How do GetProductVulnerability and GetLatestInstaller work together to remediate Windows OS vulnerabilities?

GetProductVulnerability (method ID 50505) reports which CVEs exist on an endpoint and which Windows KB addresses each one. GetLatestInstaller (method ID 50300) reports which update the endpoint should install next. The KB numbers in the two responses are often different, because Microsoft rolls older fixes into newer cumulative updates, and both are correct. This article explains what each method returns and how to read the two together.

This article applies to Windows OS vulnerabilities on the system signature 1103. Third-party applications, macOS and Linux use different mapping keys.

What each method returns

GetProductVulnerability (50505) reports the CVEs detected on the endpoint for its OS version and build. For each CVE, the details.resolution object carries:

• patches[]: the direct KB, the KB Microsoft published as the fix for this CVE. Its installable flag says whether that KB can be applied on this endpoint.

• remediation_patches[]: the optimal KBs to deploy to close this CVE, each with an install_order. This list already accounts for supersedence (a newer cumulative update that contains the fix) and prerequisites (a servicing stack or checkpoint update that must be installed first). It is returned when the request sets include_remediation_patches: true.

• advisory_url: the Microsoft advisory link for the CVE.

GetLatestInstaller (50300) reports the next update the endpoint should install:

• security_update_id: the optimal KB the SDK will install, the latest cumulative update applicable to the endpoint.

• analog_id: the unique identifier of that patch.

• url and expected_sha1[]: the download link and hash of the installer.

The two methods cover each other. GetLatestInstaller always returns the optimal KB. GetProductVulnerability shows both the direct KB and the optimal KB, in patches[] and remediation_patches[] respectively, so a CVE can be tied to what fixed it and to what should be installed in one response.

How the workflow fits together

One scan, one resolve, one install, one re-scan. GetProductVulnerability finds the CVEs and names the KBs. GetLatestInstaller turns those KBs into the update the endpoint will accept. InstallFromFiles (method ID 50301) installs it. A fresh GetProductVulnerability scan proves the CVE is closed.

Workflow at a glance: GetProductVulnerability (50505) → GetLatestInstaller (50300, index 0) → InstallFromFiles (50301) → GetLatestInstaller (next index) … repeat until it returns -1039 → GetProductVulnerability again to verify the CVE is gone.

The loop in the middle exists because prerequisites such as servicing stack and checkpoint updates are evaluated against the endpoint's current state. The next update in the chain becomes visible only after the previous one is installed.

1. Scan. Call GetProductVulnerability with signature: 1103 and include_remediation_patches: true. For each CVE, record the direct KB from patches[], its installable flag, and the optimal KBs from remediation_patches[] in install_order.

2. Resolve. Call GetLatestInstaller with signature: 1103, index: 0. The response gives the optimal KB (security_update_id), the analog_id, and the download url with expected_sha1[].

3. Install. Call InstallFromFiles with the optimal KB. Install one update at a time, in install_order, and restart when the return code asks for it.

4. Repeat. Call GetLatestInstaller with index: 1, 2, … and install each result until it returns WA_VMOD_ERROR_OUT_OF_RANGE (-1039), which means nothing is outstanding.

5. Verify. Run GetProductVulnerability again. A CVE that no longer appears is remediated. An install return code alone does not close a CVE.

Worked example

CVE-2024-38081 was fixed by KB5039893, which Microsoft later superseded with KB5041019. Both KBs close the CVE; KB5041019 is the one to install.

Scan request:

Scan response, one CVE, trimmed:

Resolve request:

Resolve response, trimmed:

KB5039893 is the direct KB for CVE-2024-38081; KB5041019 is the optimal KB, and both responses agree on it. Install KB5041019; it contains KB5039893, so the CVE disappears on the next scan.

Response patterns in remediation_patches

KB numbers are illustrative.

If Further Assistance is required, please proceed to log a support case or chatting with our support engineer.