Question

A vulnerability scan flags a critical (CVSS 9.8) remote code execution flaw on an internal application server. During validation, the analyst confirms the vulnerable service is only reachable from a management VLAN that requires jump-host authentication and MFA, and the server holds no sensitive data. The vendor patch will not be released for three weeks. Which action best reflects proper risk-based prioritization for this finding?

Accepted Answer

Document the existing network access restrictions as mitigating factors, lower the effective priority, and schedule remediation once the patch is available

Answer

Escalate the finding for emergency out-of-band patching within 24 hours based solely on the CVSS base score

Answer

Mark the finding as a false positive because the service is not internet-facing

Answer

Accept the risk permanently and close the ticket since no sensitive data is stored on the server