Interpret Remediation in Scan Results

When Zero-Touch Remediation serves a vendor-patched rebuild or a registered local patch, the resulting artifact or build scan reflects the patched package—not the CVEs of the originally requested coordinate.

Without explicit signaling, a clean scan can be misread as "no action taken" or as a scanner discrepancy when a third-party tool still reports CVEs against the original version. Xray addresses this by making remediated components visible and auditable in scan results.

Patched Contextual Analysis Status

Xray adds a Patched status to the contextual analysis vocabulary alongside Applicable, Not Applicable, Not Scanned, and other existing values.

A CVE on a remediated component displays as Patched when:

• JFrog Catalog identifies the served version as a patched rebuild, and
• Catalog data confirms the CVE is resolved on that exact rebuilt version.

For a local patch, Catalog stores the CycloneDX declaration from registration and scores remaining vulnerabilities on the custom patched version. Xray then treats that served version like other patched rebuilds in scan results.

This appears in vulnerability tables and contextual analysis widgets in the scan report.

Catalog-Aligned CVE Filtering

Xray reconciles scan-time CVE matching with Catalog data for the exact rebuilt version. CVEs that Catalog identifies as resolved on that version are excluded from active scan results, aligning Xray counts with Catalog and with Zero-Touch decision scoring.

Why Scan Results Surface Remediated Vulnerabilities

When remediation works correctly:

1. The developer requests a vulnerable package version.
2. Zero-Touch Remediation provides a patched rebuild through the covered virtual repository—either a clearing-house vendor rebuild or a registered local patch.
3. The build completes and Xray scans the served SBOM.
4. The scan shows no active violations on the patched coordinate.

A clean result alone does not tell the full story. Surfacing remediated vulnerabilities serves four purposes:

1. Evidence of value — shows that Zero-Touch Remediation performed meaningful remediation.
2. Scanner reconciliation — reframes third-party discrepancies as "resolved by JFrog," not "JFrog missed a CVE."
3. Auditability — GRC teams can prove a finding was present and remediated, with lineage and timestamps.
4. Developer trust — explains silent version swaps and signals that the served version is a verified drop-in replacement.

Related Topics

• Zero-Touch Remediation Overview
• Register local patches
• View Remediation Requests