Stop patching by CVSS alone.
oxharden inventories every package on every Linux host, matches versions to distro advisories, and ranks package risk by real-world exploitation signals, fleet impact, and whether vulnerable code is still running.
CVSS is not a patching strategy.
oxharden shows what is dangerous now: exploited CVEs, exposed vulnerable services, and patched hosts still running old code.
CVSS is context. Exploitation drives the queue.
A theoretical 9.8 and an actively exploited 7.5 should not compete equally. oxharden brings KEV and EPSS to the top, so exploited and likely-to-be-exploited CVEs drive the work queue.
Patching is not done until the old code stops running.
Package version checks miss the messy part after patching. oxharden shows when a host has the fixed package installed but is still running the previous kernel or stale shared libraries, so teams know exactly when a service restart or reboot is still required.
Fix the package, not the spreadsheet.
Instead of handing you one row per CVE, oxharden shows the actual remediation units: which package needs to change, which hosts need it, and how much risk that work retires.
CVEs are findings. Package upgrades are the work. oxharden groups vulnerabilities by the remediation that closes them, then ranks each fix by how much risk it retires across the fleet.
# disable SSH root logon printf 'PermitRootLogin no\n' \ > /etc/ssh/sshd_config.d/50-stig.conf sshd -t && systemctl reload sshd
Unknown never counts as clean.
Missing data should not make a dashboard look better. oxharden calls out unscanned hosts, stale agents, and missing or stale vulnerability feeds so coverage gaps are visible before they become audit gaps.
From installed package to prioritized fix.
Inventory
The agent inventories installed packages and versions, running processes, loaded libraries, and kernel state on each host. No network scanning, no credentials to manage.
Match & Enrich
Installed versions are matched against distro security advisories and vulnerability feeds, then enriched with exploitation signals.
Rank & Fix
Findings are ranked by real-world risk and grouped into the package updates, service restarts, or reboots that retire them.
The technical details, up front.
No black box. Here's exactly what the agent reads, where vulnerability data comes from, and how findings are ranked.
One agent connects every risk view.
Launch your first scan in minutes.
Not ready to install? Click around the live demo with real fleet data first. Then start a 14-day free trial on up to 30 of your own hosts.
curl -fsSL https://packages.executepath.dev/install.sh \ | sudo EXPECTED_GPG_FINGERPRINT=13094D5AB037E6CD79CDFA3A51687EAC6B931A09 bash
✓ inventory synced · 410 packages · 4 ports
✓ first scan complete · 12 critical · 19 vulnerable pkgs
Vulnerability scanning, answered.
CVSS measures potential impact. It does not tell you whether attackers are exploiting a vulnerability today. oxharden prioritizes real-world exploitation signals like CISA KEV and FIRST EPSS, then uses severity, exposure, and fleet impact to help rank the work.
It catches cases where a fix is installed but not yet active: a kernel updated on disk but not booted, or a shared library patched on disk while long-running services still map the old copy in memory. The agent inspects /proc, running kernel state, and open file handles to find them.
No inbound access and no host credentials are required. The agent reads local package, kernel, and process state, then checks in over an outbound connection.
NVD, CISA KEV, FIRST EPSS, and per-distro vendor advisories such as RHSA, ELSA, and ALAS. Missing or stale distro coverage is flagged as a gap instead of being treated as clean.
oxharden groups findings by the remediation that closes them: package update, service restart, or reboot. That way teams can see the actual unit of work and how many CVEs and hosts it retires.
Yes. oxharden keeps findings open when the package is fixed but vulnerable code is still running, and calls out the follow-up action needed to make the fix live.
JSON and CSV exports are available today, with API access for integration workflows.