Three Findings, One Patch Window
The vulnerability management team scanned 2,400 assets and produced 1,900 findings, 61 rated critical. The patch window is four hours on the second Saturday of each month, staffed by two administrators. Three findings compete for the next window: a CVSS 9.8 flaw in an image-printing service on a lab subnet reachable only from six research workstations; a CVSS 7.5 authentication bypass in the internet-facing remote-access VPN appliance that is listed in CISA's KEV catalog with a public proof-of-concept; and 400 endpoints running a browser build 11 versions behind, none with an observed exploitation attempt. The research director says the 9.8 must be fixed first because it is the highest score. The infrastructure lead wants the VPN patched immediately. The CFO wants a one-page answer to whether the company is exposed, yes or no, and by when.
1. Which of the three findings goes first, and what reasoning supports that ordering?
Read the worked answer
The VPN, and not because of the number. Three factors combine:
- Exposure: internet-facing and unauthenticated, so anyone with the exploit can reach the door.
- Threat: a KEV listing means confirmed exploitation in the wild, and a public proof-of-concept removes the skill barrier. That is a likelihood multiplier a base score does not capture.
- Impact: the VPN appliance is the front door to the estate; compromise yields a foothold and often credential material.
Second is the CVSS 9.8 print service. It is severe, but reachable only from six research workstations on a lab segment and not internet-facing, so likelihood is materially lower even though impact inside the lab is real. Third are the 400 stale browsers, handled as a forced mass update since no exploitation has been observed.
CVSS base scores describe the flaw in the abstract. Prioritisation adjusts for reachability, known exploitation and asset value - that is environmental and threat context, and it is what a four-hour window should be allocated by. The VPN patch also needs credential rotation and a log review, because an authentication bypass means prior sessions cannot be assumed legitimate.
2. The research director insists the CVSS 9.8 goes first. How do you respond without dismissing severity?
Read the worked answer
Agree with the severity, disagree with the ordering, and use shared evidence rather than authority.
- Show it is not being ignored - the print service gets a named fix date, an interim restriction to the six workstations, and alerting on unexpected access to it.
- Explain the difference in what the score measures: CVSS describes intrinsic defect severity, not the probability this estate will be attacked through it. Reachability and confirmed exploitation move probability further than two points of score do.
- Put both in the risk register with identical fields - likelihood, impact, existing controls, residual rating, owner - so the comparison is visible rather than asserted.
- Offer the compromise: both patches in the same window, the VPN first because it is faster and the print service second because it needs a reboot.
- State the fallback: if the window slips, the VPN gets an out-of-band patch anyway, because KEV items do not wait for monthly cadence, while the print service stays restricted.
This keeps the disagreement about evidence and dates rather than about who owns which system, which is what makes it resolvable.
3. The CFO asks whether the company is exposed, yes or no. What do you actually answer, and why is the honest answer conditional?
Read the worked answer
The answer I would give: yes, conditionally, and here is what changes it.
- Exposed now: an internet-facing VPN with a known-exploited authentication bypass. Patch out of band, rotate every credential that has authenticated through it, and review its logs for anomalous logins since the disclosure date.
- Not directly exposed: the print service, reachable only from six workstations on a lab segment, restricted further until the patch window.
- Broadly exposed, well mitigated: 400 browsers behind EDR and mail filtering, force-updated this week.
Then the dates, the owner and the residual statement.
A flat no would be false because the VPN gap is real. A flat yes would mislead because it implies uniform exposure across 2,400 assets and gives no lever for action. The honest answer is conditional because exposure depends on reachability, exploitation status and existing controls, and each of those has a specific remediation and a date. The CFO needs the two or three things that matter and their cost to close, not a score.