Question

During an internal assessment, your vulnerability scanner returns two CVSS 9.8 findings: (1) an unauthenticated RCE on a lab print server that has no network route to production and stores no data, and (2) an unauthenticated RCE on a domain controller that hosts Active Directory for the entire organization. Both have public, weaponized exploits. Your remediation report must prioritize the findings. Which approach correctly reflects vulnerability prioritization for this engagement?

Accepted Answer

Prioritize the domain controller RCE above the print server RCE because the asset's business criticality and blast radius raise its real-world impact despite identical CVSS scores

Answer

Rank both equally as critical since they share the same CVSS base score and both have public exploits

Answer

Prioritize the print server RCE first because lab systems are typically patched faster and demonstrate quick wins

Answer

Defer both findings until a re-scan confirms the CVSS scores, since automated scores cannot be trusted for prioritization