Two Criticals, One Maintenance Window

Rank Finding B first despite its lower CVSS. Risk is a function of exposure, threat activity, and impact, not a base score alone. Finding B is internet-facing, has EPSS 0.71, is in KEV, and has confirmed in-the-wild exploitation. The 3,100 failed logins from 14 ASNs are consistent with attempted exploitation or credential spraying. Finding A requires authenticated local access, has EPSS 0.02, and has no public exposure; it is serious but not the same urgency.

Patch decision: request an emergency change for the VPN appliances before the freeze. Patch one appliance at a time, even without HA, using the 20-minute outage. If the business refuses, escalate to the CISO with a written risk statement and a named acceptor. Do not silently defer. For Finding A, schedule the OpenSSL patch in the next standard window after fixing the QA failures; require a tested rollback and restart plan. If any of the 210 servers are internet-facing or hold domain credentials, re-rank them. The unsupported OS fleet cannot be ignored: segment it, restrict access, and set a migration date.

Compensating controls should reduce exposure and detect exploitation, not just document risk.

• Restrict VPN management interfaces to a jump host and management VLAN; block internet access to the admin portal.
• Geo-fence or ASN-filter login pages to countries with legitimate users, with an exception process.
• Enforce MFA and rate-limit authentication; temporarily lock accounts after a small number of failures.
• If the vulnerable feature can be disabled without breaking access, disable it.
• Enable verbose VPN and authentication logging to the SIEM, and alert on successful logins from new ASNs, unusual user agents, and post-login lateral movement.
• Place an IPS or WAF in front of the appliance if the exploit has a network signature.

Verification: attempt an external scan from an unapproved region and confirm it is blocked; review logs to confirm authentication events arrive in the SIEM; test the alert with a synthetic failed-login burst. Document residual risk: a determined attacker with valid credentials may still succeed. Set a hard expiry for the exception, no longer than the next patch window.

Separate the unsupported servers from the two findings. They are a chronic risk, not a patch decision. Inventory what they run, what data they touch, and whether they can reach the internet or domain controllers. Put them in a restricted network segment with deny-by-default egress and limited inbound access. Require unique local credentials, disable unnecessary services, and ensure EDR coverage. If EDR cannot be installed, use network monitoring and a documented exception.

For the business owner's refusal, convert the disagreement into a decision record: describe the exploited-in-the-wild VPN flaw, the 20-minute outage, the alternative compensating controls, and the residual risk. Ask for acceptance in writing with an expiry date and a review at the next change advisory board. Escalate if the owner will not accept or patch. Do not accept 'no change during close' as a blanket refusal for a KEV-listed, exploited vulnerability; offer a one-appliance-at-a-time outage outside peak hours. For the unsupported systems, set a migration date and report progress weekly. Risk acceptance is valid only when the acceptor has authority and the risk is visible.