A vulnerability assessment identifies a critical CVE with CVSS 9.8 on a web server. The finding notes the vulnerability is not exploitable because a compensating firewall rule blocks access to the affected service. How should the vulnerability management team handle this?

The correct approach is to retain the finding as active, document the compensating control, prioritize patching, and monitor to ensure the firewall rule remains in place. Compensating controls reduce risk but do not eliminate the underlying vulnerability. Firewall rules can be misconfigured, bypassed, or accidentally removed. Patching remains the permanent fix, and the compensating control requires ongoing monitoring. Closing the finding as not applicable because the firewall blocks exploitation is wrong because it creates false assurance; the vulnerability remains. Downgrading the CVSS score to low because the firewall mitigates environmental risk is wrong because CVSS base scores reflect inherent vulnerability severity, not mitigated risk; environmental scores are separate. Removing scanner exceptions and rescanning to confirm reproducibility is wrong because rescanning confirms the finding's existence, not the effectiveness of the compensating control.