Question

A security analyst reviews the weekly vulnerability scan report for an internet-facing e-commerce web farm. Four findings are flagged. The organization's remediation policy states that priority should be driven by real-world exploitability and business exposure, not raw base score alone. Which finding should the analyst remediate FIRST?

Accepted Answer

A CVSS 8.1 deserialization vulnerability on the public payment application, listed in CISA's Known Exploited Vulnerabilities catalog with active ransomware campaigns observed

Answer

A CVSS 9.8 remote code execution flaw on an internal print server that has no route to the internet and is scheduled for decommission next month

Answer

A CVSS 9.1 vulnerability on a development server segmented behind a firewall with no inbound access and no sensitive data

Answer

A CVSS 7.5 information-disclosure flaw on a static marketing microsite that contains only public content