5.3.2. Analysis and Prioritization

💡 First Principle: Not every vulnerability needs immediate attention — but some need it right now. Analysis determines which vulnerabilities pose the greatest actual risk to your specific environment, not just their theoretical severity.

Common Vulnerability Scoring System (CVSS) — standardized scoring (0-10) rating vulnerability severity. The base score considers: attack vector (network vs. local), attack complexity, privileges required, user interaction needed, and impact on confidentiality/integrity/availability. The temporal score adjusts for factors that change over time, such as exploit code maturity and whether a fix is available (renamed threat metrics in CVSS v4.0). The environmental score adjusts for your specific context — the same vulnerability may score differently in different organizations depending on their controls and asset importance. Qualitative ratings: 0.1–3.9 Low, 4.0–6.9 Medium, 7.0–8.9 High, 9.0–10.0 Critical. A CVE is the unique identifier for one specific known vulnerability; a CWE (Common Weakness Enumeration) catalogs the types of software weakness behind such flaws (for example, CWE-79 cross-site scripting).

Exploit Prediction Scoring System (EPSS) — predicts the probability that a vulnerability will be exploited in the wild within the next 30 days. A CVSS 7.0 vulnerability with 95% EPSS probability is more urgent than a CVSS 9.0 with 2% EPSS. Combining CVSS severity with EPSS likelihood gives a more actionable risk picture.

CVSS context matters: a CVSS 9.8 vulnerability on an isolated test server is less urgent than a CVSS 7.0 vulnerability on an internet-facing payment system. Raw scores without context lead to misallocated resources.

Prioritization factors:

• Asset criticality — what does the affected system do? A vulnerability on a domain controller is more urgent than one on a print server.
• Exploitability — is there an active exploit in the wild? Known exploited vulnerabilities get priority regardless of CVSS score.
• Exposure — is the system internet-facing, internal, or isolated?
• Compensating controls — do existing controls (segmentation, WAF, IPS) reduce the effective risk?

False positives — scanners sometimes report vulnerabilities that don't actually exist (version detection errors, patched-but-not-restarted services). Validation eliminates wasted remediation effort.

Confirmation — verifying that a reported vulnerability is real and exploitable in your environment before spending resources on remediation.

⚠️ Exam Trap: CVSS score alone doesn't determine patching priority. A CVSS 10.0 on a system with no network access and strong compensating controls may be less urgent than a CVSS 7.5 on an internet-facing system with no mitigations. Context-based prioritization is the correct approach.