Operations infrastructure representing Linux vulnerability response

CVE remediation

Move from a Linux advisory to a tested replacement image

Assess supported package inventories against advisory data, identify the affected artifacts, rebuild the image, and run the same VM checks before a replacement moves toward the fleet.

Pilot a remediation pathReview SBOM evidence
Artifact-aware inventoryAffected or unknown resultsReplacement VM validation

Treat patching as a new artifact, not an in-place mystery

The live inventory and advisory assessment identify where a supported package appears and preserve ambiguity as unknown. Automated rebuild approvals, ServiceNow workflows, and fleet rollout are scoped pilot capabilities, not a blanket production promise.

Inventory-aware assessment

Compare package versions and coverage data with advisory ranges for supported ecosystems.

Visible uncertainty

Use affected, unaffected, and unknown states so missing or ambiguous evidence does not become a false assurance.

Rebuild from recipe

Update the explicit image definition and produce a replacement artifact rather than modifying an unmanaged machine by hand.

Re-run acceptance checks

Boot the replacement image and repeat the agreed system, service, or UI validation before release review.

A controlled remediation loop

Inventory assessment is available now. The complete approval and fleet loop is validated with the customer during a pilot.

  1. 01

    Assess

    Map the advisory to supported package inventories and identify affected artifacts and evidence gaps.

  2. 02

    Rebuild and test

    Change the recipe, create a replacement image, regenerate inventory, and rerun VM checks.

  3. 03

    Approve and roll out

    Connect the evidence to the customer change process and rollout system as a scoped pilot integration.

Remediation questions

Is CVE assessment available today?

Yes, for supported package inventories and advisory sources. Coverage and ambiguity are reported explicitly.

Is automated fleet rollout generally available?

No. Automated rebuild approvals, ServiceNow integration, and fleet rollout are technical-pilot capabilities whose fit depends on the customer operating model.

What happens when version comparison is ambiguous?

The assessment remains unknown. OpenFactory does not convert an ambiguous package range or incomplete inventory into an unaffected result.

Exercise the response before the urgent advisory

Select one known package update and validate the assessment, rebuild, evidence, and approval steps against your real process.

Scope a remediation pilot