WES-NG is a vulnerability scanner that identifies missing security patches and applicable exploits for Windows systems.
The tool addresses the challenge of determining which security vulnerabilities affect a specific Windows installation. It works by analyzing system information from the target machine—either through Windows' built-in systeminfo utility or through dedicated scripts that enumerate missing patches—and cross-referencing this against a comprehensive database of known vulnerabilities and their associated exploits. The database combines data from Microsoft Security Bulletins, the Microsoft Security Response Center API, the National Vulnerability Database, and Exploit-DB to provide broad coverage of known issues.
WES-NG suits penetration testers and system administrators who need to quickly assess patch compliance and exposure across Windows environments. It supports every Windows version from Windows XP through Windows 11, including Server editions, making it applicable to both modern and legacy systems. The tool can operate in disconnected environments by accepting systeminfo output as input, and includes a validation mechanism to cross-check results against Microsoft's Update Catalog to reduce false positives, which the README notes can occur due to incomplete data from Microsoft's feeds.
The project maintains an actively updated vulnerability database that users can refresh locally, and provides collector scripts for those who need to generate the database manually from source feeds. The codebase includes both VBScript and PowerShell variants for patch enumeration, offering flexibility across different Windows environments and administrative contexts.
