How to Interpret Contrast CVE Shield Vulnerability Findings

Overview

In Northstar, the Issues page holds two kinds of findings: library CVEs found by scanning your dependencies, and code vulnerabilities found by scanning your application's code.

This guide explains what each finding type means, how Contrast CVE Shield adds runtime context to library CVEs, and how to use the Contrast score to decide what to work on first.

Prerequisites

1. Access to the Issues page.

2. A CVE Shield account with an agent installed.

3. A Java application you can connect.

Key Concepts: Observations, Issues, and Incidents

Before you dig into the Issues list, it helps to know how Northstar organizes findings into three related entity types:

• Observations: Created every time a vulnerability is detected through runtime or static analysis. Every observation is associated with an issue and/or incident, and repeated observations of the same vulnerability are grouped under one issue.

  For CVE Shield observations, Contrast records the class or method where the vulnerable code was entered and the dangerous permission or capability that was executed. See View Observations documentation for details.

• Issues: A defined vulnerability in your application, detected at runtime or through static analysis. An issue includes a summary of the vulnerability, a Contrast Score, metadata, and suggested remediation steps. Related incidents and observations are linked to the issue.

  For CVEs, Contrast creates a single issue per root library in the application's dependency tree, and associates all related CVEs for that library's dependencies with the same issue. See View Issues documentation for details.

• Incidents: Exploits or attacks on vulnerabilities (issues) within your application, detected at runtime. Incidents require prompt review and action. See View Incidents documentation for details.

Step-by-Step Instructions

1. Open the Issues list

Select Issues from the left navigation. Each row shows Severity, Contrast score, Issue name, Issue ID, Status, Application, Number of observations, Last detected, and Most recent incident.

2. Identify the finding type

Open any issue and check the Rule, Sensor, and Technique fields on the Overview tab. There are three patterns to recognize:

3. Find specific categories of issues

From the Issues list, use search and filters to narrow to a category of finding:

4. Read a CVE Shield Issue

CVE Shield issues are library CVE issues enhanced with additional runtime context from CVE Shield. Because an issue for a library CVE includes all CVEs from the root library and its dependencies, you can view every CVE in a library's tree from a single issue.

What happened? provides a table of the top 4 CVEs (ranked by Contrast Score) found in the dependency tree of the root library, along with the CVE Shield status of each in your environments. The full list of related CVEs is on the issue's CVEs tab. The widget names the CVE, the class or method where the vulnerable code was entered, and the dangerous permission or capability that was executed, such as a file read or network connection. The Evidence tab contains the supporting stack trace.

Each CVE Shield finding also carries a CVE Shield status, separate from the issue status:

You can filter the Issues list by CVE Shield status, or search directly by CVE ID, using the controls above the list.

5. Review the CVEs tab

The CVEs tab of a CVE Shield issue lists every CVE associated with the root library.

6. Read a runtime-confirmed finding

This view is usually most relevant to Security Operations teams. What happened? describes the actual request or code path Contrast observed, such as a specific URL or method involved in the attack, along with the relevant MITRE CWE reference. The Evidence and Activity tabs hold the supporting detail and history behind the finding.

7. Use the Contrast score to prioritize, regardless of type

All finding types show a 0–10 Contrast score gauge with Note, Low, Medium, High, and Critical bands.

For CVEs with a shield applied, this score is shield-aware: it's calculated using CVSS 4.0 environmental, supplemental, and threat metrics, and moves based on CVE Shield status in this order, highest to lowest: exploited → attacked/blocked → exposed → exposed/protecting → then the original unmodified score. Issue score updates dynamically as the underlying CVE score changes.

Note: A Critical or High score is the signal to act first, whatever the finding type. Don't assume runtime findings automatically outrank library CVEs; let the score and severity decide.

8. Check whether a finding has escalated to an incident

If the Most recent incident column shows an ID (for example, INC-2026-4) instead of a dash, Contrast has tied this finding to a broader incident, usually because it reflects active exploitation rather than a one-off detection. Loop in an incident response owner for anything with an incident ID attached.

Automated incident creation for CVE Shield-detected attacks is coming soon after the initial CVE Shield launch.

Expected Outcome

Given any row on the Issues page, you can identify whether it's a library CVE or a runtime-confirmed finding using the Target and Sensor fields, know which detail view to check first, and use the Contrast score to decide what to work on next.

Related Resources

• Contrast Documentation: CVE shields 

Escalation path

• Free: Post your question in the Gather Community Forum.