Skip to main content
This guide applies to Mac computers and Windows devices

​
About Vulnerability Management

Iru Endpoint’s Vulnerability Management feature scans your entire fleet for known Common Vulnerabilities and Exposures (CVEs) based on data from the National Vulnerability Database (NVD), providing a clear, organized way to monitor and respond to vulnerabilities across your fleet. From the Vulnerabilities page, you can prioritize threats by severity, track remediation progress, and open a CVE detail view for devices, vulnerable software, and timeline history.

​
How It Works

Vulnerability Management continuously scans your Mac fleet for known security vulnerabilities by comparing installed applications against the National Vulnerability Database. The system provides multiple views to help you understand and prioritize threats, track remediation progress, and manage risk acceptance across your environment. Once you’ve enabled Vulnerability Management, it automatically begins scanning your devices every 15 minutes for application inventory updates. The system then matches these applications against the CVE database hourly to identify any known vulnerabilities. Our Security Research team proactively enriches CVE records missing pertinent data for accurate and timely matches. You can review results on the Vulnerabilities page, then open a CVE for Overview, Devices, Vulnerable software, and Timeline details.

​
Vulnerability Management Capabilities

​
Viewing CVEs

Vulnerability Management identifies any known Common Vulnerabilities and Exposures (CVEs) within your fleet, leveraging information from the National Vulnerability Database (NVD). From the Vulnerabilities page in the Iru Endpoint Web App, you can view all relevant CVEs for specific applications.

​
Automated Remediation (macOS)

For macOS, the Vulnerability Response Library Item lets you enforce updates for known vulnerable applications using Iru Auto Apps based on CVE severity, triggering automatic remediation on devices without manual intervention.

​
Risk Acceptance

Not every CVE poses the same level of threat. Some may be critical and require immediate attention, while others might be less urgent or not relevant to your environment. Please see our Accepting CVE Risks article for more information about how to accept CVE risks.

​
Device Exclusion

You can exclude specific devices from vulnerability reporting and notifications when they shouldn’t affect fleet-wide counts—for example, test devices or devices undergoing decommissioning. Please see our Excluding Devices from Vulnerability Management article for more information. Key capabilities include:
  • Real-time scanning of your entire Mac fleet for known vulnerabilities
  • Multiple view options to analyze threats from different perspectives
  • Severity-based prioritization using Common Vulnerability Scoring System (CVSS) and Known Exploited Vulnerabilities (KEV) scoring systems
  • Remediation tracking to monitor your progress in addressing vulnerabilities
  • Automatic remediation (macOS only) of known vulnerable applications based on CVE severity using Auto Apps updates
  • Risk acceptance for vulnerabilities that don’t require immediate action
  • Device exclusion to remove specific devices from vulnerability counts, views, and notifications

​
Vulnerabilities View

The Vulnerabilities page provides a complete list of detected CVEs across your fleet, along with summary cards for:
  • Vulnerabilities by severity - Counts for Critical, High, Medium, and Low
  • Remediation status - Percentage remediated, plus counts for Remediated, Active, and Risk accepted
  • Top software with vulnerabilities - Software with the highest vulnerability counts
You can search by CVE ID or software, and filter the list by:
  • First Detected
  • Severity
  • Status - Such as Active, Remediated, or Risk accepted
  • Device
  • OS
  • Application
  • Packages
Use Clear all to reset filters. Table tools include Edit columns, Expand table, and Export CSV. The vulnerabilities table includes columns for Vulnerability ID, Vulnerable software, Severity, CVSS score, Known exploit, First detected, Devices, and Status. From the row ellipsis (…) menu, you can Accept risk or Search NVD.

​
Remediation Filtering

When all vulnerable software and devices impacted by a CVE are patched, the CVE will have a Remediated status.
1

Filter for Remediated CVEs

Use the Status filter and select Remediated.
2

View Remediated Results

The list will be filtered to display only CVEs for which the CVE was fully remediated.

​
CVE Information

When you select a CVE, a detailed drawer opens with tabs for Overview, Devices, Vulnerable software, and Timeline. From the drawer header, you can Search NVD, Change status, or open Actions. Overview Tab The Overview tab provides an in-depth look at:
  • Description - Detailed explanation of the security issue
  • Status - Current CVE status, such as Active
  • Severity - Threat rating for the vulnerability
  • CVSS score - Numeric severity score
  • Known exploit - Whether the vulnerability has been exploited in the wild
  • EPSS score - Probability of being exploited in the next 30 days
  • Age - How long the CVE has been present in your environment
  • Key dates - Published on, Modified on, First detected, and Last detected
  • Impacted devices - Remediation progress, including remediated and active device counts
  • Recommendations - Guidance for addressing the vulnerability
Devices Tab Use the Devices tab to view devices affected by the vulnerability. You can search and filter the list by Detection date, Blueprint, and Device. For each device, you can see:
  • Device name
  • Serial number
  • Blueprint
  • OS version
  • Vulnerable software - Link to view the vulnerable application and version installed on the device
  • Excluded badge - Shown when the device is excluded from Vulnerability Management
From the Devices tab, you can exclude devices individually or in bulk, or remove exclusions. See Excluding Devices from Vulnerability Management. Vulnerable Software Tab The Vulnerable software tab lists the application, OS, and platform versions affected by the CVE. You can search and filter by Detection date, Blueprint, and Device. For each software item, you can see:
  • Software name and version
  • Type - Such as Application
  • Affected device count
  • Platform - Such as Windows or macOS
  • View more details - Expandable details for the software item
Timeline Tab The Timeline tab shows a chronological history of events for the CVE, including when it was published, modified, and detected in your environment. Detection events link to affected devices. Published and modified events include a View in NVD option.

​
CVSS Score

The Common Vulnerability Scoring System (CVSS) is a method for calculating a qualitative measure of severity. Iru Endpoint Vulnerability Management uses the CVSS score to prioritize vulnerabilities and measure the severity of each vulnerability. The National Institute of Standards and Technology (NIST) maintains the National Vulnerability Database (NVD), which provides CVSS enrichment for all published CVE records.

​
KEV Score

The Cybersecurity Infrastructure Security Agency (CISA) maintains the authoritative source of vulnerabilities that have been exploited in the wild. Iru Endpoint Vulnerability Management uses the Known Exploited Vulnerabilities (KEV) catalog to prioritize vulnerabilities.

​
Report Inaccuracy

1

Start the Report

If there are any issues with a detected CVE, click the Report Inaccuracy button.
2

Select Issue Type

Select an issue from the drop-down menu.
3

Add Description

Optionally, enter a description of the issue.
4

Submit Report

Click the Report button to complete the report.

​
Application and OS Coverage

Vulnerability Management scans the following directories for macOS Applications and all supported macOS versions (.app files only):
  • /Applications
  • /Library
  • /Users
In addition, Vulnerability Management scans the entire disk for vulnerable Homebrew packages.

​
Update Frequency

​
Considerations

Iru Endpoint uses third-party vulnerability feeds and first-party research to identify CVEs across your fleet. First-party research fills gaps in public databases and enriches CVE data used for matching.Third-party sources:First-party research:
  • Iru’s Security Research team discovers vulnerabilities, coordinates disclosure with vendors, and enriches CVE records that lack the data needed for accurate matching
  • The team also investigates malware and other threats that may not yet appear in public vulnerability databases
  • macOS
    • Applications: Scans the specified directories for .app files. Third-party applications installed outside those directories won’t be detected.
    • Homebrew packages: Scans the entire disk for vulnerable Homebrew packages.
  • Windows
    • Registry and applications: Vulnerability Management scans the system and user registry and Windows applications. For supported versions and locations, see Application and OS Coverage.
  • System frameworks and libraries are not included in vulnerability scanning.
  • New vulnerabilities may not appear immediately after database updates
  • Allow up to an hour for new CVEs to be reflected in your fleet scan results
  • Device App Inventory and Packages updates every 15 minutes, but vulnerability matching occurs hourly
  • CVEs are marked as “Remediated” only when all affected software and active (non-excluded) devices are patched
  • Partial remediation won’t change the overall CVE status
  • Excluded devices do not count toward affected-device totals
  • Use the Devices tab in a CVE detail view to track individual device remediation progress