CVE severity vs context - prioritising for the environment · Linux

CVSS gives a generic severity score. Real-world prioritisation must consider the host’s role, exposure, and compensating controls. This lesson is about applying context.

Beyond CVSS

CVSS answers “how bad is this vulnerability”. Real priority also considers:

Asset value: a host holding PII gets more attention.
Exposure: internet-facing vs internal-only.
Compensating controls: behind a WAF, behind a VPN, in a container with no network access.
Patch availability: is the fix released? In a usable repository?
Mitigation: can the vulnerability be reduced without patching (disable the feature, firewall the port)?

The prioritisation matrix

Severity	Exposure	Active exploit	Priority
Critical	Internet	Yes	Hours
Critical	Internet	No	Same day
Critical	Internal	Yes	Same day
Critical	Internal	No	Days
High	Internet	Yes	Same day
High	Internet	No	Days
High	Internal	Yes	Days
High	Internal	No	Week
Medium	Internet	Yes	Week
Medium	Internet	No	Weeks
Medium	Internal	Yes/No	Month
Low	Any	Any	Quarter

Where the “active exploit” column comes from

That column carries most of the weight in the matrix, so it needs an auditable source rather than an impression. Two exist, and they answer different questions.

CISA KEV — the Known Exploited Vulnerabilities catalogue. Binary and authoritative: a CVE is either in it or it is not, and inclusion means exploitation has been observed in the wild. Each entry carries a remediation due date. Treat presence in KEV as overriding every other column in the matrix — an internal-only host with a KEV CVE is not a “days” item.

EPSS — the Exploit Prediction Scoring System, a probability (0 to 1) that a CVE will be exploited in the next 30 days, updated daily. Use it as the tiebreaker for everything KEV does not cover. A CVSS 9.8 with an EPSS of 0.0004 and a CVSS 7.5 with an EPSS of 0.6 should not be worked in CVSS order.

The pairing matters because the two disagree usefully: KEV is precise and lags, EPSS is early and probabilistic.

Decision: patch, mitigate, or accept

For each CVE:

Patch: the default. If a fix is available, apply it.
Mitigate: if a patch is delayed or risky, reduce exposure. Disable the feature, firewall the port, isolate the host.
Accept: only with explicit management approval. Document the reason and review quarterly.

Example decisions

Critical RCE in nginx (CVE-2024-XXXXX):

Severity: critical (CVSS 9.8).
Exposure: internet-facing.
Active exploit: yes (worm in the wild).
Decision: patch within hours, even with risk of brief downtime.

High info disclosure in a CLI tool:

Severity: high (CVSS 7.5).
Exposure: internal only.
Active exploit: no.
Decision: patch in the next maintenance window.

Medium denial of service in a library:

Severity: medium.
Exposure: internal.
Patch available: yes.
Decision: patch in the next release cycle.

Document every decision

Every CVE handling decision is recorded:

CVE-2024-12345
Severity: Critical (CVSS 9.8)
Affected: web01, web02 (internet-facing)
Decision: Patch within 4 hours
Patch tested in staging: 2026-08-09
Patches applied: 2026-08-09 02:00 UTC
Verified: nginx restart succeeded, smoke test passed
Approved by: Security Team

The decision record is the audit trail. Compliance and post-incident review depend on it.