First establish whether the asset is affected
A scanner’s version match can identify a candidate vulnerability. Product, version, enabled features and backported fixes affect applicability. Keep the detection method, evidence and unresolved checks, then confirm against vendor guidance and asset configuration. Candidates are not successful exploits.
A CVE identifies a publicly tracked vulnerability; it is not proof that your asset was compromised. Verification methods must remain authorized rather than escalating to high-impact exploitation merely to increase confidence.
Further reading: NIST SP 800-115: Security Testing and Assessment
Put severity back into context
CVSS describes vulnerability characteristics and severity; retain the version and vector. CISA KEV contributes evidence of known exploitation in the wild. Your environment must still supply exposure, data sensitivity, privileges, compensating controls and remediation disruption costs.
A useful priority specifies an action, accountable owner and timing, together with residual risk. If patching cannot happen immediately, reduce exposure and schedule verification. Record a new firewall rule separately from a vulnerability being fixed.
Further reading: FIRST: CVSS v4.0 User Guide·CISA: Known Exploited Vulnerabilities Catalog
Example: ordering two candidate findings
Synthetic asset A is an internet-facing login service with a confirmed applicable vulnerability and evidence of known exploitation. B is an isolated test machine with a higher scanner score but unconfirmed version applicability.
Under these assumptions, prioritizing exposure reduction and verified remediation for A is well supported while checking B’s applicability. If patching A affects a safety-critical operation, maintenance and recovery constraints also need consideration.
Conclusion: Write down the conditions supporting the order instead of only saying A is riskier.
Tabletop exercise: a four-column remediation decision
Use only fictional assets A and B; do not scan or modify systems.
- Create columns for applicability, exposure, threat evidence and action.
- For A, write immediate mitigation and later patch verification. For B, list unresolved checks.
- Add a condition that could change the order, such as B becoming public and handling sensitive data.
Expected result
A’s decision is supported by applicability, exposure and threat evidence. B’s unknowns remain explicit rather than being treated as safety.
Check your work
Can you distinguish temporary exposure reduction from a verified completed fix?
Finish and clean up
Keep the decision table. The tabletop exercise requires no system cleanup.