Red Hat Advanced Cluster Security 5 adds RHEL VM vulnerability scanning, CISA KEV context

Red Hat has released Advanced Cluster Security for Kubernetes 5, expanding its security platform to cover Red Hat Enterprise Linux virtual machines alongside containers. The release enables security teams to scan RHEL VMs for known vulnerabilities through the same interface used for container workloads, addressing a gap for organizations migrating virtualized applications to OpenShift Virtualization. The update also introduces a CVE origin indicator distinguishing Red Hat assessments from OSV.dev data, integrates the CISA Known Exploited Vulnerabilities catalog for exploitation evidence, and makes init container image scanning generally available with build and deploy policy evaluation.

The release aligns support lifecycles with the broader OpenShift platform, offering 12 months of support plus 12 months of maintenance per point release with optional Extended Lifecycle Support extending up to 3 years. Two AI-assisted capabilities arrive as technology preview: OpenShift Lightspeed-assisted risk enrichment for deployment score explanations and a Model Context Protocol server enabling natural-language queries of vulnerability data. The release completes the transition from the legacy StackRox Scanner to Scanner V4.

What changes in Advanced Cluster Security 5

• RHEL VM vulnerability scanning: Advanced Cluster Security 5 can scan Red Hat Enterprise Linux virtual machines running on OpenShift Virtualization for known vulnerabilities, extending coverage to guest operating systems alongside containerized applications.
• CVE origin indicator: The release adds source attribution distinguishing vulnerability assessments from Red Hat versus OSV.dev, visible in the interface, APIs, and exported reports, with filtering capabilities to explain severity rating differences.
• CISA KEV integration: The platform now incorporates data from the CISA Known Exploited Vulnerabilities catalog, allowing teams to factor evidence of active exploitation into remediation prioritization alongside severity scores and workload context.
• Init container coverage: Init container image scanning becomes generally available with build and deploy policy evaluation; existing and new policies evaluate init containers by default, with administrator override options for exceptions.
• Scanner transition completed: Version 5 finalizes the migration to Scanner V4 and removes the legacy StackRox Scanner, requiring upgrade planning around scanner requirements and init container policy changes.

Why it matters

For enterprises running mixed VM and container workloads on OpenShift Virtualization, unified vulnerability management reduces operational fragmentation and security blind spots during migration and ongoing operations. The CISA KEV integration and origin indicators address long-standing pain points in vulnerability prioritization by adding exploitation context and assessment transparency that security teams need to justify remediation decisions. The AI-assisted investigation tools, even as technology preview, signal Red Hat's direction toward integrating generative AI into security operations without removing human accountability for final decisions.