A vulnerability scan reports CVE-A with a CVSS base score of 9.8 on an internet-facing web server and CVE-B with a base score of 6.5 on an isolated lab host with no external connectivity. The team can remediate only one finding this week. Which approach is correct?
Select an answer to reveal the explanation.
Short Explanation
A CVE number is just a name tag; the CVSS score tells you how loud the alarm is. Put a 9.8 on a box the whole internet can touch and you've got your answer — you fix the critical, exposed one first. Don't read meaning into the CVE number itself; it says nothing about severity.
Full Explanation
A CVE identifier is a unique catalog name for a publicly disclosed vulnerability; it carries no severity information, and its sequence number reflects assignment order, not danger. CVSS supplies the severity: the base score rates intrinsic characteristics such as attack vector, complexity, privileges required, and impact, and qualitative ratings map 9.0 to 10.0 as Critical and 4.0 to 6.9 as Medium. Sound prioritization combines that severity with environmental context such as exposure, asset value, and exploit availability. A critical flaw on an internet-reachable server is both severe and reachable, while a medium flaw on an isolated host has a much smaller attack surface. Ranking by CVE sequence confuses an identifier with a risk measure. Treating the findings as equal assumes the CVE encodes severity, which it does not. Deferring until an exploit appears ignores that the base score is meaningful on publication, and waiting leaves critical exposure open; exploit maturity adjusts priority but does not invalidate the score. Exam caveat: CVSS environmental and threat metrics exist precisely to adjust a base score for local context. Operational check: confirm the asset's exposure, apply the vendor fix or a compensating control to the critical internet-facing finding, rescan, and schedule the lab finding.