Last bulid of ESXi but vulnerability still exist on IVA scan.

Hello,

My auditor requests me to fix vulnerabilities CVE-2019-5518 and CVE-2019-5519 discovered on ESXi after execution recently the IVA (internal vulnerability assessments) sacn.

I already have the last build 15256549 for ESXi 6.5.0 and the last build 15160138 for ESXi 6.7.0 that normally fixes all of those CVE since April 2019 from older build at that moment.

My update manger indicate also that I have the last compliant patches.

Please, how can I insure that all of those vulnerabilities are fixed ? and if no, does this mean that I should do some setting on VMs under ESXi?  

Kind Regards,