CTERA’s vulnerability and patch management procedures encompass the remediation of common vulnerabilities & exposures (CVEs).
Remediation is provided for actively supported product versions, and on condition of a valid cloud-care subscription.
Remediation may be, at the discretion of CTERA engineering, provided as part of the regular product release cycle, or through the issuance of “out-of-band” patches to the customer, when the severity of newly discovered vulnerabilities command urgent remediation actions that do not fit into CTERA’s software product roadmap.
The following table defines the criticality of vulnerabilities and expected time for a resolution, where:
Priority (QVSS Score*) | Target Remediation Timeline** |
|---|---|
1 - Critical | 7-14 days |
2 - High | 14-30 days |
* The QVSS (Qualys Vulnerability Scoring System) score includes threat intelligence considerations which are not included in CVSS (Common Vulnerability Scoring System) scores.
** The timeline is the time for a fully integrated and tested version and starts from time the vendor releases a fix.
Related Articles
Linux kernel IPv4 TCP vulnerability: CVE-2026-98432
PHP2Shell Remote Code Execution (RCE) Vulnerabilities
CTERA Portal Nessus False Positive: CVE-2024-41110 AuthZ Bypass
CTERA Edge Filer Cross-site Request Forgery (CSRF) Vulnerability
OpenSSH Vulnerability CVE-2024-6387 (regreSSHion)
Edge Filer Security Vulnerability
Samba Vulnerability CVE-2021-44142
Security Vulnerability CVE-2021-4034 (Polkit (Pwnkit)
Security Vulnerability CVE-2021-44228 (Log4Shell)
Security Vulnerability CVE-2022-0847 (Dirty Pipe ) and CVE-2022-0001 (Spectre-BHI )
Security Vulnerability CVE-2022-22965 and CVE-2022-22963 (Spring4Shell Zero-Day Vulnerability)