Skip to main content

KB-CVE Mappings

The KB-CVE Mappings page provides visibility into how Microsoft Knowledge Base (KB) patches relate to the CVEs they fix. This information is crucial for accurate vulnerability exposure calculations on Windows systems.

Why KB-CVE Mappings Matter​

When calculating vulnerability exposure, it's not enough to know which CVEs affect your software—you also need to know which CVEs have already been patched. KB-CVE mappings enable NopeSight to:

  • Reduce False Positives: Exclude CVEs that are already fixed by installed patches
  • Calculate True Exposure: Show only vulnerabilities that are actually unpatched
  • Prioritize Remediation: Focus on vulnerabilities without available fixes

Accessing KB-CVE Mappings​

  1. Navigate to SAM in the main menu
  2. Under Vulnerability Management, click KB-CVE Mappings

Understanding KB-CVE Mappings​

Summary Statistics​

MetricDescription
KB ArticlesTotal Microsoft patches in the database
Unique CVEsNumber of CVEs addressed by tracked patches
CriticalPatches addressing critical severity CVEs
ImportantPatches addressing important severity CVEs
ModeratePatches addressing moderate severity CVEs

Search and Filters​

  • Search: Find specific KB articles by number or title
  • Severity: Filter by patch severity level
  • Date Range: Find patches released within a specific period

KB Mapping Details​

Each KB entry shows:

FieldDescription
KB IDMicrosoft Knowledge Base identifier (e.g., KB5034441)
TitleDescription of the security update
Release DateWhen the patch was released
SeverityOverall severity rating
CVEs FixedList of CVEs addressed by this patch
Affected ProductsWindows versions this patch applies to

How KB-CVE Mapping Works​

Data Collection Flow​

Microsoft MSRC API
        │
        ├─→ Security Update Information
        │         │
        │         └─→ KB Articles
        │                 │
        │                 └─→ CVEs Fixed per KB
        │
        └─→ NopeSight KB-CVE Mappings Database
                          │
                          ▼
                Windows Device Discovery
                          │
                          ├─→ Installed Hotfixes (KBs)
                          │
                          └─→ Patched CVE Identification
                                    │
                                    ▼
                          Accurate Exposure Calculation

During Vulnerability Assessment​

  1. CVE Identification: NopeSight identifies CVEs affecting installed software
  2. KB Lookup: Installed patches are retrieved from device scan data
  3. Mapping Check: Each installed KB is checked for CVEs it fixes
  4. Exclusion: Fixed CVEs are excluded from the vulnerability report
  5. True Exposure: Only unpatched vulnerabilities are reported

Practical Example​

Consider a Windows Server with the following scenario:

Installed Software: Windows Server 2022, SQL Server 2019

Potential CVEs:

  • CVE-2024-21302 (Windows Kernel)
  • CVE-2024-21303 (SQL Server)
  • CVE-2024-21304 (Windows RDP)

Installed Patches: KB5034123

KB-CVE Mapping Shows: KB5034123 fixes CVE-2024-21302 and CVE-2024-21304

Result: Only CVE-2024-21303 appears in the vulnerability report

Understanding Patch Relationships​

Supersession​

Microsoft patches often replace (supersede) older patches:

  • Superseded By: A newer patch that includes all fixes from this one
  • Supersedes: Older patches that this KB replaces

When a newer cumulative update is installed, it typically includes fixes from previous updates.

Cumulative Updates​

Windows uses cumulative updates that include:

  • All previous security fixes
  • Quality improvements
  • Previous cumulative update content

This means installing the latest cumulative update provides protection for many older CVEs.

Using KB-CVE Mappings​

Verify Patch Coverage​

To check if a specific CVE is addressed:

  1. Search for the CVE ID
  2. Review which KBs fix that CVE
  3. Check if those KBs are installed on affected systems

Plan Patch Deployment​

When planning updates:

  1. Identify high-priority unpatched CVEs
  2. Find KBs that address those CVEs
  3. Verify KB compatibility with your Windows versions
  4. Schedule deployment

Audit Patch Status​

For compliance and auditing:

  1. Export KB mapping data
  2. Cross-reference with installed patches
  3. Document patching coverage
  4. Identify gaps in coverage

Data Freshness​

KB-CVE mappings are synchronized from Microsoft Security Response Center (MSRC):

  • Automatic Updates: Data is refreshed periodically
  • Patch Tuesday: New mappings added after monthly security releases
  • Out-of-Band Updates: Emergency patches are added as released
Patch Tuesday

Microsoft releases security updates on the second Tuesday of each month. New KB-CVE mappings are typically available within 24-48 hours of release.

Limitations​

Windows-Specific​

KB-CVE mappings apply only to Microsoft products. For other software:

  • Check vendor security advisories
  • Monitor software-specific update channels
  • Review CVE references for patch information

Mapping Completeness​

Not all KBs have CVE mappings:

  • Quality updates may not address specific CVEs
  • Some fixes are proactive rather than vulnerability-related
  • Feature updates have separate tracking