Question

A SOC analyst is triaging a backlog of 40 vulnerabilities across internet-facing systems. Two vulnerabilities have identical CVSS base scores of 7.5. One (CVE-A) is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with confirmed active exploitation in the wild; the other (CVE-B) has no public exploit code and no reports of exploitation. Both affect production web servers. Which factor should most influence the analyst to prioritize CVE-A over CVE-B for immediate remediation?

Accepted Answer

The presence of confirmed active exploitation increases the real-world likelihood of compromise, raising the effective risk despite identical base scores

Answer

CVE-A has a higher confidentiality impact metric in its CVSS vector

Answer

CVE-A affects more assets in the environment than CVE-B

Answer

CISA KEV listing automatically raises the CVSS base score to 9.0 or higher