Encountered a false positive

[AndreasDamen]

Hey,

I just ran a scan against a device running Microsoft SQL Server 2019 and the script detected CVE-2021-1636. However, the version of the software is not vulnerable for this CVE. The script showed the correct version of the software though.
My question is, does the script takes software versions into account when checking for CVE's? And if it does, what could have gone wrong here?

Thanks in advance.