A team can patch only one finding this week. One is a CVSS 6.5 flaw on an internet-facing customer payment portal. The other is a CVSS 9.1 flaw on a lab host with no network connection that is scheduled for decommissioning next month. Which finding should be remediated first?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal: the score tells you how bad a flaw COULD be, but you live in a real network. A medium hole on the front door of your payment site is a lot scarier than a critical hole in a box that isn't even plugged in. Don't let the bigger number make the call for you.
Full Explanation
Vulnerability prioritization starts with severity but adjusts for context: how exposed the asset is, how critical it is to the business, whether exploitation is practical from where attackers sit, and what compensating controls exist. A flaw on an internet-facing payment portal is reachable by any attacker and sits on a system that handles sensitive financial data, so its real-world risk is high despite a medium base score. Treating the higher base score as the sole driver ignores exposure and criticality, which is exactly the mistake contextual prioritization is meant to prevent. Declaring both findings below threshold is wrong because a medium-severity flaw on a high-value, exposed system routinely requires prompt remediation, and an isolated host still needs a documented decision. Claiming that decommissioning hosts are the most common pivot points does not fit this case: a host with no network connection cannot be used to pivot anywhere. Exam caveat: the lab flaw is not ignored; it is tracked and either remediated or retired with the host. Operational check: confirm the lab host truly has no network path, record a risk acceptance until decommissioning, and schedule the portal patch with validation scanning afterward.