Vulnerability statuses and resolutions

Last updated: October 21, 2026

Use this article when you need to move a vulnerability through triage or understand its resolution.

Status groups

  • Active statuses: Open, Confirmed, Needs Review, In Progress, and In Review.

  • Final statuses: Resolved and Closed. A resolution is required when a vulnerability reaches a final status.

What does Needs Review mean?

Needs Review can reflect an unresolved automated assessment or a review requested by a person. Read the evidence and review reason on the vulnerability detail page.

Confirmed exploitable evidence can coexist with a human-review requirement for other evidence. The workflow status and the analysis results describe different aspects of the finding. Final findings in Resolved or Closed no longer show an active human-review requirement. See Human review and analysis.

Resolutions

  • Fixed: Cysmiq confirmed remediation. This resolution is scanner-managed and cannot be selected manually or submitted through API or CLI triage.

  • Won't Fix: the team accepts the risk and will not remediate.

  • False Positive: the finding is not a real issue.

  • Duplicate: the same issue is tracked elsewhere.

  • Cannot Reproduce: the issue cannot be verified.

  • Done: the work is complete.

False positive workflow

  • Open the vulnerability detail view.

  • Set the status to Closed.

  • Choose False Positive as the resolution.

  • Add a comment with the reviewer, evidence, or linked discussion.

  • Save the status change.

Reopening behavior

A final vulnerability can be reopened manually only when Cysmiq still has an active location for it. Status changes and scan-triggered regressions appear in the vulnerability detail view.

Which branches determine whether a finding is fixed?

In Cysmiq Cloud, Vulnerability fix branches controls automatic resolution. The default policy uses primary branches, including the repository's default branch. A finding can become Resolved / Fixed while an active location remains on another branch.

Changing the policy recalculates existing findings and can reopen automatically fixed findings. Automatic branch resolution preserves manually chosen workflow outcomes. Provider-checked secrets still require verification; context-assessed secrets require manual closure when that setting is enabled. See Automatic resolution and Vulnerability fix branches.

Stable 1.14.10 uses the earlier resolution behavior based on all active locations.

Canonical docs

For the maintained reference, see Vulnerability lifecycle.

Contact support if

  • An expected status transition or resolution is unavailable.

  • A final vulnerability reopens and you need help understanding why.

  • You need help deciding between Won't Fix, False Positive, Duplicate, or Cannot Reproduce.