Vulnerability evidence and patch worksheet
This is a reference worksheet, not a live inventory of your systems. Start with the vendor advisory and compare its affected versions to your actual deployment.
Use a dated primary record
CISA's official KEV data repository mirrors the Known Exploited Vulnerabilities data files and schema. Keep the catalogue version/date with any finding rather than treating a saved entry as a current scan of a host.
| Field | Evidence |
|---|---|
| Identifier | CVE plus the original vendor advisory URL. |
| Affected asset | Installed product, exact version, configuration and exposure. |
| Exploitation | Who reports exploitation, when, and what evidence they publish. |
| Action | Vendor fix or mitigation, prerequisites and remaining limitations. |
| Change record | Backup, test scope, responsible owner and rollback condition. |
| Confirmation | Installed version and checks after the change; unresolved hosts remain visible. |
Do not treat a missing catalogue entry as evidence that a vulnerability is harmless. A CVE mention in a news article also does not establish that a particular host is affected.