Question

During an internal engagement, you run a credentialed Nessus scan against a Windows server. The report lists a plugin flagged as 'Critical' with a CVSS base score of 9.8, but the plugin output notes 'This is a potential vulnerability — the affected service was detected but the patch level could not be confirmed remotely.' Your client wants to prioritize remediation efficiently. What is the most appropriate next step before reporting this as a confirmed critical finding?

Accepted Answer

Manually verify the finding by checking the installed patch level and version on the host, then attempt to confirm exploitability

Answer

Report the finding as a confirmed Critical based on the CVSS 9.8 score to ensure the client patches quickly

Answer

Immediately re-run the scan with all safe checks disabled to force exploitation of the service

Answer

Downgrade the finding to Informational because Nessus could not confirm the patch level