulnerabilities | Patch Availability = Yes |
| Exploited Vulnerabilities | Exploit Status = Yes |
| Declined Vulnerability | Status = Declined |
Search bar: Filters the list by any field. Select a field from the dropdown then type a value.
Export: Sends selected columns to your logged-in Technician email address as CSV or Excel. You can also password-protect the Excel file.
- Download: Downloads the full list as CSV or Excel with optional password protection.
Refresh: Reloads the list to show the latest scan data.
Column Selection: Adds or removes columns from the list view. Preferences are saved per Technician.
More Options: Opens additional actions including Auto Refresh Interval to set how often the list refreshes automatically.
View Details: Click on any record to open its CVE Detail page.
View Details on a New Tab: Click the arrow to the right of the CVE ID to open its CVE Detail page in a new tab.
Grid: Displays all detected CVE records. The default visible columns are:
| Field | Description |
|---|---|
| CVE ID | Unique CVE identifier, for example CVE-2024-1234 |
| Description | Short summary of the vulnerability from the CVE database |
| Severity | Risk level: Critical, High, Medium, Low, or Unspecified |
| CWE ID | Common Weakness Enumeration identifier for the underlying weakness |
| Impacted Systems | Count of enrolled endpoints where this CVE was detected |
| Patch Availability | Yes if a remediation patch exists for this CVE in the ServiceOps server |
| CVSS 3.1 Score | CVSS 3.1 base score indicating overall severity |
| Exploit Status | Yes if active exploitation of this CVE is known |
| Published Date | Date the CVE was published in the vulnerability database |
Additional fields are available through Column Selection.
CVE Details Page
The CVE Details page shows the full context for a single CVE: CVSS metrics, impacted endpoints, linked patches, references, and audit history. Click any record in the list to open the CVE Detail page. From here, you can move to the previous or next page by clicking the respective arrows. And also the Decline button to decline the patch if required. It has the following sections:
Header Fields
The top section shows the CVE's key attributes:
| Field | Description |
|---|---|
| CWE ID | Common Weakness Enumeration identifier for the root weakness |
| Status | Current CVE record status, for example Modified or Published |
| Severity | Risk level assigned to this CVE |
| Exploit Status | Yes if active exploitation of this CVE is known |
| Patch Availability | Yes if a remediation patch exists for this CVE in the ServiceOps patch database. A patch is considered available only when it has been downloaded and indexed on the ServiceOps server. If a patch exists for this CVE but the field still shows No, the patch database may not have completed its latest sync. Wait for the next sync cycle or trigger a manual sync from the patch management settings. |
| Tags | Add or remove tags for this CVE |
| Vulnerability Details | Full CVE description from the repository. Click the expand icon to view it in full. |
The CVE details page is read-only. ServiceOps updates it automatically when CVE data changes in the central repository or when endpoint scan results change.
Associated Actions
Each tab on the CVE Details page gives a different perspective on the vulnerability, from CVSS scoring to the endpoints it affects.
- Metrics
- Endpoint
- Patches
- References
- Audit Trail
Shows CVSS 3.1 scoring details for this CVE.
| Field | Description |
|---|---|
| Exploitability Score | CVSS 3.1 sub-score measuring how easily an attacker can exploit the vulnerability. Ranges from 0 to 3.9. Higher values mean the vulnerability is easier to exploit. |
| Impact Score | CVSS 3.1 sub-score measuring the potential damage if an attacker exploits the vulnerability. Ranges from 0 to 5.9. Higher values indicate greater impact on confidentiality, integrity, or availability. |
| Severity | Overall risk level derived from the CVSS 3.1 base score: Critical (9.0-10.0), High (7.0-8.9), Medium (4.0-6.9), Low (0.1-3.9). |
| Access Vector | The full CVSS 3.1 vector string describing the attack characteristics, for example CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. |
| Source | The organisation that assigned this CVSS score, for example nvd@nist.gov. |
| Type | Indicates whether this CVSS score is the primary score from the authoritative source (e.g., NVD) or a secondary score from another assessor/vendor. |
Lists the enrolled endpoints where this CVE was detected. Use the search bar to filter by field.
| Field | Description |
|---|---|
| ID | Unique endpoint identifier in EP-XX format. Click to open the endpoint's detail page. |
| Host Name | Hostname of the enrolled device |
| IP Address | Current IP address of the device |
| OS Name | Operating system name, for example Microsoft Windows 11 Pro |
| OS Version | Full OS build version string |
| Architecture | Processor architecture, for example 64 BIT |
| Remote Office | Remote office assignment for the device |
Lists the patch records from the Vulnerabilities list that address this CVE. Use this tab to identify which patch resolves the vulnerability before escalating to the patch team.
| Field | Description |
|---|---|
| ID | Unique patch identifier in PCH-XX format. Click to open the patch detail page in the Vulnerabilities list. |
| Name | Full patch name including KB number and target OS |
| Patch Category | Category of the patch, for example Security Updates |
| Severity | Severity level assigned to the patch, for example Critical or High |
| Approval Status | Current approval state of the patch, for example Approved or Pending |
| Application | Target operating system or application the patch applies to |
| Release Date | Date the patch was released by the vendor |
| KB Number | Microsoft Knowledge Base article number associated with the patch |
| Download Size | File size of the patch download in bytes |
Lists external reference links published alongside this CVE. Use these links to read vendor advisories, proof-of-concept reports, or third-party analysis.
| Field | Description |
|---|---|
| Reference URL | External link to the advisory, report, or analysis. Click to open in a new browser tab. |
| Source | Organisation or reporter that published the reference, for example cve@mitre.org |
| Tags | Classification labels for the reference type, for example Exploit, Vendor Advisory, or Third Party Advisory |
Shows a chronological log of all system events for this CVE record. Use the date range filter to narrow entries. Click the download icon to export the log.
| Field | Description |
|---|---|
| Event | Description of what changed, for example System Fixed / Removed or Status Updated |
| Date | Date and time the event was recorded |
Other Info
The Other Info panel on the right side shows additional CVE metadata.
| Field | Description |
|---|---|
| Published Date | Date the CVE was first published in the vulnerability database |
| Last Updated Date | Date the CVE record was last modified in the repository |
Filter by Exploit Status = Yes and Severity = Critical together. CVEs that meet both conditions carry the highest immediate risk. Escalate them to the patch team before any others.
Example
Your security team receives an alert about a newly disclosed CVE being actively exploited in real-world attacks. You open Vulnerability Management > Detected CVEs and search by CVE ID. The record appears with Severity = Critical, Exploit Status = Yes, and 23 Impacted Systems. You click the record to open the detail page. You check the Metrics tab to review the CVSS 3.1 Access Vector. You then switch to the Endpoint tab to identify which servers are affected. You share the endpoint list with the patch team, who uses Patch Management to deploy the fix immediately.
Troubleshooting
If something isn't working as expected, expand the relevant item below for the cause and fix.
Detected CVEs list is empty after setup
Cause: The local vulnerability database has not synced yet, or no endpoints are enrolled.
Fix: Go to Admin > Vulnerability Management > Vulnerability Settings and click Update Now. Confirm at least one endpoint is enrolled in Admin > Discovery and Agents > Endpoint Management.
A known CVE is missing from the list
Cause: The local database is stale, or the affected endpoint is not enrolled in scope.
Fix: Trigger a manual database update from Vulnerability Settings. Confirm the affected endpoint appears in the Endpoints Scope list.
Impacted Systems count is lower than expected
Cause: Some affected endpoints are not enrolled in scope, or an agent is offline and not reporting.
Fix: Check the Vulnerability Endpoints list to confirm enrollment and agent status for the missing devices.
Exploit Status shows No for a CVE known to be actively exploited
Cause: The local vulnerability database may not have received the latest threat intelligence update.
Fix: Go to Admin > Vulnerability Management > Vulnerability Settings and click Update Now to pull the latest data from the central repository.