Vulnerability Assessment, Scan Output and Zero-Day Report

Detects vulnerability assessment reports, vulnerability scanner outputs (Nessus, Qualys, OpenVAS, Nexpose/InsightVM), and zero-day vulnerability write-ups containing CVE/CVSS details, scanner plugin/QID host-port rows, and unpatched or pre-disclosure status. Report and scanner titles alone are discovery-only; enforcement requires a concrete finding, CVE/CWE/CAPEC ID, CVSS vector or score, scanner output structure, or zero-day status evidence.

Type

regex

Confidence

medium

Confidence justification

Medium confidence: titles are discovery-only; enforcement needs a finding, identifier, CVSS, scanner structure, or zero-day status hit, and 85 needs two distinct evidence groups.

Jurisdictions

global

Regulations

Criminal Code Act 1995 (Cth)

Frameworks

CIS Controls, ISO 27001, NIST CSF, PCI-DSS

Data categories

security

Scope

narrow

Risk rating

8

Should match

• Vulnerability assessment report — Low-tier probe - report title without a finding
• Vulnerability assessment report: SQL injection vulnerability with a proof of concept. — Discovery probe (65) - finding wording without CVE, CVSS or scanner structure; formal scoring
• Vulnerability scan report: CVE-2026-4412, CVSS score 9.1, critical severity. — High-tier probe - formal vulnerability reference plus severity score
• Nessus scan results - corporate server VLAN, scan completed 2026-09-18 02:14 Host Port Plugin ID Severity Name 10.20.4.17 445/tcp 97833 Critical MS17-010: Security Update for Microsoft Windows SMB Server CVE-2017-0144 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H 10.20.4.31 3389/tcp 18405 Medium Microsoft Windows Remote Desktop Protocol Server Man-in-the-Middle Weakness — High-tier probe - scanner export with host/port/plugin/severity rows, CVE ID and CVSS vector (rebuilt from global-top500-286-vulnerability-scan-outputs)
• Qualys scan report, host 10.8.1.22:443 - QID 38657 flagged on the payroll web server; remediation owner: Infrastructure. — Medium-tier probe - scanner output structure (host:port and QID) without CVE or CVSS (rebuilt from global-top500-286-vulnerability-scan-outputs)
• Zero-day vulnerability details - remote access gateway firmware 9.1.4 Status: unpatched, no vendor fix available, no CVE assigned; under embargo until coordinated disclosure on 2026-11-02. Scoring: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) Impact: pre-authentication remote code execution via the portal login handler; proof of concept attached. — High-tier probe - zero-day write-up with pre-disclosure status, CVSS vector, and exploit finding (rebuilt from global-top500-288-zero-day-vulnerability-details)

Should not match

• Emotional vulnerability in relationships — Non-match 1
• Vulnerability of the coastline to erosion — Non-match 2
• Developers applied routine operating-system updates during the maintenance window. — Patch activity without an assessment, scan, CVE, CVSS, or report anchor is outside this SIT
• The public advisory links to a vulnerability assessment report. — Public link mentions only the report title
• Template example: vulnerability scan report with CVE-2026-4412 and CVSS score 9.1 critical severity. — Template contains otherwise high-tier evidence
• Policy: every vulnerability scan report must be stored in the ISMS register and reviewed by the CISO within 10 business days of the scan. — Policy naming the report type without findings, identifiers, or scanner structure stays discovery-only
• News: the council published a summary of its annual vulnerability assessment for residents and thanked the contractor. — News mention of an assessment without findings stays discovery-only
• Vendors rushed to ship fixes after researchers disclosed a zero-day under active exploitation in a popular browser. — Public zero-day news without a report/scan/zero-day-details anchor is outside this SIT
• Training example: Nessus scan results for host 10.20.4.17 port 445/tcp, Plugin ID 97833, CVE-2017-0144, unpatched. — Training content with an otherwise high-tier scanner row must not enforce

Known false positives

• Non-technical use of vulnerability. Mitigation: Require CVE, CVSS, or vulnerability scan specific terms.
• Public vendor advisories, NVD entries, and security news cite CVE IDs, CVSS vectors, and zero-day status for already-public issues. Mitigation: Require a report, scanner-output, or zero-day-details anchor for any tier; bare zero-day news and advisories without those anchors do not match, and template/training framing is excluded. Public advisories that are titled as vulnerability reports can still reach enforce tiers and should be handled by site or sender exceptions.

References

• Criminal Code Act 1995 (Cth)