The 9.8 That Is Not First
You own vulnerability management for 1,800 hosts. A quarter-end change freeze starts in 10 days; the next patch window is 26 days out. This month's scan surfaced four findings: (1) an internet-facing VPN appliance with a CVSS 9.8 authentication bypass, no public exploit code yet, and the vendor goes end-of-life in 90 days; (2) an internal Jenkins server, CVSS 7.5 deserialization flaw, public proof-of-concept published four days ago, reachable from the developer VLAN and holding deployment credentials for production; (3) a CVSS 9.1 local privilege escalation on 12 machines in an air-gapped lab; (4) TLS 1.0 still enabled on a payment-terminal VLAN that is segmented and IDS-monitored, required by certified terminal firmware. The CISO asks for one prioritized list and asks why the 9.8 is not automatically first.
1. Rank the four findings and justify the order.
Read the worked answer
Order: Jenkins, VPN appliance, TLS 1.0, air-gapped lab.
CVSS base score measures severity of a vulnerability in the abstract. Risk adds exposure, exploitability in the wild, and blast radius. That is the whole argument to the CISO.
- Jenkins first. A public PoC plus network reachability plus stored production deployment credentials produces the shortest path to the worst outcome. An attacker who lands on that box does not need another vulnerability to reach production. This is the one where the clock is already running.
- VPN appliance second. Maximum exposure, but no public exploit today. It ranks below Jenkins because exploitability is unproven, and above the rest because history says internet-facing appliance CVEs are weaponized within days, and the EOL date means the vendor will stop shipping fixes entirely. Pre-position detection and mitigation now.
- TLS 1.0 third. A compliance and confidentiality problem, materially reduced by segmentation plus IDS. Acceptable only as a dated, documented exception tied to the terminal refresh cycle.
- Air-gapped LPE last. Local access is required. Re-evaluate immediately if the lab ever connects to the corporate network for updates.
State the ranking as a decision with named owners and review dates, not as a scan output.
2. What do you actually do about the end-of-life appliance inside the change freeze?
Read the worked answer
Do not let 'no public exploit yet' become 'no action'.
Interim controls, all doable without a change window:
- Restrict the management interface to a jump host and named source ranges; confirm whether it was ever exposed.
- Enforce MFA and per-user accounts on the VPN; remove any shared or local fallback accounts.
- Deploy virtual patching via the IPS/WAF signature set ahead of a vendor fix that may never come.
- Raise logging and alerting on authentication anomalies, and confirm logs reach the SIEM (an unmonitored edge device is worse than a patched one).
- Inventory how many external users depend on it, since that number determines the replacement timeline.
Then take a formal, time-boxed risk acceptance to the CISO with an owner and an expiry date, and start replacement procurement immediately rather than at the 90-day mark. If the CVE is later added to KEV or a PoC appears, treat it as an emergency change and break the freeze, documenting the business justification.
3. How do you measure and report remediation so the CISO can defend the numbers?
Read the worked answer
Report outcomes and exposure, not counts.
Counts are indefensible because they move for the wrong reasons. Useful measures:
- Percentage of internet-exposed critical assets remediated within SLA, by severity tier.
- Mean and 90th-percentile time to remediate by severity, trended quarter over quarter.
- Open risk acceptances and exceptions, with owner, compensating control, and expiry date, plus how many are past expiry.
- Scan coverage as a percentage of known assets, because a falling count from lost coverage looks like improvement.
Call out the artifact explicitly: if the quarterly number rises after you extend scan coverage to the lab and terminal VLANs, that is better visibility, not worse security. Pre-empt the misreading before the CISO has to explain it upward. Pair each metric with the decisions it drove, so the board sees the program as managed rather than as an open-ended count.