Per-CVE validation

What it is

A focused, per-CVE invocation of the AI exploit engine. Instead of the general “find what’s exploitable” run, you click a specific CVE on a specific service and the agent attempts to reproduce that exact chain. The verdict updates the per-CVE row directly so the UI badge flips inline.

What it produces

For each per-CVE validation run:

• A status: exploitable, not_exploitable, or inconclusive
• A one-page proof if exploitable: verbatim HTTP exchange that demonstrates the chain
• A reason string if not: typically “patched”, “behind WAF”, “wrong configuration”, “wrong version after re-fingerprint”
• An entry in cve_validations linked to the underlying ai_exploit_runs row, so the audit trail and cost accounting match the rest of the engine

What to use it for

• Closing out a finding: “is this nginx 1.18 actually exploitable for CVE-2022-X, or just a version-string false positive?”
• Re-checking after a patch: “we pushed the fix yesterday. Confirm it’s gone.”
• Building defensible non-findings: “we tried, the chain didn’t reproduce, here’s why.”

Why it matters

The single biggest cost line on a vulnerability program is the human time spent triaging false positives from version-string CVE matchers. Per-CVE validation cuts a class of triage out entirely: the agent says “yes” or “no” with a reproducible artefact.

Why it’s valuable

• Surgical. One CVE, one service, one run. Bounded scope means bounded cost.
• Idempotent. Re-running validates the patch landed without re-doing discovery / fingerprint.
• Auditable. The cve_validations row sticks around with the PoC even after the service is rescanned.

How to use it

1. Open a service detail drawer.
2. The CVE table has a Verify button per row.
3. Click. The agent runs in ~30 seconds for HTTP-shaped CVEs (longer for the ones that need multi-step authentication setup).
4. The CVE row’s badge flips to one of three states.
5. Click the run ID to read the full cinematic replay.

Cost is metered against your AI bundled allowance. Typical per-CVE runs are $0.10 – $0.50 in API tokens.

Auto-verify (optional)

Rather than clicking Verify by hand, an org admin can turn on auto-verify in workspace settings. When a new CVE that is both actively exploited (on the CISA KEV list) and confirmed to affect the detected version lands on an asset, Umbra runs the same per-CVE validation for you and flips the badge when it finishes.

It’s off by default and deliberately narrow (only the version-confirmed KEV slice, never the broad “product-only” matches) so it can’t quietly drain your balance. Every auto-run passes the same gates as a manual one: the target must be authorized, your plan must include AI validation, and your balance must cover the estimated cost, or it’s skipped. It never re-verifies a CVE that already has a verdict.