Managing “Unfixable” CVEs Without Turning Exceptions Into Permanent Blind Spots

The question

“When facing unfixable CVEs that an auditor or compliance framework flags, security teams typically rely on three steps to satisfy compliance without writing endless manual exceptions: 1. **Formal Risk Acceptance with Expiration:** Document why the vulnerability cannot be fixed (e.g., upstream dependency, breaking change), map out the true attack path or compensating controls in your environment, and get formal management sign-off with a defined review date (typically 90 days). Auditors want to see a paper trail of controlled risk, not a silent scanner suppression. 2. **Contextual Reachability Analysis:** Use advanced SCA (Software Composition Analysis) or reachability tools (like Snyk or Grype) to prove whether the vulnerable code path is actually invoked, compiled, or reachable in your specific configuration. 3. **Structural Reduction:** Minimize your attack surface by stripping out unused packages or shifting to minimal/distroless base images, which often eliminate unfixable OS-level CVEs entirely.”

Explore the complete package

Ask your own question

Turn a complex question into a source-backed briefing, editable document, podcast, slides, and training video.