Interpreting Remediation in Scan Results

Learn how scan results show Patched status and requested versus served lineage after Zero-Touch Remediation heals a package.

When Zero-Touch Remediation serves a vendor-patched rebuild or a registered local patch, the resulting artifact or build scan reflects the patched package, not the CVEs of the originally requested coordinate.

Without explicit signaling, a clean scan can be misread as no action taken or as a scanner discrepancy when a third-party tool still reports CVEs against the original version. Xray addresses this by making remediated components visible and auditable in scan results.

Patched Contextual Analysis Status

Xray adds a Patched status to the contextual analysis vocabulary alongside Applicable, Not Applicable, Not Scanned, and other existing values.

A CVE on a remediated component displays as Patched when:

JFrog Catalog identifies the served version as a patched rebuild, and
Catalog data confirms the CVE is resolved on that exact rebuilt version.

For a local patch, Catalog stores the CycloneDX declaration from registration and scores remaining vulnerabilities on the custom patched version. Xray then treats that served version like other patched rebuilds in scan results.

This appears in vulnerability tables and contextual analysis widgets in the scan report.

Catalog-Aligned CVE Filtering

Xray reconciles scan-time CVE matching with Catalog data for the exact rebuilt version. CVEs that Catalog identifies as resolved on that version are excluded from active scan results, aligning Xray counts with Catalog and with Zero-Touch decision scoring.

Why Scan Results Surface Remediated Vulnerabilities

When remediation works correctly:

The developer requests a vulnerable package version.
Zero-Touch Remediation provides a patched rebuild through the covered virtual repository. The rebuild can be a clearing-house vendor rebuild or a registered local patch.
The build completes and Xray scans the served SBOM.
The scan shows no active violations on the patched coordinate.

A clean result alone does not tell the full story. Surfacing remediated vulnerabilities serves the following purposes:

Evidence of value: Shows that Zero-Touch Remediation performed meaningful remediation.
Scanner reconciliation: Reframes third-party discrepancies as resolved by JFrog, not as a missed CVE.
Auditability: Governance, risk, and compliance teams can prove a finding was present and remediated, with lineage and timestamps.
Developer trust: Explains silent version swaps and signals that the served version is a verified drop-in replacement.

Frequently Asked Questions

This section provides answers to frequently asked questions.

plusFAQs

Q: How do I read scan results after Zero-Touch Remediation?

A: Xray scans the served patched package, not the originally requested coordinate. Remediated CVEs display as Patched when Catalog confirms the CVE is resolved on that rebuild. For more information, see Patched Contextual Analysis Status.

Q: What happens if a third-party scanner still reports the original CVEs?

A: That is expected when the third-party tool evaluates the requested coordinate. Xray aligns counts with Catalog data for the served rebuild. For more information, see Catalog-Aligned CVE Filtering.

Q: What is the difference between a clean scan and a Patched status?

A: A clean scan means no active violations on the served version. Patched records that a CVE was present on the requested version and resolved by remediation. For more information, see Why Scan Results Surface Remediated Vulnerabilities.

Q: What do I need before scan results show Patched?

A: Zero-Touch Remediation must serve a vendor rebuild or a registered local patch, and Catalog must identify that served version as patched. For more information, see Patched Contextual Analysis Status.

Q: Can local patches appear as Patched in scan results?

A: Yes. Catalog stores the CycloneDX declaration from registration and scores remaining vulnerabilities on the custom patched version. For more information, see Register Local Patches.