{"entity":"Acme Supplies SRL","scan_period":{"start":"2026-01-06","end":"2026-03-28"},"scope":{"assets_in_scope":["Production web tier (4 hosts)","Staging environment (3 hosts)","Internal Jenkins + GitLab runners","Office network (VPN concentrator, 2 switches, 3 AP)","Endpoint fleet (142 laptops)"]},"methodology":{"tool_used":"Tenable Nessus Professional v10.8","authenticated_scan":true,"frequency":"Quarterly, with monthly delta scans on production-facing assets"},"summary_counts":{"critical":2,"high":7,"medium":19,"low":38},"top_findings":[{"cve_or_id":"CVE-2021-44228","title":"Log4Shell — RCE in legacy internal Jenkins","severity":"critical","affected_assets":["jenkins-internal.acme.eu"],"cvss_score":10.0,"recommended_fix":"Decommission the legacy Jenkins (migrated to GitHub Actions in 2024); shut the host down by target date.","owner":"Marc Dewinter","target_date":"2026-04-30","status":"in_progress"},{"cve_or_id":"CVE-2025-20120","title":"Unpatched Cisco AnyConnect — remote code execution","severity":"critical","affected_assets":["vpn-1.acme.eu","vpn-2.acme.eu"],"cvss_score":9.8,"recommended_fix":"Apply Cisco's out-of-band patch; fast-track the AnyConnect→Cloudflare WARP replacement already in the 2026-Q4 roadmap.","owner":"Marc Dewinter","target_date":"2026-04-25","status":"open"},{"cve_or_id":"CVE-2024-6387","title":"OpenSSH regreSSHion — signal-handler race","severity":"high","affected_assets":["web-03.acme.eu","staging-01.acme.eu"],"cvss_score":8.1,"recommended_fix":"Upgrade OpenSSH to 9.8p1+; enforce via Ansible role on next provisioning cycle.","owner":"Marc Dewinter","target_date":"2026-05-15","status":"fixed"},{"cve_or_id":"ACME-2026-001","title":"Internal — outdated Postgres 14 on warehouse replica","severity":"high","affected_assets":["db-wh-replica.acme.eu"],"cvss_score":7.5,"recommended_fix":"Upgrade to Postgres 16 per change request CHG-2026-0082.","owner":"Marc Dewinter","target_date":"2026-05-30","status":"in_progress"},{"cve_or_id":"CVE-2023-50164","title":"Struts 2 — file upload path traversal on legacy supplier portal","severity":"high","affected_assets":["suppliers-legacy.acme.eu"],"cvss_score":8.6,"recommended_fix":"Risk-accept — portal is decommissioned 2026-06-30; compensating control: WAF rule blocks multipart uploads above 0 bytes until shutdown.","owner":"Marc Dewinter","target_date":"2026-06-30","status":"risk_accepted"}],"remediation_trend":"Critical count down from 4 (Q4 2025) to 2 this quarter; the two remaining are scheduled for closure in April. High count stable at 7 — pace is sufficient to hit the internal target of <5 highs for 2026-Q2.","next_scan_date":"2026-06-29","author":{"name":"Marc Dewinter","title":"IT Operations Manager"}}