The 9.8 Nobody Patched
Meridian Outfitters operates its own e-commerce stack on 220 Linux and Windows servers. Authenticated scans run weekly. This cycle produced two findings. Finding A: CVSS 9.8 in an image-resizing library used by the public storefront; the vendor notes exploitation requires a non-default configuration and the vulnerable function is not called by Meridian's current code. Finding B: CVSS 6.5 in an internal reporting server that authenticates to the domain with a service account holding Domain Admin; a public proof-of-concept exploit was published 11 days ago and the CVE is on CISA's Known Exploited Vulnerabilities list. The reporting server sits on the corporate VLAN but shares the same Active Directory forest as the cardholder data environment. A change freeze begins in 9 days and runs through the Black Friday peak.
1. You can get exactly one emergency change approved before the freeze. Which finding do you fix, and on what basis? Explain why the higher CVSS score is not automatically the priority.
Read the worked answer
Fix Finding B first.
CVSS base score measures the severity of a vulnerability in the abstract. It says very little about this environment. The factors that actually drive priority:
- Exploitation status. B has a public PoC and is on the KEV list - exploitation is observed in the wild, not theoretical. A has no known exploitation and a configuration precondition.
- Reachability. A sits on the internet-facing storefront, but the vulnerable function is reportedly not invoked. That claim must be verified, but taken at face value it lowers current exploitability. B is internal - yet 'internal' is doing less protective work than it used to, and it shares a forest with the cardholder data environment.
- Blast radius. B's service account is Domain Admin. Exploitation is not one server; it is the domain, including the CDE. A would compromise the storefront, which is serious but bounded and rebuildable from immutable images.
- Effort and reversibility. Patching a reporting server is likely a smaller, faster change than upgrading a storefront library, so it is also the more achievable emergency change.
The judgment: prioritize exploitable, reachable, high-impact paths over the number on the label. Document the reasoning - an auditor will ask why a 9.8 was deferred, and 'the score was higher' is not a defense if you got it backwards.
2. The freeze is real and Black Friday revenue is at stake. Lay out a plan for the next 9 days that manages residual risk on both findings.
Read the worked answer
Split into what can be done without touching code or violating the freeze.
Before the freeze (days 1–9):
- B - emergency change now. Patch, or if the vendor patch is untested, apply the vendor workaround and remove Domain Admin from the service account (replace with a gMSA scoped to the reporting app). Restrict inbound to the server to the two admin jump hosts; block outbound SMB and RDP from it except its tier-0 management path. Put EDR in block mode and add the published PoC indicators as detections. These are configuration changes with a small blast radius, reversible in minutes.
- A - verify the assumption. Confirm the vulnerable function is unreachable in the deployed build: inspect the call path, run an unauthenticated scan against the storefront, and reproduce the vendor's configuration precondition in staging. Add a WAF rule on the affected endpoint as virtual patching. If verification shows the function is reachable, the calculus flips and A becomes the emergency change.
After the freeze: patch A in week one with a canary deployment and a tested rollback. Record both items in the risk register with an owner, the compensating controls, and an expiry date on the acceptance.
3. The CISO asks what would make you reorder your answer. Give two specific triggers and explain each.
Read the worked answer
- Trigger 1 - A turns out to be reachable. If staging shows the vulnerable function fires on a normal storefront request, or an unauthenticated scan returns evidence of the library and endpoint, A becomes an internet-facing, potentially wormable pre-auth RCE. That outranks B immediately, freeze or no freeze, because compromise is one request away and the storefront is the revenue path.
- Trigger 2 - B's privilege is already reduced, or the exploit needs local access. If the service account turns out to be low-privilege and the exploit requires authenticated local access, B's blast radius collapses from 'domain compromise' to 'one server,' and A rises above it.
Secondary triggers worth watching: any scanning or exploitation attempts against either host in the last 30 days (check egress and WAF logs); the vendor shipping a working exploit for A; the reporting server turning out to be internet-reachable via a forgotten NAT rule; or Finding A's library being bundled into a container image that is rebuilt on every deploy, which changes the cost and timing of the fix.
The point is to state the assumptions your ranking rests on, so that new information updates the decision instead of being argued away.