> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/software-composition-analysis-sca-vulnerability-issues.md).

# Software Composition Analysis (SCA) vulnerability issues

SCA vulnerability scanners safeguard your software supply chain by identifying known CVEs in open-source packages and third-party libraries consumed by your applications. By detecting vulnerable dependencies at code-time, SCA scanners closes the gap between development practices and production-time security posture, preventing remote code execution, privilege escalation, and data exfiltration from silently propagating into live environments through compromised upstream packages.

Cortex Cloud supports both a native SCA scanner and third-party SCA data ingestion. For details on third-party scanners, refer to [Ingest third-party data sources](/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources.md).

The Vulnerabilities page consolidates all scanner-detected CVE vulnerability issues across monitored repositories into a single view where you can prioritize, investigate, remediate, and track SLA compliance.

## Workflow

Use the child pages for each stage of the workflow:

1. [Understand the Vulnerabilities table](/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/software-composition-analysis-sca-vulnerability-issues/understand-the-vulnerabilities-table.md).
2. [Investigate, prioritize and remediate vulnerability issues](/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/software-composition-analysis-sca-vulnerability-issues/investigate-and-remediate-cve-vulnerability-issues.md).
3. [View and understand CVE findings](/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/software-composition-analysis-sca-vulnerability-issues/investigate-cve-vulnerabilities-findings.md).

## Prerequisites

| Prerequisite            | Description                                                                                          |
| ----------------------- | ---------------------------------------------------------------------------------------------------- |
| **License**             | An active Cortex Cloud license with Application Security add-on entitlements                         |
| **RBAC Role**           | The AppSec Admin or SOC Analyst role, or an equivalent custom role with issue management permissions |
| **VCS Integration**     | At least one Version Control System (GitHub, GitLab, Bitbucket, Azure DevOps) integrated and active  |
| **SCA Scanner**         | The SCA scanner enabled for the target repositories                                                  |
| **Periodic or PR Scan** | At least one completed periodic scan or PR scan that includes SCA scanning results                   |

## Core achievements and use cases

* **Shifting security left and developer integration:** Detecting vulnerable open-source dependencies at code-time, before compromised packages are deployed, reduces the cost and risk of post-deployment remediation. SCA scans identify and flag critical CVEs such as remote code execution, SQL injection, and deserialization vulnerabilities directly within dependency manifests (such as package.json, pom.xml, requirements.txt, go.mod) across monitored repositories. This scanning integrates seamlessly into development workflows. Developers can detect findings locally using the Cortex CLI or directly within supported IDEs (Visual Studio Code, JetBrains) via plugins, providing real-time security feedback as they write code.
* **Accelerating issue remediation:** Fix version recommendations and upgrade guidance enable developers to resolve CVE vulnerabilities directly in the source repository without context-switching to external tools. All Critical and High CVE vulnerability findings are categorized as actionable issues. The platform streamlines remediation efforts by identifying the minimum safe version that resolves the vulnerability and providing package upgrade paths
* **Reducing vulnerability noise:** Urgency-based prioritization isolates the CVE vulnerabilities that affect deployed, internet-exposed, or business-critical assets from low-risk findings in development environments. Reachability analysis determines whether the vulnerable function is actually invoked in the application code, suppressing CVEs in imported-but-unused library paths. EPSS scoring and KEV catalog cross-referencing further distinguish actively exploited vulnerabilities from theoretical risks
* **Establishing compliance baselines and policy enforcement:** Mapping CVE vulnerabilities to detection rules and CVE identifiers (such as CVE-2021-44228, CVE-2023-34039) provides auditable evidence of compliance with organizational security policies, NIST SSDF, and software supply chain security standards. Furthermore, you can create and apply custom policies and rules that define how the system responds to SCA threats, allowing for tailored security checks and automated actions, such as blocking CI runs or pull requests based on detected vulnerabilities


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/software-composition-analysis-sca-vulnerability-issues.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.