Question

A risk analyst is reviewing the results of a recent vulnerability scan of an internet-facing web application. Two findings are flagged: (1) a critical-severity remote code execution flaw for which no known exploit exists and the affected component is disabled in production, and (2) a medium-severity flaw that is actively being exploited in the wild and is reachable through the application's login page. Management asks the analyst which finding should be prioritized for remediation. What is the analyst's BEST recommendation?

Accepted Answer

Prioritize the medium-severity flaw because its active exploitation and reachability create higher likelihood of a successful attack

Answer

Prioritize the critical-severity flaw because CVSS base severity is the most reliable indicator of risk

Answer

Remediate both simultaneously since severity ratings alone determine remediation order

Answer

Defer both until the next patch cycle because neither has caused an incident yet