Question

During analysis of a large scan report, a penetration tester must recommend which vulnerability to prioritize for remediation. Two findings stand out: Finding X has a CVSS base score of 9.8 but an EPSS (Exploit Prediction Scoring System) score of 0.4% and no public exploit; Finding Y has a CVSS base score of 7.5, an EPSS score of 92%, and is actively being weaponized in the wild against internet-facing hosts identical to the client's exposed web server. Which recommendation best reflects risk-based prioritization?

Accepted Answer

Prioritize Finding Y first because its high EPSS score and active exploitation against exposed assets indicate a far greater likelihood of near-term compromise

Answer

Prioritize Finding X first because its higher CVSS base score indicates greater severity

Answer

Prioritize both equally since CVSS is the only authoritative severity metric for remediation ordering

Answer

Defer both findings until a temporal CVSS score is manually recalculated for each