Question

During analysis of a scan report, you find two findings on an internal application server: (1) a CVE with a CVSS base score of 9.8 that requires the attacker to already have local administrative access and for which no public exploit or proof-of-concept exists, and (2) a CVE with a CVSS base score of 7.5 that is remotely exploitable over the network, unauthenticated, and has a weaponized Metasploit module publicly available. Given limited time in the engagement, which finding should you prioritize for exploitation first and why?

Accepted Answer

The 7.5 finding, because its lower attack complexity, network reach, and mature public exploit make it more realistically exploitable despite the lower base score

Answer

The 9.8 finding, because CVSS base score is the definitive measure of exploitation priority and always outranks lower-scored findings

Answer

The 9.8 finding, because a higher score guarantees a working exploit will be easier to develop from scratch

Answer

Neither, because both require manual verification before any exploitation attempt can ever be justified