How do I clear high CVEs before a Cyber Essentials Plus audit?

Start with the detection details for each finding, not just the CVE score. Check which file, application version or Windows build the scanner says is affected, then compare that evidence with the vendor's advisory.

For Windows findings, verify that the relevant security update is applicable and actually installed. Some issues need a separate configuration change or other manual action. Update the scanner's vulnerability definitions and rescan after remediation. If the evidence still doesn't match the advisory, raise it with the scanner vendor as a possible false positive.

Check applications as well as Windows itself. Profile-specific apps can leave old versions in user profiles, and those copies may not update when someone else signs in. Review unused profiles and remove them where appropriate, then check the remaining users' apps for updates or uninstall what isn't needed.

Don't assume OpenSSL findings are all impossible to fix. The scanner should tell you where it found the affected component. It may belong to a separate application rather than Windows, so check that application's vendor guidance for an update or mitigation. Treat each finding on its own merits.

Get the exact current requirements from your assessor now. The discussion around the patching threshold and deadlines isn't consistent, so I wouldn't plan around 7.5 alone or assume that documenting an accepted risk will satisfy the assessment.

Ask how they handle applicable security updates, mitigations and disputed scanner findings. Keep a record of what was detected, what you changed and the results of the rescan.

With only a couple of weeks left, test the fixes on one device first, then use your patch management process to roll them out across the estate. A second vulnerability scan can help catch things your usual tool misses, but check the evidence before treating every result as a real exposure.