Vulnerability detection

The Wazuh Vulnerability Detection module performs a software audit. It identifies vulnerabilities in the operating system and installed applications in monitored endpoints.

The Vulnerability Detection module helps to implement the following NIST 800-53 controls:

• RA-5 Vulnerability monitoring and scanning: "Vulnerability monitoring includes scanning for patch levels; scanning for functions, ports, protocols, and services that should not be accessible to users or devices; and scanning for flow control mechanisms that are improperly configured or operating incorrectly. Vulnerability monitoring may also include continuous vulnerability monitoring tools that use instrumentation to continuously analyze components. Instrumentation-based tools may improve accuracy and may be run throughout an organization without scanning. Vulnerability monitoring tools that facilitate interoperability include tools that are Security Content Automation Protocol (SCAP)-validated. Thus, organizations consider using scanning tools that express vulnerabilities in the Common Vulnerabilities and Exposures (CVE) naming convention and that employ the Open Vulnerability Assessment Language (OVAL) to determine the presence of vulnerabilities. Sources for vulnerability information include the Common Weakness Enumeration (CWE) listing and the National Vulnerability Database (NVD). Control assessments, such as red team exercises, provide additional sources of potential vulnerabilities for which to scan. Organizations also consider using scanning tools that express vulnerability impact by the Common Vulnerability Scoring System (CVSS)."

• SC-38 Operations security: "Operations security (OPSEC) is a systematic process by which potential adversaries can be denied information about the capabilities and intentions of organizations by identifying, controlling, and protecting generally unclassified information that specifically relates to the planning and execution of sensitive organizational activities. The OPSEC process involves five steps: identification of critical information, analysis of threats, analysis of vulnerabilities, assessment of risks, and the application of appropriate countermeasures. OPSEC controls are applied to organizational systems and the environments in which those systems operate. OPSEC controls protect the confidentiality of information, including limiting the sharing of information with suppliers, potential suppliers, and other non-organizational elements and individuals. Information critical to organizational mission and business functions includes user identities, element uses, suppliers, supply chain processes, functional requirements, security requirements, system design specifications, testing and evaluation protocols, and security control implementation details."

The Wazuh Vulnerability Detection module assists with the above requirements by scanning an endpoint for vulnerable applications and packages and missing OS updates.

Use case

Detect vulnerabilities on a monitored endpoint

Wazuh helps meet the RA-5 Vulnerability monitoring and scanning requirement using the Vulnerability Detection module to identify system vulnerabilities. The Vulnerability Detection module is enabled by default.

Click the upper-left menu icon (☰) and go to Threat intelligence > Vulnerability Detection > Dashboard on the Wazuh dashboard. The image below shows the global vulnerability summary across monitored endpoints.

Click the upper-left menu icon (☰) and go to Threat intelligence > Vulnerability Detection > Inventory on the Wazuh dashboard. You can filter the inventory by CVE, severity, agent, or package name to identify endpoints that need remediation. The image below shows the Inventory tab with a filter applied for vulnerabilities with Critical severity.

Select a specific vulnerability by clicking Inspect vulnerability details (magnifying glass icon) to view more information. The image below shows details for CVE-2026-72970 affecting Microsoft Edge 145.0.3800.58.

The vulnerability.scanner.reference field provides a link to the corresponding Wazuh CTI vulnerability page.