---
title: "Missing Fix Information for Certain CVEs"
slug: "missing-fix-information-for-certain-cves"
updated: 2026-10-22T15:02:28Z
published: 2026-10-22T15:02:28Z
canonical: "docs.safe.security/missing-fix-information-for-certain-cves"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safe.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Missing Fix Information for Certain CVEs

In some cases, vulnerabilities such as **CVE-2021-44228 (Log4Shell)** appear in Balbix with an exposure score and asset context, but **no fix or remediation information** is displayed under the *Details* tab. The screen may show the message **“No Fixes Available.”**

#### **Root Cause**

This behavior occurs when **Host Analyzer (HA)** detects a vulnerable component **inside a packaged application**, such as a `.jar` file. In these cases, the vulnerability is found at the component level (for example, a `log4j-core` class within an application JAR) rather than as a directly installed or independently managed software package.

Because HA identifies the vulnerable component through **deep file inspection** rather than a package manager or known patchable version, **Balbix cannot automatically determine or recommend a fix** for the enclosing application. This limitation applies not only to Log4Shell but also to other components discovered through HA-based inspection, such as certain **Cisco network device components** or custom application bundles.

#### **Expected Behavior**

- The asset will correctly display its **exposure score**, severity, and associated **CVE**.
- The **Remediation** field will show **“No Fixes Available”** when:

####
  - The vulnerable component is embedded in an application JAR or similar container.
  - No upstream vendor patch mapping exists for that asset.
  - The fix cannot be automatically inferred from available package metadata.