Patching a 9.8 vulnerability into a change freeze

Decompose the risk rather than the score

A 9.8 is the base score for the component, not for this deployment. The effective exposure here is: internal clinical VLAN only, authentication required, one host. That is materially narrower than the headline, and it changes the urgency calculation.

Lay out the options honestly

1. Patch in the next 4 days. Requires one engineer, a 3-hour radiology outage, and a dongle re-registration whose failure mode is unbounded (engineer unavailable until day 6). Worst case is a longer outage than planned, immediately before a freeze that forbids fixing it.
2. Emergency change inside the freeze. Same technical risk, plus the freeze exists precisely for this reason; only defensible if the exposure were internet-facing.
3. Defer with compensating controls, book the patch for day 6+. Lowest operational risk, requires the controls to actually bite and the remediation date to be real and owned.

Recommendation

The decision turns on whether the exploit path can be closed without patching. If you can restrict the file-transfer service to named source hosts at the firewall, and that restriction is testable, option 3 is the defensible choice - the vulnerability becomes unreachable by configuration rather than by hope. If the service must remain broadly reachable from the clinical VLAN, option 1 is required and you mitigate the dongle risk by getting the re-registration procedure and vendor contact documented before the reboot.

The wrong answer is choosing on CVSS score alone in either direction.

A control is defensible when it addresses a prerequisite of the exploit, can be verified by someone else, generates evidence, and has a named owner.

Map to the attack path - network reach, authentication, and the vulnerable service:

• Restrict source hosts at the firewall or via network policy, then prove it with a scan from a non-permitted host. Verifiable, bounded, owned by network operations.
• Disable or rename unused accounts on the transfer service and enforce strong auth on the rest - reduces the authenticated foothold the exploit assumes.
• Detection: enable and actually monitor logging for anomalous transfer-service activity, with an alert route to someone on shift during the freeze.
• Segmentation check: confirm nothing in the clinical VLAN can reach the host that should not.

What is not a control: an email telling staff to be careful, a policy reference, or "internal only" used as a substitute for checking who is internal. Anything that cannot be tested and evidenced to an auditor in three weeks' time does not count.

Decline to be the signatory - not to avoid accountability, but because the wrong role is accepting the risk.

You supply the technical assessment: exposure path, what the controls do and do not cover, residual likelihood and impact, what would invalidate the assessment (for example, the host becoming reachable from outside the clinical VLAN, or a working exploit appearing in the wild against authenticated internal access).

The acceptance belongs to the business owner of the radiology service, countersigned by the CISO, because the consequence is a clinical service outage or a data breach, not an IT inconvenience.

What the record must contain to be worth anything:

• Asset, vulnerability, and the specific exposure path assumed.
• Controls in place, with evidence references and verification dates.
• Residual rating and the reasoning behind it.
• A hard expiry date and the booked remediation date (day 6+), with the trigger conditions that force re-assessment.

An acceptance with no expiry is not a decision, it is a permanent excuse.