Read CVE, CWE and CVSS, then prioritise findings by exploitation evidence, exposure and asset value rather than score alone.
Why it matters
A vulnerability scanner pointed at a medium-sized network can report thousands of findings. No team can fix them all at once, and attackers do not care which ones you meant to get to. Vulnerability management is the continuous process of finding weaknesses, deciding which ones matter most, fixing them and checking the fix. The hard part is prioritisation.
The lifecycle
- Asset inventory: you cannot scan what you do not know exists.
- Discover: authenticated scans (with OpenVAS/Greenbone, Nessus, Qualys and similar), agent reports, cloud posture tools, software composition analysis for code dependencies.
- Prioritise: rank findings by risk, not just by score.
- Remediate: patch, change configuration, or apply a compensating control (for example, block the port) if a fix is not possible yet.
- Verify: rescan to confirm the fix worked.
- Report: track trends and deadlines (often called SLAs, such as "critical internet-facing findings fixed within 7 days").
CVE, CWE and CVSS
- A CVE (Common Vulnerabilities and Exposures) ID names one specific vulnerability in one product, such as
CVE-2021-44228(Log4Shell). Browse them at cve.org. - A CWE (Common Weakness Enumeration) names the type of mistake, such as CWE-79 (cross-site scripting) or CWE-89 (SQL injection).
- CVSS (Common Vulnerability Scoring System), maintained by FIRST, scores how severe a vulnerability is from 0.0 to 10.0. The current version is CVSS v4.0 (released in 2023); you will still see many v3.1 scores. Official specification: first.org/cvss. Checked on 2026-10-23.
CVSS severity ratings:
| Score | Rating |
|---|---|
| 0.0 | None |
| 0.1 to 3.9 | Low |
| 4.0 to 6.9 | Medium |
| 7.0 to 8.9 | High |
| 9.0 to 10.0 | Critical |
The base score comes from a vector string describing the vulnerability itself. A v3.1 example:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H -> 9.8 Critical
Read it as: Attack Vector Network, Attack Complexity Low, Privileges Required None, User Interaction None, Scope Unchanged, and High impact on Confidentiality, Integrity and Availability. In plain English: anyone on the network can fully take over the system with no login and no help from a user.
Why the score alone is not enough
CVSS base scores describe the vulnerability in general, not your risk. Two more questions change the priority a lot:
- Is it being exploited? The US CISA Known Exploited Vulnerabilities (KEV) catalogue lists vulnerabilities with evidence of real-world exploitation: cisa.gov/known-exploited-vulnerabilities-catalog. FIRST's EPSS estimates the probability that a vulnerability will be exploited in the next 30 days. Checked on 2026-10-23.
- How exposed is the asset, and how important? An internet-facing VPN gateway is far more exposed than a printer on an isolated network. A server holding customer data matters more than a test VM.
A practical rule many teams use: known exploited and exposed first, then critical and high on important assets, then the rest by score and age.
Worked example: ranking five findings
| # | Finding | CVSS | In KEV? | Asset |
|---|---|---|---|---|
| 1 | VPN appliance remote code execution | 9.8 | Yes | Internet-facing, all remote staff use it |
| 2 | Database server privilege escalation | 7.8 | No | Internal, holds customer data, needs a local login |
| 3 | Web framework remote code execution | 9.8 | No | Internal test VM, no real data, isolated |
| 4 | Outdated TLS settings on intranet site | 5.3 | No | Internal |
| 5 | Mail server authentication bypass | 8.1 | Yes | Internet-facing |
A sensible order: 1, 5, 2, 3, 4. Findings 1 and 5 are exploited in the wild and reachable from the internet. Finding 2 is lower scored but protects sensitive data. Finding 3 has the highest score but almost no exposure, so it can follow. Sorting by CVSS alone would have put the test VM ahead of an actively exploited mail server.
If finding 1 cannot be patched today (say the vendor patch needs a maintenance window), a compensating control buys time: restrict the VPN management interface to the admin network, turn on the vendor's mitigation, and watch its logs closely. Record the exception with an owner and an expiry date.
Common mistakes
- Sorting by CVSS only. Exposure and active exploitation matter at least as much.
- Unauthenticated scans only. Scans that cannot log in miss most missing patches.
- Closing tickets without rescanning. A patch that failed to install looks the same as one that worked until you verify.
- Permanent exceptions. Every accepted risk needs an owner and a review date.
Quick recap
- Vulnerability management is a loop: inventory, discover, prioritise, remediate, verify, report.
- CVE names a vulnerability, CWE names the kind of mistake, CVSS scores severity (v4.0 current, v3.1 common).
- Prioritise with exploitation evidence (CISA KEV, EPSS), exposure and asset value, not the base score alone.
- Use compensating controls with owners and deadlines when you cannot patch yet.