Vulnerability management: CVEs, CVSS scores, scanning, prioritising and patching

Most successful attacks use known weaknesses that had a fix available. Vulnerability management is the steady process of finding those weaknesses and fixing the most dangerous first.

Key terms

CVSS severity ratings

CVSS describes how severe a flaw is in general (can it be exploited over the network? is login needed? what is the impact?). CVSS version 4.0 was released in 2023; many databases still show 3.1 scores too.

Severity isn't the whole story

Smart prioritisation adds context:

• Is it being exploited in the wild? The US CISA Known Exploited Vulnerabilities (KEV) catalogue lists flaws attackers actively use.
• How likely is exploitation soon? EPSS (Exploit Prediction Scoring System) estimates the probability.
• How exposed is the asset? Internet-facing beats internal-only.
• How important is the asset? The payment server matters more than a test VM.

The vulnerability management cycle

1. Asset inventory: you can't protect what you don't know about (servers, laptops, cloud, websites, plugins).
2. Scan: authenticated scans find more than unauthenticated ones.
3. Prioritise: by severity, exploitation, exposure and asset value.
4. Remediate: patch, upgrade, change configuration, or apply a temporary mitigation.
5. Verify: rescan to confirm the fix.
6. Report: track numbers and time to fix.

Tools

Lab: prioritise a list of findings (run it)

findings = [
    {"cve": "CVE-A", "asset": "Public website (WordPress plugin)", "cvss": 9.8, "known_exploited": True,  "internet": True,  "critical_asset": True},
    {"cve": "CVE-B", "asset": "Internal test VM",                 "cvss": 9.1, "known_exploited": False, "internet": False, "critical_asset": False},
    {"cve": "CVE-C", "asset": "VPN gateway",                      "cvss": 7.5, "known_exploited": True,  "internet": True,  "critical_asset": True},
    {"cve": "CVE-D", "asset": "Accounts PC (PDF reader)",          "cvss": 7.8, "known_exploited": False, "internet": False, "critical_asset": True},
    {"cve": "CVE-E", "asset": "Office printer",                   "cvss": 5.3, "known_exploited": False, "internet": False, "critical_asset": False},
]

def priority(f):
    score = f["cvss"]
    if f["known_exploited"]: score += 5
    if f["internet"]:        score += 3
    if f["critical_asset"]:  score += 2
    return score

for f in sorted(findings, key=priority, reverse=True):
    print(f'{priority(f):5.1f}  {f["cve"]}  CVSS {f["cvss"]:<4}  {f["asset"]}')

The VPN gateway (CVSS 7.5) jumps above the internal test VM (CVSS 9.1) because it is internet-facing and actively exploited. The weights here are a simple teaching example; organisations agree their own rules.

Patch management good practice

• Turn on automatic updates for operating systems, browsers and apps wherever practical.
• Set target fix times, e.g. actively exploited or critical internet-facing: days; high: within 2–4 weeks; others: the regular monthly cycle.
• Test important patches first, but don't let testing become an excuse for months of delay.
• Replace end-of-life software (no more security updates), such as old Windows versions or abandoned plugins.
• Can't patch yet? Mitigate: disable the feature, restrict access, add a WAF rule, monitor closely.

Responsible disclosure

If you find a vulnerability in someone else's product while using it normally:

• Don't exploit it further or access other people's data.
• Report it privately to the vendor (look for security.txt, a security email, or a bug bounty programme).
• Give them reasonable time to fix it before any public discussion.

Summary

• CVEs identify known vulnerabilities; CVSS rates severity from 0 to 10.
• Prioritise by severity plus active exploitation (KEV), likelihood (EPSS), exposure and asset value.
• Cycle: inventory, scan, prioritise, remediate, verify, report.
• Scan only with permission; disclose responsibly.