Critical CVE Response¶
Scope and Triggers¶
This procedure covers a newly disclosed vulnerability that cannot wait for the normal patch cycle. It starts when:
- A vulnerability affecting software or devices we run is added to CISA's Known Exploited Vulnerabilities (KEV) catalog
- A vendor publishes an out-of-band patch or an advisory that mentions active exploitation
- A critical vulnerability with public exploit code affects an internet-facing system
Prioritization¶
CVSS alone over-prioritizes. I combine it with the factors that actually drive risk:
| Factor | Question |
|---|---|
| Exploitation | Is it in KEV, or does the vendor or threat intel report exploitation? Is there public exploit code? |
| Exposure | Is the vulnerable component reachable from the internet, or only internally? |
| Asset | Is it an identity system, edge device, or server holding sensitive data? |
| Likelihood | What does EPSS say about the chance of exploitation in the next 30 days? |
| Severity | CVSS score, and whether exploitation requires authentication or user interaction |
My response targets:
| Priority | Criteria | Target |
|---|---|---|
| Emergency | Known exploited and internet-facing | Mitigate within 24 hours |
| High | Known exploited and internal, or public exploit and internet-facing | Patch within 7 days |
| Normal | Everything else | Normal patch cycle |
Steps¶
- Intake. I read the advisory and record the CVE, affected products and versions, fixed versions, available mitigations, and published indicators of compromise.
- Scope. I find every affected instance from the asset inventory, vulnerability scanner, and EDR software inventory (see the queries below). I check for the products that inventories often miss: appliances, embedded software, and third-party components bundled in other applications.
- Assess exposure. For each instance: is the vulnerable service reachable from the internet? An external scan or the firewall rules answer this.
- Mitigate if I cannot patch immediately. The vendor workaround, disabling the vulnerable feature, restricting access to known IPs, a WAF or IPS rule, or taking the system offline if the risk justifies it.
- Patch. Test where possible, but for Emergency priority, I accept more change risk than usual. Systems that cannot be patched get a documented exception with compensating controls and an owner.
- Verify. I rescan or check versions to confirm every instance is fixed, rather than relying on the patch job's success report.
- Hunt for prior exploitation. For anything exploited in the wild, patching closes the door but does not tell me whether someone already came through it. I check the vendor's indicators and logs from before the patch. For edge devices, this means running the Exploited Edge Device investigation steps.
- Communicate and close. I report what was affected, what was done, any exceptions, and whether there was evidence of exploitation.
Queries¶
Devices with the CVE from Defender Vulnerability Management:
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2026-XXXXX"
| summarize Devices = dcount(DeviceName), DeviceList = make_set(DeviceName, 100) by SoftwareVendor, SoftwareName, SoftwareVersion
All installed versions of an affected product, to confirm the fixed version is deployed:
DeviceTvmSoftwareInventory
| where SoftwareName has "product-name"
| summarize Devices = dcount(DeviceName) by SoftwareVendor, SoftwareName, SoftwareVersion
| order by SoftwareVersion asc
Internet-facing devices among those affected:
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2026-XXXXX"
| join kind=inner (DeviceInfo | where IsInternetFacing == true | distinct DeviceId) on DeviceId
| distinct DeviceName, SoftwareName, SoftwareVersion
Communication¶
- System owners: at intake, with the deadline and any expected downtime
- Change advisory board: emergency changes follow the emergency change process, documented after the fact if needed
- Management: a short status at intake and at close for Emergency priority, including any exceptions accepted
Close-out¶
- Record affected assets, actions, dates, exceptions, and hunt results
- Asset inventory gaps found during scoping get fixed, because they will matter again on the next CVE
- Track exceptions to their review date