A vulnerability scanner reports a critical finding on a web server: 'Apache HTTP Server 2.4.49 Path Traversal and Remote Code Execution (CVE-2021-41773).' The server is in production. What is the risk-prioritization factor that should be considered first?
Select an answer to reveal the explanation.
Short Explanation
When a critical Apache path traversal/RCE finding shows up, you prioritize by CVSS severity, whether a public exploit exists, and whether the server is internet-accessible. Those factors drive real likelihood and exposure. Past scan history, patch cost, or vendor statements don't change the immediate risk.
Full Explanation
The correct prioritization factor is the CVSS score, exploitability (including whether a public exploit is available), and whether the affected component is internet-accessible. For a critical Apache path traversal/RCE finding, risk is driven by severity, likelihood of exploitation, and exposure: a public exploit increases likelihood, and internet accessibility increases attack surface. The option about whether the finding appeared in last quarter's scan is wrong because recurrence history informs patching process maturity but does not change current risk. The option about patching cost versus hardware depreciation is wrong because depreciation is irrelevant to security risk. The option about a vendor statement is wrong because it may inform awareness but does not change exploitability or exposure.