CVE triage practice
Five public vulnerabilities. Fictional assets. Evidence frozen September 20, 2026. This teaching table is not output from CVE Prioritizer.
Choose what to investigate first, record your evidence, and keep unknowns visible.
On a small screen, scroll the table sideways to see every column.
| Finding | CVE | CVSS v3.1 | EPSS | KEV snapshot | Applicability | Exposure |
|---|---|---|---|---|---|---|
| A | CVE-2021-44228 | 10.0 | 99.999% | Yes | unconfirmed | Internal network; package inventory only |
| B | CVE-2023-23397 | 9.8 | 97.408% | Yes | confirmed in exercise | Receives external email |
| C | CVE-2023-34362 | 9.8 | 99.934% | Yes | confirmed in exercise | Public internet |
| D | CVE-2024-3094 | 10.0 | 85.974% | No entry in snapshot | unconfirmed | Internal build network |
| E | CVE-2023-44487 | 7.5 | 99.999% | Yes | confirmed in exercise | Public internet through a protective edge |
Fictional asset context
A — Fictional internal Java service: Scanner matched a library filename; loaded version and reachable execution path have not been verified.
B — Fictional finance-team Outlook endpoint: Fictional device inventory confirms affected software. No evidence has been collected to determine whether exploitation occurred.
C — Fictional public file-transfer server: Fictional inventory confirms an affected version and public access. It handles sensitive files; no compensating control is recorded.
D — Fictional Linux build worker: Scanner matched xz by name only. Distribution package version and vendor advisory applicability are missing. Do not assume all xz installations are affected.
E — Fictional public HTTP/2 service: A mitigation is recorded, but its coverage and configuration have not been tested. Availability is business-critical.
Your task
Choose the first confirmed exposure to investigate. Identify which findings need applicability checks. Explain how mitigation evidence could change the order, and why absence from KEV does not establish safety.
Compare a worked answer
Start response planning for C and handle B promptly alongside it where capacity allows. Test E's mitigation. Assign A and D explicit applicability investigations. Avoid a final patch schedule until incident evidence, ownership, maintenance constraints and vendor guidance are known.
The best answer names evidence, a next step and uncertainty. Severity alone does not settle the queue.
Your evidence worksheet
Type into the cells, then print or save as PDF. Edits are not saved automatically and disappear on reload.
| Finding | Source/date | Applicability/exposure | Next step | Owner/review time | Uncertainty |
|---|---|---|---|---|---|
| A | |||||
| B | |||||
| C | |||||
| D | |||||
| E |
Download frozen fixture · Full exercise and answer key · Original project