Download NESSviewer

Easier-to-read themes

• Chips and coloured text. Severity, scan status, credentialed and compliance chips use a deeper or lighter shade of their colour for the label, so the text reads clearly on the chip's tint. The chip and the charts keep the bright colour. The same goes for coloured counts on the Dashboard and the Coverage tabs.
• Text boxes have a visible border. They used the faint divider colour, which some themes drew at barely more than the background. The border gets stronger when you point at the box, and takes the theme's accent colour while you type in it.
• The selected row in a grid has an outline. Before, it was a tint only, hard to tell from the row you're pointing at or the alternate rows.
• Buttons, pop-ups and toolbars keep the theme's colours. Most themes only defined the main shade of their green, red, amber and blue. Pressed buttons, pop-up headers and toolbar borders fell back to Telerik's own red, lime and yellow, and on dark themes put white text on bright fills. Every theme now defines the full set.
• Critical on the Command themes (Crimson, Azure, Verdant and Amber Command) is now a raspberry red. The old crimson was too dark for those mid-tone backgrounds, and lightening it made it look the same as High.
• The built-in themes (Main, Ocean Blue, Purple, Turquoise and their dark versions) get the same corrections.

If something looks off in a theme you use, tell us which theme and which screen.

Installing

• The installer (MSIX, inside the zip) is digitally signed by STIGSolution LLC.

Finding history

A .nessus file says when a plugin was published and when the scan ran. It doesn't say when a finding first appeared on a host, or when it went away. NESSviewer now works both out, and keeps the evidence in the system's Baseline.

• How it records. While a Baseline is open, every scan you load is recorded in it: for each host, the scan date, whether the scan was Good and credentialed, what identifies the machine, and which plugins it reported. Only findings of Low severity and above are kept. Each scan file is recorded once, even if you load it again or from another folder. If you open the Baseline after loading scans, the scans already loaded are recorded as it opens. Unloading a scan keeps its history.
• Order doesn't matter. Dates are worked out from every scan recorded, so you can load scans in any order. An older scan loaded later moves First Identified earlier. Load your oldest scans once to build the history: First Identified only goes back as far as the oldest scan recorded.
• Hosts are followed by machine, not by IP. The same identifiers that give Analyze its Asset ID (BIOS UUID, AWS instance ID, AD account, FQDN, MAC address, hostname) follow a machine from scan to scan, even when its IP changes. A Baseline host matched by MAC, IP or name links scans too. Hosts with nothing to identify them can also be matched by IP: switch on Match hosts with no name, MAC or FQDN on IP for that Baseline. It's off by default, because the same IP can be a different machine in another enclave.
• When a finding counts as fixed. Any scan that finds a plugin, Good or not, counts towards First Identified. A later scan that doesn't find it marks it remediated on that scan's date, but only if the scan was Good, and if a credentialed scan ever found the finding, only if the later scan was credentialed with local checks enabled. A scan that couldn't have seen the finding is ignored.
• When a fix doesn't hold. If a finding comes back within the grace period of the scan that showed it fixed (30 days by default), the fix is cancelled and the finding is flagged Intermittent. If it comes back later, a new occurrence starts and it's flagged Recurred. Aging always counts from the very first time the finding was identified, so fixing and regressing can't reset the clock. The grace period is in Options, Analysis, Baseline.
• Where you'll see it:
  • Analyze: new First Identified, Days Since First Identified and Finding History (Intermittent, or "Recurred (2nd occurrence, since ...)") columns.
  • Reports, Finding History: every finding the history knows, fixed ones first, with the date and the scan that proved each fix. Below it, the recorded scans, with Remove from history for a scan recorded into the wrong system's Baseline (it is never recorded again).
  • Dashboard, Remediation: see Dashboard below.
  • POA&M aging (optional): Options, POA&M Rules, Age from First Identified ages findings from when they were first identified instead of from plugin publication. Off by default.
  • POA&M Update (optional): new items can take their Date Identified from First Identified, or from the scan date. See POA&M Update below.
• Things to know:
  • The history is saved in the Baseline file, which becomes Baseline schema 4. Older builds of NESSviewer or the Baseline app drop the history if they save the file, so make sure everyone who edits a Baseline has this build. From this build on, sections a build doesn't recognize are kept rather than dropped.
  • An old XML Baseline can't hold the history, so nothing is recorded into one. Convert it with the banner on Files, Baseline (the original is kept as a .bak), and the scans loaded are recorded straight away.
  • Walkthrough sample scans are never recorded.

Dashboard

• New Remediation tab, from the finding history:
  • Fixed on time: the share of findings fixed within their deadline. Deadlines are your POA&M aging thresholds (Options, POA&M Rules), by the scan's severity.
  • Median time to fix over the last 90 days, Overdue (open past the deadline, counted from First Identified), and Fixes that didn't stick (recurred or intermittent).
  • By severity: deadline, fixed, on time, median and 90th-percentile days to fix, open, overdue.
  • Open backlog by First Identified: open findings by how long they've been known.
  • New vs fixed by month, for the last 12 months with activity, with the net change.

  With no Baseline open, or no history yet, the tab says what to do instead.

• Summary has new cards: Likely exploited (EPSS of 10% or more), Overdue and Median time to fix, plus an Exploit Likelihood (EPSS) panel showing findings by severity and EPSS band.

EPSS scores

EPSS (the Exploit Prediction Scoring System, from FIRST) gives every CVE the probability it will be exploited in the next 30 days. It's re-scored daily.

• On every finding: EPSS Score (for example 97.36%), EPSS Percentile (how that ranks among all scored CVEs) and EPSS Date (which day's scores were used), in the risk columns and on the drawer's Risk tab. A finding with several CVEs takes the highest score. Score and percentile sort by value.
• Offline, like CISA KEV. A copy of the scores (dated 24 October 2026) ships with this build. For current scores, download the day's epss_scores-current.csv.gz from first.org/epss and load it in Options, Reference Data, EPSS, Update.... It applies to the loaded scans straight away. Nothing is sent anywhere.
• Analyze tells you when the scores are stale. If findings have CVEs with no EPSS score and the loaded scores are 30 or more days old, a notice says where to download a fresh file and where to load it.
• Don't want it? Switch off Use EPSS scores in Options, Reference Data. The EPSS values leave every finding and the notice stops.

CCIs for CWEs

Where a finding's plugin lists one or more CWEs, Analyze now shows the CCIs they map to.

• CCI column: for example CCI-005003, CCI-002771.
• Show CCIs for CWEs in Options, Reference Data turns it off. It's on by default.

Walkthroughs

Short guided walkthroughs now run on a small sample scan. They're under Walkthroughs at the bottom of the menu. Watch one play by itself, or step through at your own pace.

• Getting around NESSviewer: the menu and what each page is for.
• Open a scan and read the results.
• Find and drill into a finding: grouping by severity and plugin, then down to a host.
• Working with grids: row details, sorting, filtering, search, grouping, and the toolbar.
• The Dashboard: every tab.
• Create a Baseline: create one and add the hosts from the loaded scans.
• CWE, CCI, CISA KEV and EPSS: where the reference data lives and where it shows.

The scans you have loaded are set aside while a walkthrough runs, and loaded again when it ends. The Baseline walkthrough uses a practice Baseline, and reopens yours afterwards. Your grid layouts aren't changed. Options, Application, Show walkthroughs hides the button.

Analyze

• Columns in reading order. The default column order is now grouped the way the colour bands are: the host, the risk (severity, CVSS, EPSS, KEV, exploits), the plugin, the dates and age (a new band), then POA&M and remediation. Your saved layout keeps its own order; use the toolbar's Reset to get the new one.
• CVSS scores sort by number. 10.0 now sorts after 9.8.

POA&M Update

• Date Identified for new items: a new setting in POA&M Default Values, Risk and dates: Blank (the default, as before), First Identified (from the finding history) or Scan Date (from the scans loaded). An item covering several hosts takes the earliest date. Add from Open Findings shows the date that will be used.
• An existing item's dates are never changed automatically. eMASS locks the Scheduled Completion Date on some items and not others, and its export doesn't say which. Update Existing keeps both dates exactly as the POA&M holds them, and Fill from Defaults writes Scheduled Completion Date on new items only. You can still change them by hand.
• Update Existing:
  • Controls / APs no longer come in blank from Rev 5 exports, which write item letters (CM-06b).
  • Description, Predisposing Conditions and Impact Description no longer show as changed when nothing was edited, and Devices Affected no longer shows as changed when only the order of hosts differs.
  • It no longer adds a milestone unless you ask. The option is off by default, in the Update Existing dialog.
• The Update Existing and Close lists show Ongoing items by default, with a switch for the rest.
• Add from Open Findings (N) now shows the right count, and keeps it current as the POA&M, the scans or the update change.
• The file row's X now closes the update and its files. It did nothing before.
• eMASS POA&M grid: Identification Source and its details now sit after Risk Check.

Options

• POA&M Rules: the risk calculation is now in colour, from Very Low (green) to Very High, and each row shows the Likelihood and Residual Risk it produces.

Reference data updated

• CISA KEV: catalog 2026.10.23, 1,756 entries (was 2026.06.25, 1,629).
• EPSS: scores of 24 October 2026 (new).
• CCI List and CWE to CCI: new, see above.
• CWE: still 4.20, MITRE's latest.

Fixed

• Grids blanked out after a load. The Files list, and Analyze, Ports, Dashboard and Reports, went blank and came back once or twice after every load. They stay put now.
• Analyze, Dashboard, Ports and Reports could stay empty after a load until something else changed. They always fill in now.
• The menu didn't close when you clicked outside it (Minimal and Compact menu styles). It does now.
• The DVL per-scan export stopped on some scans. Plugin output that starts with "-" or "=" was read as an Excel formula. It's written as text now, and text over Excel's cell limit is cut to fit with a note.
• The DVL export's busy indicator never stopped, and its "Exported N files" message never appeared. Both work now.
• Exports show they're running. A large grid takes a few seconds before the save dialog appears; the toolbar now shows Exporting to Excel... until it's done, and blocks a second click.
• Cloned virtual machines shared one Asset ID when their AD accounts told them apart. Each now gets its own.
• An old XML Baseline could be overwritten at close with the new format and no backup, if it had unsaved changes. It's never written now except by converting it.

Machines that share an IP address

Until now, NESSviewer told hosts apart by IP address and hostname. Reusing private addresses across enclaves is common, so two different machines scanned at the same IP could be folded into one host: one Scan Status row, one status built from both machines' results, and one host in the Dashboard counts. Hosts that Nessus could not name were affected worst, because all of them were grouped together when working out scan status. Each machine is now counted on its own.

• How machines are identified. NESSviewer uses what the scan itself reports about the machine: the AWS instance ID, BIOS UUID, Active Directory computer account, McAfee ePO GUID, fully qualified domain name, MAC address and hostname. Two scans that report the same machine are recognised as one machine, even when its IP has changed between scans.
• What is deliberately not used. Tenable's host TAG is ignored, because a cloned machine carries the same TAG as the machine it was cloned from. If a scan reports nothing that identifies the machine, that scan's host stands on its own rather than being merged by IP.
• A machine scanned more than once is shown once, with its best scan. "Best" means the most successful scan status, and the most recent scan when two are equal. The Scan Status tab has two new columns. Scans shows how many loaded scans saw the machine. Asset ID shows what identified it. Analyze also has an Asset ID column.
• Each scan's status comes from that scan alone. A good rescan no longer hides a failed scan, and another machine's results no longer count towards this one's status. The Files compliance flags judge each scan file by its own hosts in the same way.
• Counts are per machine. Hosts scanned, top hosts, asset totals and all three Ports views now count machines, not IP addresses.
• Hosts without a name show their IP. A host Nessus could not name used to have a blank hostname. It now shows its IP address, so no host is nameless in a grid.

Severity totals on the Dashboard still count every finding in every loaded scan, as before. If you load several scans of the same machine, its findings are counted once for each scan.

Baseline and scanned hosts

The Baseline now works with the same picture of the scanned machines.

• In Scans and Host Info Matches Scan compare each baseline host against the scanned machines, not against hostnames. When two scanned machines share a baseline host's IP, the MAC address and then the hostname decide which one it is. If nothing tells them apart, the column reads "Unclear: 2 share IP" and the tooltip names the machines. NESSviewer does not guess, and it does not offer Use scan, which would copy the other machine's details onto this host.
• Add/Update Hosts from Scans no longer writes one machine's details over another's:
  • Two machines on the same IP that Nessus could not name are added as two hosts, named "10.0.0.5" and "10.0.0.5 (2)". Rename them to their real names.
  • A second machine found on a baseline host's IP is offered as a new host. It no longer proposes updates to the existing host.
  • When nothing ties a scanned machine to a baseline host, no change is proposed.
  • Adding a host never replaces a value you already have with a blank.
• Fill blank hostnames from Baseline treats a host that shows its IP as unnamed and fills it in. Turning the option off puts the IP back. The Scan Status tab picks up the filled names. If two baseline hosts share an IP, that IP is not used to fill either one. Only a MAC address or hostname that identifies one of them is used.

Two machines on one IP: the workflow

If your scans could not name two machines that share an address, and the scans report their MAC addresses:

1. Open your baseline and choose Add/Update Hosts from Scans. Both machines are offered, each with its own IP, MAC address and FQDN.
2. Add both, then rename them to their real hostnames.
3. Turn on Fill blank hostnames from Baseline. The MAC address ties each machine's findings to the right name throughout NESSviewer.

POA&M Update

• An update now knows which project it belongs to. The first time you use an update with an eMASS POA&M export loaded, the update is linked to that system's name and eMASS item IDs. Afterwards, a bar on the page shows the linked system and how many scanned hosts are loaded. NESSviewer warns you when:
  • the loaded POA&M belongs to a different system
  • none of the items being updated are in the loaded POA&M
  • no POA&M is loaded
  • the loaded scans do not contain any of the update's hosts

  These are warnings only, and nothing is blocked. If the system was renamed in eMASS, you can re-link the update.

• The two exports can no longer be mistaken for each other. Export to eMASS writes POAM_Update_eMASS_Import.xlsx, which is the file to upload to eMASS. The grid's own Excel export writes POAM_Update_Working_View_NOT_FOR_eMASS.xlsx, and its tooltip says it is a working copy.
• Fill from Defaults:
  • It now applies a default you have changed, not only defaults filling blank fields.
  • Each row has one checkbox, labelled Overwrite, which says whether to replace a value that is already filled in.
  • The risk defaults now save.
  • Milestones that already exist in eMASS, and items being closed, are never changed.

Fixed

• An opened POA&M Update document closed itself shortly after it was opened. Fixed.
• Excel exports drew an X through every cell. The POA&M, POA&M report and test-result exports now have normal grid lines.
• The DVL per-scan Excel export failed without any message. It now saves, and if it cannot save it tells you why.

Dialogs you can resize

Every dialog in the application can now be resized, and each one remembers the size you gave it.

• Drag the bottom-right corner, the right edge or the bottom edge to resize. Drag the title bar to move the dialog out of the way. Double-click the title bar to fill the window, and again to restore.
• The size is remembered per dialog and kept between sessions. A size saved on a large monitor is fitted to the window when you open it on a smaller one, so a dialog never opens off screen.
• Every dialog has a close button in its title bar, and Escape closes it. Both behave exactly like the dialog's own Cancel or Close button.
• This matters most for the dialogs that hold a grid: the add-findings picker, the POA&M item picker, the corrections review and the Baseline add-hosts dialogs. They used to be a fixed size, which meant scrolling sideways to read the columns.

POA&M aging, where you need it

If you use the POA&M aging rule (Options, POA&M Rules), it now shows up where you make the decision rather than in a separate column.

• Analyze. The POA&M Status column states what the rule says about each finding: "Not on POA&M - POA&M required", "Ongoing - not required yet", and so on. A finding past its threshold that is missing from the POA&M is now obvious at a glance. This also works before any POA&M is loaded, which is useful when building a first POA&M from scan results.
• POA&M Update, adding findings. The picker now shows each finding's Publication Date, Days Since Publication and the same POA&M Status you see in Analyze, so you can choose what to add without going back to check.
• With the rule switched off, the status reads exactly as it did before.

Fixed

• Grid layouts were lost when files were loaded or unloaded. Hidden columns, widths and column order on the Analyze grid reset to their defaults, and the defaults were then saved over your layout. Layouts now survive loading and unloading scans. If your layout was affected, set it up once more and it will hold.
• Scan Status details were empty. Selecting a host on the Scan Status tab showed its status and nothing else. The description, the logic behind the status, the plugins that determine it and the troubleshooting plugins are all back.
• "Update Selected" closed the application. Ticking items on the POA&M Update page and choosing Update Selected could crash the application. Fixed.
• Grouping a grid could close the application after the last framework update. Fixed.

Options

• The "Use CVSSv3 score instead of Nessus severity" rule now lists every band in full: 0.1 - 3.9 Low, 4.0 - 6.9 Moderate, 7.0 - 8.9 High, 9.0 - 10.0 Very High. A finding with no CVSSv3 score, or a score of 0.0, keeps its Nessus severity.

eMASS POA&M: 2026 template

eMASS changed its POA&M export template. NESSviewer reads both the old and the new layout, and writes the new one.

• Import accepts either generation. "Vulnerability Description" and "Resources" are recognised alongside the old "Control Vulnerability Description" and "Resources Required", and a POA&M is now identified by POA&M Item ID + Security Checks + POA&M Status, so the rename cannot stop a file being recognised.
• Export (POA&M Update and the generated POA&M report) matches the 2026 template column for column: Summary, Date Identified and Actual Cost added; POA&M Status moved to the front; Milestone Status before Milestone Description; Comments after Office/Org; Resources and Actual Cost last. The info block uses the new positions and labels ("CC/S/A/FA", "DoW IT Registration No"), and the hidden validation lists match the template.
• Summary carries the finding title; Vulnerability Description is the plain description text.
• Labels throughout the POA&M pages use the template's wording.

Loading scans

• Duplicate scans are loaded once. A folder holding a .zip together with its extracted .nessus files (or a copy in a subfolder) used to load every scan twice or three times. Scans are now matched by content, not path; identical copies are skipped and listed in the load dialog with both paths.
• Files that fail to load are named, with the reason, in one dialog. A deleted recent file is reported and removed from the recent list. Dropped files of an unsupported type are named rather than ignored.

Reports

• The POA&M Status and Remediation Plan report sections now contain the loaded POA&M and remediation plans. Both were empty in every previous build.

Reliability

• Pending edits in the Software List, Ports List, Baseline and Remediation Plan editors are saved before the window closes. Previously an edit made in the last second before closing was lost.
• Unhandled errors are written to %TEMP%\nessviewer-crash.log. If the application closes unexpectedly, send that file.
• Startup is faster: the Files page builds its Baseline, POA&M and Remediation tabs on first use rather than at launch.

Licence

• The End-User Licence Agreement is version 1.1. Every user is asked to accept it once on the next start.

Housekeeping

• Legacy test-plan and POA&M loaders that had been unreachable since the kits took over are removed.
• Framework and component updates (.NET MAUI 10.0.101, Telerik UI for MAUI 15.0.0, Telerik Document Processing 2026.3.826).