Skip to content
Hermes Codex

Software Intelligence: Version Vulnerability Intelligence Engine

Interactive Software Posture Analyzer

Section titled “Interactive Software Posture Analyzer”

Enter any software product name or common alias (e.g., Apache, Veeam, httpd, OpenSSL, LiteLLM) along with an exact version string to evaluate known applicable vulnerabilities and weaponized threat exposure:

HERMES SOFTWARE INTEL & SECURITY DELTA

Enter a product and exact version. Discover what threatens it — and what matters now.

Quick Presets:

1. Product Philosophy & Doctrinal Design

Section titled “1. Product Philosophy & Doctrinal Design”

The Hermes Software Intelligence engine follows a non-negotiable core architectural axiom:

Use deterministic structured data to determine vulnerability applicability; use intelligence to enrich, prioritize, correlate, and explain results.

In modern cybersecurity operations, relying on a large language model (LLM) to perform version comparison and interval testing produces hallucinations, dangerous false negatives, and false alarms. Hermes separates the stack into two independent tiers:

┌──────────────────────────────────────────────────────────┐
│                   DETERMINISTIC LAYER                    │
│   CPE / Product Resolution · Version Range Boundaries   │
│   Exact Ingestion Math · CISA KEV Status · EPSS Scores   │
└────────────────────────────┬─────────────────────────────┘
                             │
                             ▼
┌──────────────────────────────────────────────────────────┐
│                    INTELLIGENCE LAYER                    │
│   Exploit Maturity · Root Cause Analysis · Attack Paths  │
│   Hermes Editorial Cross-Linking · Remediation Playbooks │
└──────────────────────────────────────────────────────────┘

2. Nuanced Vulnerability Status Model

Section titled “2. Nuanced Vulnerability Status Model”

A major flaw of legacy CVE aggregators is reducing complex configuration states to a binary « Vulnerable / Safe » judgment. Hermes strictly classifies every result into five standardized states:

Status IdentifierOperational Meaning & Criteria
AffectedThe supplied version falls strictly inside the documented affected version range without requiring optional non-default modules.
Configuration dependentThe version falls inside the affected range, but active exploitation requires specific non-default flags, compiled modules (e.g., mod_cgi), or architectural prerequisites.
Potentially affectedThe vendor advisory indicates theoretical exposure across major releases, but exact minor boundary verification remains incomplete.
Not affectedThe supplied version is strictly outside the affected boundary, or is equal to or greater than the official fixed version.
UnknownInsufficient structured CPE range data is available to make a deterministic decision. The system refuses to guess.

3. Fundamental Principle: “No Known CVE” ≠ “Secure”

Section titled “3. Fundamental Principle: “No Known CVE” ≠ “Secure””

4. Prioritization Matrix: CISA KEV & EPSS

Section titled “4. Prioritization Matrix: CISA KEV & EPSS”

Hermes layers real-world exploitation telemetry directly over CVSS base metrics:

  • CISA KEV (Known Exploited Vulnerabilities): Flags whether threat actors, ransomware syndicates (e.g., Akira, Qilin), or initial access brokers are actively weaponizing the vulnerability in production environments.
  • EPSS (Exploit Prediction Scoring System): Quantifies the statistical probability (0.0% to 100.0%) that a software vulnerability will be exploited in the wild within the next 30 days.
  • Hermes Deep-Dive Correlation: Whenever a vulnerability is covered by original Hermes reverse-engineering research, a direct link connects the analyzer to our comprehensive disassembly, Sigma/KQL detection rules, and incident response playbooks.

5. Version Comparison & Security Delta Engine

Section titled “5. Version Comparison & Security Delta Engine”

The workbench features a Version Comparison Mode designed to evaluate upgrade paths (e.g., 2.4.49 $\rightarrow$ 2.4.51):

  • Eliminated Vulnerabilities: Flaws active in the source version that are completely neutralized in the target release.
  • Residual Risks: Vulnerabilities that persist even after upgrading, highlighting when a higher patch or secondary configuration hardening is necessary.
  • Regressions: Warnings if a target version inadvertently introduces newer unpatched CVEs.
  • Remediation Target Recommendation: The engine automatically analyzes available vendor patches to identify the lowest version that eliminates 100% of KEV and Critical threats.

6. Hermes Threat Score (HTS) Model

Section titled “6. Hermes Threat Score (HTS) Model”

The Hermes Threat Score (HTS) is a composite metric on a 0 - 100 scale that quantifies true operational exposure:

HTS = Min(100, (5 × CVSS_max) + (15 × EPSS_max) + (25 × KEV_flag) + (10 × Exploit_flag))
  • Base Severity (up to 50 pts): Anchored on the highest active CVSS score.
  • Weaponization Probability (up to 15 pts): Derived from the maximum EPSS percentile.
  • CISA KEV Weight (+25 pts): Applied immediately if any flaw is being actively exploited in the wild.
  • Public Exploit Availability (+10 pts): Added when verified weaponized exploit code or PoCs exist.

7. Asset Intelligence & SBOM Support (CycloneDX & SPDX)

Section titled “7. Asset Intelligence & SBOM Support (CycloneDX & SPDX)”

The third workbench mode introduces client-side Software Bill of Materials (SBOM) ingestion, allowing organizations to audit multi-package software inventories in seconds:

Supported Manifest Formats

Section titled “Supported Manifest Formats”
  1. CycloneDX (JSON 1.4 — 1.6): Standardized specification designed by OWASP. The parser traverses root metadata components as well as nested dependencies, extracting names, exact versions, CPE identifiers, and Package URLs (purl).
  2. SPDX (JSON 2.2 — 2.3): ISO/IEC 5962 international standard. Packages are ingested from the packages collection, resolving security locators from externalRefs (cpe23Type, cpe22Type, purl).

Ingestion & Canonical Resolution Workflow

Section titled “Ingestion & Canonical Resolution Workflow”
┌─────────────────────────────────────────────────────────────┐
│             RAW SBOM MANIFEST (CycloneDX / SPDX)            │
└──────────────────────────────┬──────────────────────────────┘
                               │
                               ▼
┌─────────────────────────────────────────────────────────────┐
│                CANONICAL RESOLUTION PIPELINE                │
│  1. CPE Match: Identifies vendor & product identifiers      │
│  2. PURL Match: Parses package namespace & ecosystem types  │
│  3. Alias Resolver: Maps names via fuzzy canonical engine   │
└──────────────────────────────┬──────────────────────────────┘
                               │
                               ▼
┌─────────────────────────────────────────────────────────────┐
│               PARALLEL DETERMINISTIC AUDIT                  │
│  - Concurrent retrieval of partitioned product CVE datasets │
│  - Deterministic version-interval matching per component    │
│  - Hermes Threat Score (HTS) calculation per component      │
│  - Aggregate Inventory HTS & Exposure Gauge                 │
│  - Identification of Urgent Remediation Priorities          │
└─────────────────────────────────────────────────────────────┘

Aggregate Inventory Threat Score

Section titled “Aggregate Inventory Threat Score”

The overall inventory posture reflects both peak single-component exposure and horizontal multi-component risk:

Overall_HTS = Min(100, Max(HTS_components) + Min(15, (Vulnerable_Count - 1) × 3))
  • Peak Component Weight: Anchored on the highest-threat asset in the fleet.
  • Cumulative Exposure Factor: Escalates the score by +3 pts for each additional vulnerable dependency (capped at +15 pts), accurately distinguishing an inventory with 1 vulnerable service from an environment harboring dozens of exposed entry points.
  • Actionable Remediation Playbook: Components harboring active CISA KEV exploitation or Critical severity CVEs are highlighted with recommended upgrade targets and instant 1-click links to run full Hermes Security Delta evaluations.

5. Dedicated Product Intelligence Profiles

Section titled “5. Dedicated Product Intelligence Profiles”

Every tracked core software component features a dedicated static security profile compiling overall posture, full affected version ranges, CISA KEV status, EPSS weaponization percentiles, and validated safe remediation targets:

Apache HTTP Server HTTPD web server, path traversal flaws, and mod_proxy exposure analysis.
Veeam Backup & Replication Backup infrastructure resilience, deserialization RCE, and PostgreSQL vectors.
OpenSSL Foundational TLS/SSL cryptographic library securing enterprise endpoints.
OpenSSH Standard secure shell remote management daemon and client suite.
nginx High-concurrency web server, reverse proxy, and TCP/UDP load balancer.
Ivanti Connect Secure SSL VPN remote gateways and Zero Trust access appliances under active nation-state siege.
Fortinet FortiOS FortiGate enterprise next-gen firewalls and core perimeter operating platform.
Citrix NetScaler ADC & Gateway Enterprise application delivery controllers and remote access gateways.
LiteLLM Unified API gateway and proxy orchestrating 100+ LLMs with centralized authentication.
LangChain & Langflow Frameworks and visual IDEs for building autonomous agent workflows and AI pipelines.
VMware ESXi Industry-standard bare-metal hypervisor, virtual machine escape vectors, and VMXNET3 driver vulnerabilities.
Mozilla Firefox Open source web browser, SpiderMonkey JIT compiler, WebRender engine, and multi-process sandbox isolation.
Microsoft SharePoint Server Enterprise collaboration platform, ToolShell insecure deserialization, and dynamic code injection vectors.
Microsoft Windows Client and server operating system, CLFS driver memory safety, Hyper-V kernel VSP, and NTLM forced auth.
Cisco IOS XE Modular networking operating system, Catalyst 9800 wireless controllers, hard-coded JWTs, and SNMP stack overflows.
Cisco Secure Email Gateway Enterprise email security gateway running AsyncOS and spam quarantine remote execution vectors.
Cisco Identity Services Engine (ISE) Zero Trust network access control (NAC) and policy platform, unauthenticated ERS API injection.
Oracle E-Business Suite Enterprise Resource Planning (ERP) suite, Concurrent Processing engine, and BI Publisher XSLT exploitation.
Oracle Database Server Enterprise relational database, RDBMS Listener network daemon, and TNS protocol.
SAP NetWeaver Enterprise ERP application platform, RMI-P4 protocol, and Java AS components.
Roundcube Webmail Enterprise browser-based IMAP webmail, PHP deserialization, and attachment handling.
Erlang/OTP Concurrent telecom runtime and communication platform, embedded SSH servers, and message brokers.
Apache Tomcat Enterprise Java servlet container, partial PUT requests, and session persistence deserialization.
Meta React & Server Components UI library and React Server Components (RSC), Flight protocol deserialization, and React2Shell attacks.
Vercel Next.js Full-stack React framework, middleware authorization bypasses, and subrequest header tampering.
Fortinet FortiWeb Web Application Firewall (WAF), management interface SQL injection, and administrative bypasses.