Vulnerability Reachability Now Available in SonarQube Advanced Security
Blog post from Sonar
SonarQube Advanced Security has introduced Vulnerability Reachability, a feature that uses call graph analysis to determine whether an application’s code calls functions associated with vulnerabilities in third-party dependencies. Designed to reduce alert fatigue from large CVE backlogs, it classifies risks as reachable, unreachable, or not analyzed, helping teams prioritize vulnerabilities that could be triggered through their own code while recognizing that unreachable findings may still pose indirect risks. Reachability complements CVSS severity, CISA’s Known Exploited Vulnerabilities list, and EPSS exploitation predictions by adding codebase-specific context. Available for Java, C#, and Python projects following full CI or automatic analyses, the feature appears in Dependency Risks views, detailed risk pages, downloadable reports, and, for eligible subscribers, SonarQube’s Remediation Agent. SonarQube positions the capability as increasingly important as AI-assisted attackers shorten the time between vulnerability disclosure and exploitation, and it is available without additional configuration to Advanced Security customers on SonarQube Cloud and Server.
No tracked trend matches for this post yet.
Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.