A vulnerability scanner reports CVE-2025-1234 on an internet-facing web server. A threat intelligence feed states that the same CVE is being actively exploited in the wild, but the scanner did not confirm a successful exploit. How should the analyst treat the finding?

Vulnerability assessment output is only the starting point for prioritization. A scanner can identify a CVE and assign a base severity, but practical urgency depends on whether attackers are using it. Threat intelligence that reports active exploitation is a threat-driven factor that changes the real-world risk, so the finding should move toward immediate remediation even when the scan did not confirm a successful exploit. Waiting for scanner confirmation can leave an exposed system unprotected while exploitation is already occurring. A priority unchanged by confirmed exploit activity ignores that environmental and threat context can override a static base score. Lowering the priority pending manual penetration testing introduces unnecessary delay, because validation is useful after containment when active abuse is known. Treating exploit activity as informational misunderstands the relationship between scanning and threat intelligence; feeds are meant to adjust vulnerability response, not replace scan results. Exam caveat: Do not confuse a scanner's unconfirmed finding with a false negative or false positive; active exploitation raises urgency without proving that the specific host was compromised. Operational check: Compare the scanner's CVE list against exploit or ransomware activity feeds and raise remediation SLAs for internet-facing assets with matching indicators.