Vulnerability Scanning is a security process used to identify weaknesses, missing security patches, outdated software, open ports, and configuration issues in cloud resources.

In Oracle Cloud Infrastructure (OCI), the Vulnerability Scanning Service (VSS) helps administrators identify security risks in Compute instances and container images. It generates reports containing detected vulnerabilities, risk levels, and remediation information.

A vulnerability is a weakness in an operating system, application, software package, or system configuration that could be exploited by an attacker.

Examples:

• Missing critical operating system security patches.

• Outdated OpenSSL or other vulnerable software packages.

• Unnecessarily open network ports.

• Weak security configurations.

• Failed CIS security benchmark checks.

• Vulnerabilities in third-party application files.

Important: A vulnerability is not necessarily a Critical or High risk issue. Vulnerabilities are categorized by severity, such as Critical, High, Medium, Low, and Minor. Critical and High findings generally require the highest priority.

Suppose we have an Oracle Linux 9 Compute instance running an application.

The operating system has an outdated software package with a known security vulnerability.

The Vulnerability Scanning Service can identify the issue and report its associated CVE, severity, and remediation information.

The administrator reviews the report, applies the appropriate patch or configuration fix, and scans again to verify whether the issue has been resolved.

Vulnerability scanning helps organizations:

• Identify security weaknesses before attackers exploit them.

• Find missing security updates and critical patches.

• Review open ports and unnecessary network exposure.

• Check operating system security configurations.

• Monitor CIS benchmark compliance.

• Generate security reports for clients and security teams.

• Prioritize remediation according to severity.

• Verify whether remediation activities have resolved the findings.

• Improve the overall security posture of cloud infrastructure.

Interview point: Do not claim that Qualys is always more expensive or always better. Pricing and capabilities depend on the selected edition, license, scope, and organizational requirements.

During the lab, we created a Compute Scan Recipe and a Target, then investigated why the Vulnerability Scanning plugin remained disabled.

The Oracle Cloud Agent service was running, and the plugin directory existed on the instance.

The agent logs repeatedly showed:

Plugin [oci-vulnerabilityscan] has [Disable] desired state

This observation confirmed that the plugin was being reported in a disabled desired state. It did not, by itself, establish whether the cause was instance configuration, a service-side problem, or a permission/configuration issue.

The correct troubleshooting approach is to:

1. Verify the instance agent service.

2. Verify the plugin and supported image configuration.

3. Check the instance's agent configuration in OCI.

4. Review the required IAM policies.

5. Check network connectivity where applicable.

6. Review relevant logs and console notifications.

7. Contact the tenancy administrator or Oracle Support if the state remains unexplained.

sudo systemctl is-active oracle-cloud-agent
rpm -qa | grep oracle-cloud-agent
sudo journalctl -u oracle-cloud-agent -n 100 --no-pager
sudo grep -i vulnerability /var/log/oracle-cloud-agent/agent.log | tail -20

These commands help investigate the agent service and plugin state. They do not, on their own, prove that VSS is functioning end to end.

Lab result: The recipe and target were created, and agent/plugin troubleshooting was performed. Because the Vulnerability Scanning plugin remained disabled, successful host scanning and vulnerability remediation were not yet demonstrated. The next step is to resolve the plugin configuration issue and then verify scan results.

Vulnerability scanning is a security process that identifies potential weaknesses in Compute instances and container images, including missing OS patches, vulnerable packages, open ports, and supported security configuration issues.

A vulnerability is a weakness in software, an operating system, or a configuration that could potentially be exploited by an attacker.

It is an OCI security service that scans supported hosts and container images and generates reports containing security findings, severity levels, and remediation information.

A Scan Recipe defines the scanning configuration, including the types of checks and the scan schedule.

A Scan Target identifies the Compute instances or other supported resources that should be scanned using a selected recipe.

A recipe defines how to scan; a target defines what resources to scan.

CVE stands for Common Vulnerabilities and Exposures. It is a common identifier for a publicly known vulnerability.

OCI reports can classify findings as Critical, High, Medium, Low, and Minor. Critical and High findings generally receive the highest remediation priority.

It checks supported system security configurations against recommendations published by the Center for Internet Security.

Oracle Cloud Agent supports management and monitoring functions on Compute instances. The appropriate Vulnerability Scanning plugin configuration is required for agent-based host scanning.

OS Management Hub is an OCI service for managing operating-system updates, security patches, and update jobs on registered and supported instances.

No. OSMH can apply supported operating-system updates, but application vulnerabilities, open ports, insecure configurations, and other findings may require different remediation methods.

Host Scans provide findings for individual scanned hosts. Vulnerability Reports organize information about detected vulnerability types and the affected resources.

Verify the target, recipe, selected compartment, plugin state, scan completion, and report type. An empty report alone does not prove that the instance has no vulnerabilities.

No. Agent-based host scanning can work without a public IP, provided the required service connectivity and configuration are in place. Public IP port scanning is a separate scanning capability.

Check the agent configuration, plugin support, IAM policies, service connectivity, and logs. If the cause remains unclear, involve the tenancy administrator or Oracle Support.

Identify the affected package and advisory, verify the available update, apply it through an approved patch-management method such as OSMH, and perform a subsequent scan to validate remediation.

Assess the risk, apply available mitigations, document the issue, follow the security exception process if applicable, and track a vendor fix or upgrade plan. Escalate service-side issues through the appropriate support channel.

A follow-up scan helps verify whether the original vulnerability has actually been resolved. A successful update job alone is not sufficient evidence that every finding is fixed.

OCI VSS is natively integrated with OCI, whereas Qualys is a third-party security platform. The appropriate choice depends on coverage requirements, features, licensing, and the organization's security architecture.

Yes. Scan Recipes support scheduling options such as daily or weekly scans, depending on the recipe configuration.

It should identify the affected host, vulnerability or CVE, severity, affected package or configuration, remediation recommendation, action taken, and verification status.

I would validate the finding, assess exposure and business impact, notify the appropriate security and operations teams, prioritize remediation according to the organization's incident and change-management procedures, apply the approved fix, and verify the result through rescanning.

I created a Compute Scan Recipe and a Target, reviewed the required permissions, and investigated the Oracle Cloud Agent and Vulnerability Scanning plugin. The plugin remained disabled, and the logs showed a disabled desired state. I documented the evidence and identified the need for further configuration or service-side investigation before validating scan results.

Identify → Scan → Analyze → Prioritize → Remediate → Verify → Report → Monitor

• Vulnerability Scanning Overview: https://docs.oracle.com/en-us/iaas/Content/scanning/using/overview.htm

• Compute Scan Recipes: https://docs.oracle.com/en-us/iaas/Content/scanning/using/managing-host-recipes.htm

• Creating a Compute Target: https://docs.oracle.com/en-us/iaas/Content/scanning/using/create-host-target.htm

• Host Scan Reports: https://docs.oracle.com/en-us/iaas/Content/scanning/using/host-scan-reports.htm

• Vulnerability Reports: https://docs.oracle.com/en-us/iaas/Content/scanning/using/host-vulnerabilities-reports.htm

• Troubleshooting VSS: https://docs.oracle.com/en-us/iaas/Content/scanning/using/troubleshoot.htm

• OS Management Hub: https://docs.oracle.com/en-us/iaas/osmh/doc/

OCI Vulnerability Scanning helps identify security weaknesses in supported cloud resources. Scan Recipes define the scanning configuration, Targets select the resources, and Reports present the findings.

After analyzing the findings, administrators apply the appropriate remediation. OSMH can help manage supported OS security updates, while network, application, and configuration findings may require other corrective actions. If a service-side problem persists, the team investigates the configuration and permissions and escalates through the appropriate support process.

The final step is always verification: scan again, review the updated findings, document the outcome, and share the authorized report with the client or security team.

as of now for lab I have disabled the option of file scan(It was asking for file path and as of now for me its not required)

in report it is showing nothing because vulnerability scanning is disable

now enabling it by clicking on 3 dots