Global – October 13, 2026 -- Tenable has released Nessus detection plugins built from CIQ's security advisories, so CVEs that CIQ has already fixed on Rocky Linux from CIQ Pro (RLC Pro) hosts now resolve in scan results instead of showing as unpatched.
Community advisories left CIQ fixes uncounted on pinned LTS hosts
RLC Pro LTS lets customers pin a host to a minor release and keep receiving security fixes on it. Even-numbered minor releases receive four years of security patching, and CIQ documents those fixes in its own advisories.
Tenable's existing Rocky Linux plugins draw on community Rocky Linux advisories, which do not include CIQ's. Nessus therefore compared a pinned host against the latest release, and a CVE that CIQ had already fixed on that release could still appear as unpatched. The same gap applied to packages CIQ adds beyond community Rocky Linux.
Tenable makes two changes to scan logic
New plugins flag a package when a CIQ patch is available for it. Tenable's existing unpatched-vulnerability plugins now check for a CIQ patch before raising a finding.
Nessus also matches each host to the CIQ product and release it runs. An LTS host is checked against CIQ advisories for its pinned release, and a host on the current release is checked against advisories for the current release.
Finding counts fall on patched hosts and rise on unpatched ones
Hosts kept current on CIQ patches should see finding counts only decrease after the update, as CVEs CIQ has fixed resolve. Hosts missing an available CIQ patch will show new findings for the vulnerabilities that patch addresses.
A finding that stays open on a subscribed RLC Pro host points to the CIQ advisory containing its fix. Resolution requires an active CIQ subscription for the product each host runs, such as RLC Pro LTS for a pinned host.
The detection is available in Tenable's plugin set now.