Contrast launches CVE Shield to block exploit attacks

Contrast Security has launched CVE Shield, a product designed to block exploitation of known software vulnerabilities in production applications and APIs.

The launch comes as security vendors and researchers warn that artificial intelligence systems can now generate working exploits for disclosed vulnerabilities far faster than traditional patching cycles can keep up.

Contrast says the product runs inside a live application and is designed to detect and prevent attempts to exploit known flaws in third-party libraries. It allows normal application functions to continue while restricting the actions an exploit needs to succeed.

The release addresses a growing cyber security concern: that disclosed vulnerabilities can be weaponised rapidly with the help of advanced AI models. Contrast pointed to recent disclosures by major AI companies about research systems that can take a public vulnerability identifier and related code changes and produce a working exploit in a short time.

Jeff Williams, Founder, Contrast Security, said organisations were already adapting their security operations to that shift.

"Organisations are standing up Mythos Task Forces because traditional patch cycles cannot keep pace with AI-generated exploits," said Williams. "We created CVE Shield to give them immediate protection and buy security teams time between CVE disclosure and patch deployment. Legacy applications, vendor dependencies and frozen release windows no longer have to mean open exposure."

Runtime focus

Many companies already use vulnerability management tools to identify software components affected by published CVEs, or Common Vulnerabilities and Exposures. The harder task is determining whether the vulnerable code is actually running in production, whether an attacker can reach it, and whether exploitation would expose sensitive systems or data.

CVE Shield is intended to address that gap by applying controls at runtime. Rather than trying to identify every malicious payload, the software blocks actions commonly required by exploits, including native code execution, remote class loading, and arbitrary file writing. Under that model, new variants of a supported exploit can be stopped without a new signature.

The product can also serve as a temporary safeguard while organisations test and deploy software fixes. That may be especially relevant in environments where patching is delayed by operational constraints, dependency management issues, or formal release windows.

Katie Norton, Senior Research Manager, IDC, commented on the wider shift in application security.

"Developers and security teams have long struggled to prioritize CVEs because traditional tools focus on vulnerable versions rather than real execution. Capabilities that connect CVE identification with runtime reachability and active protection represent an important step toward more operationally relevant application security," said Norton.

Log4Shell example

Contrast used Log4Shell as an example of how the system works. The vulnerability, tracked as CVE-2021-44228, affected the Log4j logging library and became one of the most prominent software flaws in recent years because of how easily it could be triggered in internet-facing applications.

In that attack chain, a crafted string entered into request data can cause a vulnerable application to make an outbound lookup and load attacker-controlled code. Contrast says CVE Shield wraps the vulnerable Log4j methods so ordinary logging still works while the exploit path is blocked. According to the company, the outbound lookup, remote class loading, and process execution needed for the attack are denied, preventing the malicious code from running.

Deployment and scope

The initial release covers 60 critical Java vulnerabilities, including Log4Shell, Spring4Shell, and Apache Commons Collections deserialisation flaws. Contrast says the product identifies vulnerable libraries when an application starts and activates protections for affected versions it finds.

The software can be installed with a single command and does not require a separate appliance, proxy, or sidecar. Deployment across Kubernetes and OpenShift workloads can also be automated through its agent operator, without service-by-service code changes or Dockerfile changes.

Contrast adds that the system gives security teams runtime evidence about which vulnerable libraries are present, which code paths are being exercised, and when exploitation attempts occur. That information is intended to help teams decide which issues warrant immediate remediation rather than treating every CVE in a backlog as equally urgent.

A free tier will provide runtime visibility for supported CVEs in Java applications. The product is part of Contrast's Application Detection and Response portfolio, and the company plans to extend support to more vulnerabilities and additional languages, including Go, Node.js, .NET, and Python.

Contrast says exploit prevention adds only 12 nanoseconds when an attack is blocked.