I open this thread just to point the attention to this KNOW BUG. We are on VSA 9.5 on-prem, and we noticed that many machines have many "vulnerabilities" shows in Software Management module. We opened a ticket at Kaseya support and they reply us:
"This is being caused by the issue described in the two articles below:https://helpdesk.kaseya.com/hc/en-gb/articles/360000760191 https://community.ivanti.com/docs/DOC-62314When a Security Monthly Quality Rollup patch has been installed on a machine, Software Management incorrectly displays older Security Only Quality Update patches as Vulnerabilities. So basically it does not detect that the Security Monthly Quality Rollup contains all the Security Only Quality Update patches"
Unfortunately, the reply ends with:
"I do not have an ETA for the fix for this issue at this time. As soon as I have any further information I will let you know."
I think (and I guess that other Kaseya customers agree with me) that this BUG has to be fixed as soon as possible: actually, we are not able to determine if a customer is "fully patched/protected or not". Moreover, our Executive Summary monthly reports, have "bad score" and we have to "apologize and explain why of that results".
To conclude, I kindly request Kaseya, to SOLICIT Ivanti to resolve this bug.
Someone else with the same issue?
This has been a thing since the product has been released day 1. I built my own executive summary report from scratch using a combination of reports and simply just stay away from the prebuilt one because it doesn't account for many things. I built a report that excludes any patch that has been rejected from the report so numbers reflect real missing patches, I also deny any security patch thats > 30 Days except if they are office patches using override settings.
This is something I reported a long time ago and they have assured me is being taken into consideration in the development.