Question

During an internal network assessment, your credentialed scan returns four confirmed findings. Management asks which one to remediate first based on real-world risk, not just base score. Given the following, which vulnerability should be prioritized for immediate exploitation and remediation?

Accepted Answer

A CVSS 8.1 unauthenticated deserialization flaw on an internal application server, with a public Metasploit module and reachable from the tester's subnet

Answer

A CVSS 9.8 RCE in a library that is installed but the vulnerable function is never called, and the service is bound to localhost only

Answer

A CVSS 9.1 flaw in a workstation OS component that requires local physical access and a rebooted machine to trigger

Answer

A CVSS 7.5 information-disclosure issue that leaks server version banners over the network