Skip to main content

Prove Linux fixes are live.
Not just installed.

oxharden verifies vulnerability remediation from live host evidence: vulnerable packages, running kernels, mapped libraries, exposed services, and CIS/DISA STIG controls across RHEL-family Linux fleets.

View sample report Start 14-day trial
RHEL-family LinuxPatch verificationRestart debtCIS + DISA STIGRead-only agent
Focused on live Linux remediation evidence
Patch verificationRestart debtRHELRockyAlmaLinuxOracle LinuxAmazon Linux 2023CISDISA STIG
What oxharden answers

Which fixes are actually running?

oxharden collects live host state once, then connects vulnerability findings, installed packages, running kernels, mapped libraries, exposed services, and compliance evidence into one answer security teams can act on.

acme-prod / packages / scan
Monitor
Dashboard
Hosts347
Packages2,184
Ports4,218
CVEs189
Compliance
Exposure47
Scans
Manage
Enroll host
Organization
acme-prod › Package risk
Search hosts, packages, CVEs…⌘K
KM

Package risk

347 hosts · 2,184 packages assessed · 189 CVEs matched · 2m 11s

Re-scan
Ranking
KEV-first
exploit signals over CVSS
Reboot debt
Applied ≠ live
86 hosts still vulnerable
Coverage
5 Linux families
vendor advisories matched
86 hosts are "patched" by version but still running vulnerable code. Old libraries remain mapped into long-running services.Review
Top package fixesranked by exploit signals + fleet impact
PackageFixHostsKEVRisk retired
xz-libs5.2.5-7 → 5.2.5-842KEV86 CVEs
openssl3.0.7-27 → 3.0.7-31187.8 EPSS24 CVEs
kernel5.14.0-427 → 5.14.0-50331reboot19 CVEs
glibc2.34-83 → 2.34-10078KEV41 CVEs
polkit0.117-13 → 0.117-1596KEV12 CVEs
curl7.76.1-29 → 7.76.1-31248.2 EPSS9 CVEs
Why oxharden

Patch windows do not end at install.
oxharden shows what is still live.

01 · Applied ≠ live

“Patched” by version. Still running the vulnerable code.

A kernel CVE is not closed until the host reboots. A library fix is not live until every service that mapped it restarts. oxharden tracks applied-vs-live state, so your dashboard reflects what is actually running, not just what the package manager reports.

oxharden tracks applied-vs-live state, so patched-but-still-running risk stays visible until the fix actually takes effect.

On disk
ON DISK · package layer
openssl-libs3.0.7-27.el9rpm db · fixed
patched build installed — the package manager reports it resolved
IN MEMORY · running processes
nginxpid 1841↳ libssl.so.3 · 3.0.7-18 (deleted)
postgrespid 2207↳ libssl.so.3 · 3.0.7-18 (deleted)
redis-serverpid 995↳ libssl.so.3 · 3.0.7-18 (deleted)
31 services still map the old inode — loaded before the upgrade, never re-exec'd
KERNEL · running image
uname -r5.14.0-427installed5.14.0-503reboot pending
fixed kernel staged on disk; the running image won't change until reboot
reconciling installed ↔ live…
1/4On disk
Run an upgrade and the package database flips to the fixed build. By version alone, openssl-libs 3.0.7-27 reads as patched — which is where most scanners stop.
02 · Exploited first

CVSS is not a work queue.

A list of 189 CVEs is noise if the exploited ones are buried halfway down. oxharden brings KEV and EPSS to the top, then uses CVSS for impact context, so teams fix the vulnerabilities attackers are most likely to use first.

Detected
189
CVEs detected · acme-prod fleet
46 score CVSS ≥ 7.0 — far too many to call any one of them "the priority"
4
CISA KEV — confirmed exploited
9
EPSS ≥ 0.50 — likely in 30 days
37
CVSS ≥ 7.0 — high impact
139
Tracked · lower priority
ranking by real-world exploitability…
1/4Detected
189 CVEs across the fleet. Sorting by CVSS alone leaves dozens tied at "high" — a flat list that says everything is urgent, so nothing is.
03 · Fix the work, not the row

One remediation can close many findings.

oxharden groups findings by the work required: package upgrade, service restart, reboot, or configuration change. Copy the Bash or Ansible guidance where available, then re-scan to verify the risk is gone.

Group
Findings → the actual unit of work
CVE-2023-0464CVE-2023-0465CVE-2022-4304+20
↓ grouped into one remediation
upgrade openssl-libs → 3.0.7-27.el9closes 23 CVEs
ranked by risk retired = CVEs × hosts closed
1/3Group
One upstream fix usually answers many CVEs. Findings are grouped into remediations — the real unit of work — and ranked by how much risk each one retires across the fleet.
Everything in one agent

From finding to closure, with evidence.

Inventory, vulnerability risk, live patch state, compliance, and exposure all come from the same host record, so teams can move from finding to affected system to closure without guessing what changed.

Live Host Evidence source of truth
Every host, package, running kernel, mapped library, port, CVE, compliance result, and agent status in one searchable record.
hostfix installedrunning coderestart debtevidence
Explore
Patch Verification applied vs live
Show whether fixed packages and kernels are actually running, or still waiting on a service restart or reboot.
Explore
Vulnerability Management KEV + EPSS
Prioritize Linux CVEs by exploit signals, affected hosts, available fixes, and whether remediation is live.
Explore
Attack-Surface Exposure reachable ports
Listening sockets mapped to reachability, owning process, package, risky protocol, and TLS posture.
Explore
Compliance Evidence CIS / DISA
Continuous CIS and DISA STIG scoring with expected-vs-actual host evidence for every rule.
Explore
<2 min
to first scan
live
patch verification
CIS + DISA
continuous baselines
reboot debt
kernel evidence
Get started

See what your Linux fleet is really running.

Review a sample Patch Truth report, then start a 14-day trial to verify live fixes, restart debt, exposure, and compliance evidence on up to 30 of your own hosts.

View sample reportStart 14-day trial
Prefer to click around first? Explore the live demo, or book a guided walkthrough.
install.sh
curl -fsSL https://packages.executepath.dev/install.sh \
  | sudo EXPECTED_GPG_FINGERPRINT=13094D5AB037E6CD79CDFA3A51687EAC6B931A09 bash
✓ agent enrolled · ip-10-20-2-107
✓ live state synced · kernel · packages · ports
✓ first scan complete · 3 restart debts · 1 reboot pending
FAQ

Questions, answered.

Deploy the lightweight agent with curl, dnf, or automation tooling like Ansible. It checks in periodically, captures package, process, port, and kernel posture, detects restart or reboot debt, and evaluates compliance locally on each host. The agent is strictly read-only, so it reports findings without making changes.