Two findings compete for the same maintenance window. Finding 1: CVSS 9.8 remote code execution on a development sandbox with no inbound internet exposure and no sensitive data. Finding 2: CVSS 7.2 privilege escalation on the production payroll server holding regulated staff records, with a public proof-of-concept available. Which finding should the analyst prioritise, and why?
- AFinding 1, because its 9.8 base score outranks the 7.2 and the highest CVSS should always be remediated first.
- BFinding 2, because asset criticality, regulated data, and a working proof-of-concept make it the greater real-world risk. Correct
- CFinding 1, since a remote code execution flaw is inherently more damaging than any privilege-escalation flaw regardless of location.
- DNeither yet; defer both until a fuller environmental CVSS re-score is completed for every asset in the estate.
Why A is wrong: Tempting because 9.8 exceeds 7.2, but base CVSS ignores exposure and asset value; treating the raw score as the sole ranking factor is the classic prioritisation error.
Why B is correct: Environmental context wins: a lower-scored flaw on an exposed, regulated, business-critical asset with a public exploit carries more real risk than a higher score on an isolated sandbox.
Why C is wrong: RCE can be severe, but severity depends on where it lives; an isolated sandbox with no exposure or data limits impact well below the exposed payroll server.
Why D is wrong: Re-scoring can refine ranking, but the evidence already shows a clear winner; deferring an exposed, exploitable, regulated-data finding to await a full re-score wastes the window.