Question

A CySA+ analyst reviews the weekly scan results and must recommend which vulnerability to remediate first. The organization has limited maintenance windows this week. The four findings below all have valid CVSS base scores. Which vulnerability should be prioritized for immediate remediation based on business context and exploitability?

Accepted Answer

CVSS 7.5 on the internet-facing payment processing server that stores cardholder data; a working exploit is actively being used in the wild

Answer

CVSS 9.8 on an isolated lab workstation with no network connectivity and no sensitive data; no known public exploit exists

Answer

CVSS 8.1 on an internal print server on a segmented VLAN; the vendor reports proof-of-concept code only

Answer

CVSS 6.4 on a developer's test VM that is rebuilt nightly from a clean image; no exploit is publicly available