PatchBee docs
Security updates
PatchBee shows which known vulnerabilities (CVEs) affect the apps you have deployed, and which of them an available update fixes. The data comes from the National Vulnerability Database (NVD), with the CISA list of vulnerabilities that are being actively exploited layered on top. It is there to help you decide what to update first; it is not a vulnerability scanner for your devices.
Where you see it
- Update Candidates. A Security column shows what each update fixes, for example "Fixes 2 CVEs (max 9.8)". A red Exploited chip means at least one of those CVEs is known to be exploited in the wild. Click the chip to list the CVEs with their scores right below the row. Tick Security updates only to hide updates that fix nothing security-related.
- Deployed Apps. Under the current version of each app you see "N open CVEs", coloured by the worst score, or No matching CVEs when nothing in the database matches that version. Click it to open the app's page with the full list.
- App Library. Open an app and scroll to Known vulnerabilities to see which versions are affected and how badly. Show CVEs on a version lists them; each one links to its page on NVD.
| Band | CVSS score |
|---|---|
| Critical | 9.0 and above |
| High | 7.0 to 8.9 |
| Medium | 4.0 to 6.9 |
| Low | below 4.0 |
A CVE can be listed before it has a score; it then reads unscored. The exploited flag does not wait for a score.
Fast-track critical fixes
If an app uses auto-approve (see Automating updates), you can let PatchBee skip the safety delay when an update fixes something serious:
- Open Deployed Apps and find the app. Its policy must be Auto-package.
- In the CVSS fast-track box next to the delay, type a score, for example
7. - From then on, an update that fixes a CVE scoring 7.0 or higher, or one on the actively-exploited list, is approved on the next sweep instead of waiting out the delay. Updates below that line keep the delay you set.
Leave the box empty to turn the fast-track off. It only applies to apps on the Auto-package policy.
Example: a browser with a two-day delay and a fast-track at 7
Google Chrome is on Auto-package with a two-day delay, so most new builds wait two days while your pilot ring tries them. With the fast-track set to 7, a build that closes a high or critical CVE, or one that CISA says is being exploited, is approved on the next sweep and starts through your rings straight away. A build that fixes nothing security-related still waits its two days.
When there is no data
Some apps show no security information at all. That means PatchBee has no vulnerability data for the app, either because it is not yet linked to its entry in the vulnerability database or because the database returned nothing for it. It does not mean the app has no vulnerabilities. About two hundred of the most common apps are linked out of the box (browsers, PDF readers, developer tools, remote-access and VPN clients, password managers and more); ask your PatchBee administrator to link the others.
- No matching CVEs is not a guarantee. It means nothing published so far matches that version. Vulnerabilities are often published weeks after the fix ships, so a version that reads clean today can show a CVE next month.
- Vulnerabilities that only affect a vendor's mobile apps are left out: PatchBee only counts the ones that apply to the Windows or Mac version you deployed.
- A few CVEs are recorded without saying which versions they affect. The app page lists those separately ("without a version range"); they never count as open or fixed, and they never trigger the fast-track.