Death by Critical CVE: Escaping the Flood of Score-Based Remediation

Death by Critical CVE: Escaping the Flood of Score-Based Remediation

Speakers: Courtney Burr, Senior Security Solutions Architect, Qualys

Conference: SAINTCON

YouTube: https://www.youtube.com/watch?v=ZKBGuDB92KY

Overview

In the realm of cybersecurity, organizations are perpetually overwhelmed by an ever-increasing deluge of vulnerabilities, each demanding attention and remediation. Courtney Burr, a Senior Security Solutions Architect at Qualys, tackles this critical challenge in his SAINTCON presentation, "Death by Critical CVE: Escaping the Flood of Score-Based Remediation." Co-authored with Andrew Nelson, this talk critically examines the prevalent, yet often flawed, practice of prioritizing vulnerability remediation solely based on the Common Vulnerability Scoring System (CVSS). Burr argues that while CVSS provides a technical severity score, it fails to adequately capture the true business risk and exploitability of a vulnerability, leading to misprioritization, wasted resources, and increased organizational exposure.

The core premise of Burr's presentation is that CVSS alone is insufficient for effective risk-based prioritization, and that context is everything. He demonstrates through real-world examples how a high CVSS score might indicate low actual risk, while a low CVSS score could represent a significant, actively exploited threat. The talk advocates for a paradigm shift, urging security teams to integrate crucial contextual signals—such as business impact, exploit prediction, and known exploitability—to create a more accurate and actionable risk profile. By doing so, organizations can invest their limited resources more effectively, focusing on the vulnerabilities that genuinely pose a material risk to their business operations.

This article delves into Burr's insights, exploring the limitations of traditional scoring, highlighting critical misprioritizations, and detailing a proposed framework for enhancing vulnerability management. It provides a technical deep dive into the supplementary scoring systems and threat intelligence feeds that can augment CVSS, culminating in a discussion of a prototype automation example designed to synthesize these diverse data points into a composite risk score. Ultimately, the goal is to empower defenders to move beyond a reactive, score-driven approach to a proactive, context-aware strategy that truly measures and mitigates business risk.

Background

▶ Watch: Key Takeaways: CVSS alone insufficient, context is everything (1:35)

The landscape of cybersecurity is defined by a constant arms race between attackers and defenders, with new vulnerabilities emerging at an unprecedented rate. Central to understanding and communicating these weaknesses are two foundational concepts: Common Vulnerabilities and Exposures (CVE) and the Common Vulnerability Scoring System (CVSS).

A CVE is a unique identifier assigned to publicly disclosed cybersecurity vulnerabilities. It serves as a universal catalog for tracking and referencing specific flaws. Complementing CVEs, CVSS is an open standard designed to assess the severity of a vulnerability, assigning a numerical score from 0 to 10. This score categorizes vulnerabilities into low (0.0-3.9), medium (4.0-6.9), high (7.0-8.9), and critical (9.0-10.0) severity levels. While CVSS is widely adopted, the talk focuses specifically on CVSS version 3.1, which remains the most commonly used standard today.

CVSS 3.1 is composed of three primary metric groups:

1. Base Score: This is a static score that never changes, regardless of the threat landscape. It describes the inherent exploitability and potential impact of a vulnerability on a system. Factors include attack vector, attack complexity, privileges required, user interaction, scope, and impacts on confidentiality, integrity, and availability.
2. Temporal Score: This dynamic score changes over time to reflect the current state of exploit availability, remediation efforts, and official fixes. For instance, the score might increase if a public exploit becomes available or decrease once a robust patch is released.
3. Environmental Score: This is arguably the most crucial, yet most underutilized, component for assessing true risk. The environmental score allows organizations to customize the base and temporal scores by incorporating their specific business context. For example, if a vulnerability's attack vector is network-based but the affected asset resides in a highly segmented, internal-only network, the environmental score can be adjusted downwards, reflecting a lower practical risk. Burr notes that fewer than 5% of organizations he's encountered actually leverage temporal or environmental metrics, largely relying on the static base score.

The problem is exacerbated by the sheer volume of new vulnerabilities. In 2024 alone, over 28,000 CVEs were disclosed, averaging approximately 79 per day. A significant portion, roughly 31%, were rated as critical (CVSS 9.0 or higher), equating to nearly 9,000 critical CVEs annually. This creates an impossible remediation workload for security teams.

However, a critical piece of context often overlooked is that historically, only about 2% of all disclosed CVEs are ever actually exploited in the wild. The speaker emphasizes that CVSS, in its base form, cannot distinguish which 2% will be weaponized. Furthermore, the time from vulnerability disclosure to weaponization has drastically shrunk. While it averaged 32 days in 2021-2022, it dropped to 5 days in 2023, and in 2024, the average was 72 hours. Disturbingly, there have even been instances of "minus-one day" exploits, where vulnerabilities were exploited before public disclosure. This rapid weaponization, coupled with the overwhelming volume of CVEs and the inability of CVSS to predict exploitability, creates a false sense of security and leads to significant misprioritization, burnout, and an increased risk of security incidents.

Key Findings

▶ Watch: Real-world problem: Overwhelmed by volume of vulnerabilities (4:45)

The central finding of Burr's talk is a stark indictment of CVSS-only prioritization: it measures technical severity, not actual business risk or threat. This disconnect leads to severe misprioritizations, wasting valuable resources and leaving organizations vulnerable to genuinely exploited threats.

Burr highlights several real-world examples of flawed prioritization strategies he's encountered:

• Case 1: Prioritizing CVSS 6+ and vendor severity 4-5. For a large organization, this resulted in more vulnerabilities needing remediation each month than many companies generate in annual revenue. The sheer volume was unsustainable.
• Case 2: Prioritizing CVSS 8+ or vendor severity 4-5. This approach led to significant operational overhead and burnout, as teams were swamped with vulnerabilities, many of which did not pose an immediate or material threat.
• Case 3: Only patching OS-level vulnerabilities. This extreme case entirely missed critical patches for databases, middleware, and applications like web browsers, leaving vast swathes of the environment exposed.

To illustrate the inherent flaws, Burr presents two contrasting CVEs:

• Bleeding Tooth (CVE-2020-11261): This zero-click RCE in a Linux Bluetooth stack sounds terrifying and carries a CVSS score of 8.3. However, its actual risk is significantly lower in many environments because an attacker needs to be within physical distance of the device, and Bluetooth must be enabled and in discoverable mode. In data centers or Linux server environments, this vulnerability's practical threat is minimal.
• CVE-2020-0302: This vulnerability has a much lower CVSS score of 5.0 but is part of the CISA Known Exploited Vulnerabilities (KEV) catalog. It was paired with Android exploits and used by law enforcement to unlock confiscated phones. Despite its medium CVSS, its active exploitation makes it a far higher priority than Bleeding Tooth.

These examples underscore the critical disconnect: CVSS cannot tell you which of the 2% of vulnerabilities will actually be exploited. This leads to a substantial misallocation of effort, with potentially 98% of remediation efforts focused on vulnerabilities that will never pose a material risk.

The financial and human costs of this misprioritization are significant:

• Increased Risk: A false sense of security leads to an increased risk of security events and business disruptions.
• Wasted Resources: According to a 2024 study by Ponemon, the average cost to deploy a single patch is $397. Focusing solely on the 9,000 critical CVEs disclosed annually could cost an organization $3.5 million, with most of that budget potentially spent on non-exploitable vulnerabilities.
• Burnout: The overwhelming workload contributes to 67% of security teams reporting burnout, a unsustainable situation that further degrades security posture.

Burr's key finding is that to escape this "death by critical CVE," organizations must move beyond simple score-based prioritization and integrate robust context-based signals. These signals include business context, exploit prediction (via EPSS), and known exploitability (via CISA KEV), which together provide a more accurate and actionable measure of true risk.

Technical Deep Dive

▶ Watch: Mis-prioritization example: Bleeding Tooth (high CVSS, low risk) (6:20)

To effectively escape the flood of score-based remediation, Burr proposes a multi-faceted approach that integrates several key technical signals beyond the static CVSS base score. The foundation of this approach involves understanding and leveraging CVSS version 3.1 more fully, particularly its Environmental Score, and then layering on external threat intelligence.

While the Base Score (static, describing inherent exploitability and impact) and Temporal Score (dynamic, reflecting exploit maturity and remediation availability) provide valuable technical details, the Environmental Score is where an organization's unique context can significantly alter the perceived risk. This metric allows for customization of base metrics based on specific environmental conditions. For instance, if a vulnerability has a network attack vector, but the affected asset is strictly internal or in a segmented network, the environmental score can be adjusted downwards. This customization is critical for aligning technical severity with actual organizational risk, yet it is rarely implemented.

Beyond enhancing CVSS usage, Burr advocates for the integration of two primary, free, and highly impactful signals:

1. Exploit Prediction Scoring System (EPSS): Maintained by FIRST (Forum of Incident Response and Security Teams), EPSS is a machine learning model trained on real-world data to predict the likelihood that a vulnerability will be exploited in the next 30 days. Unlike CVSS, which tells you how bad a vulnerability can be, EPSS tells you how likely it is to be exploited in the wild. EPSS provides a probability score (e.g., 0.1% or 64%), offering a crucial dynamic indicator of immediate threat.

• High CVSS + Low EPSS: (e.g., Bleeding Tooth, CVSS 8.3, low EPSS) – Sounds scary, but the actual risk is likely much lower due to limited exploitability in practical environments.
• Low CVSS + High EPSS: (e.g., CVE-2020-0302, CVSS 5.0, high EPSS) – Appears minor by CVSS alone, but its high EPSS indicates a strong likelihood of exploitation, demanding immediate attention.
• High CVSS + High EPSS: This combination represents the highest priority, as both impact and exploit likelihood are significant.

1. CISA Known Exploited Vulnerabilities (KEV) Catalog: This publicly available list, maintained by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), enumerates vulnerabilities that have been actively exploited in the wild. Inclusion in the KEV catalog immediately elevates a vulnerability's priority, irrespective of its CVSS or EPSS score, as it represents a proven, ongoing threat. Organizations with government contracts or specific regulatory requirements are often mandated to address KEV catalog vulnerabilities within strict timelines.

Burr’s proposed decision framework for prioritization integrates these signals:

1. Is it on the CISA KEV list? If Yes, prioritize patching immediately.
2. If No, does it have a high EPSS score AND a high CVSS score? If Yes, prioritize next.
3. If No to both, consider network environment context and compensating controls. Prioritize based on asset criticality, whether it's production, non-production, internal, external-facing, or if existing security controls mitigate the risk.

Beyond these core, free resources, organizations can further enhance their threat intelligence by incorporating:

• Vendor Advisories: Specific guidance from software and hardware vendors (e.g., Patch Tuesday details, Red Hat Erratas, Cisco Advisories).
• Community Threat Feeds: Platforms like MISP (Malware Information Sharing Platform) and AlienVault OTX (Open Threat Exchange) provide crowdsourced and curated threat intelligence, often accessible via API.
• Paid Intel Platforms: For organizations with larger budgets, commercial threat intelligence platforms offer curated, in-depth analysis and early warnings.

The critical takeaway is to integrate CISA KEV and EPSS first, as they are free, impactful, and relatively easy to implement, providing an immediate and significant improvement to prioritization capabilities. This layered approach moves beyond a simplistic numerical score to a dynamic, context-aware assessment of true organizational risk.

Demo / Proof of Concept

▶ Watch: CVSS cannot identify the 2% of actively exploited vulnerabilities (7:40)

To demonstrate the practical application of his proposed framework, Burr presented a prototype automation example. This proof of concept is designed to consolidate the various contextual factors and threat intelligence feeds into a single, actionable risk score, providing a prioritized list of vulnerabilities. The code for this prototype is available on GitHub, allowing other organizations to explore and adapt it.

The prototype workflow involves several key steps:

1. Data Ingestion: The system pulls vulnerability data from existing security scanners (e.g., Qualys, Nessus, Tenable) or can ingest it from a simple CSV file. This ensures compatibility with diverse organizational toolsets.
2. Data Normalization and Enrichment:

• The ingested vulnerability data is normalized to ensure consistency.
• It is then enriched with EPSS scores, which are fetched from the FIRST EPSS API (a free resource).
• The vulnerabilities are cross-referenced against the CISA KEV catalog, identifying those known to be actively exploited.

1. Asset Context Integration: The prototype incorporates asset context, which can be sourced from a CMDB (Configuration Management Database) or through manual classification. This context includes critical factors such as:

• Asset Value: The financial or operational impact if the system goes down.
• Data Sensitivity: Whether the asset handles PII, PHI, or falls under regulatory scopes like PCI.
• Attack Surface: Whether it's an externally facing production web server or an internal, segmented system.
• Compensating Controls: Existing security measures that might reduce the likelihood of exploitation.
• Maintenance Window: Practical constraints on when patches can be deployed.

1. Composite Risk Scoring: Based on all these factors (CVSS, EPSS, CISA KEV, asset context, and temporal factors like vulnerability age), the prototype calculates a composite risk score ranging from 0 to 100. The scoring weights for each factor are customizable, allowing organizations to tune the model to their specific risk appetite and environment.
2. Prioritized Ranking: Finally, the system outputs a prioritized rank for each vulnerability, indicating its true urgency based on the composite risk score.

The output of the Python script is a JSON file. To make this data more accessible and visually intuitive, the prototype also includes a basic UI (User Interface). This UI allows users to:

• Visually explore the prioritized list of vulnerabilities.
• Click on widgets to showcase specific data points.
• Toggle between asset and CVE views.
• Drill down into individual CVEs to retrieve detailed information, such as MITRE ATT&CK data (though not explicitly mentioned, often integrated with CVE data) or further details from MISP.

Burr emphasizes several key considerations for organizations looking to implement similar solutions:

• Iterate and Validate: Do not "over-automate before you validate." Start with a prototype, iterate, and continuously tune the scoring model to your specific environment.
• Tune Scoring: The customizable scoring weights are crucial for aligning the risk score with an organization's unique business priorities.
• Asset Criticality: This is highlighted as one of the "key factors that you absolutely need to have" for accurate risk assessment.
• Exception Handling: The prototype, being a proof of concept, doesn't fully account for exceptions (e.g., a critical business application that must run an outdated, vulnerable component). Organizations must implement robust processes for documenting and managing such exceptions.

This prototype serves as a tangible example of how diverse data sources can be programmatically combined to move beyond static CVSS scores and achieve a more intelligent, risk-driven vulnerability management program.

Defensive Implications

▶ Watch: The ever-increasing flood of new CVEs year-over-year (7:50)

The insights presented by Courtney Burr offer critical defensive implications for organizations struggling with vulnerability management. The core message is clear: defenders must shift away from a purely score-based remediation strategy to one driven by comprehensive risk assessment.

Here are actionable steps and considerations for defenders:

1. Re-evaluate Current Prioritization: If your organization relies solely on CVSS v3.1 base scores (or any single metric) for prioritization, it's imperative to re-evaluate this approach. Recognize that CVSS is a technical severity score, not a business risk score, and it inherently lacks the context of exploitability and environmental factors.

1. Leverage Existing Security Tools: Many commercial vulnerability management platforms (e.g., Qualys, Tenable, Rapid7, CrowdStrike, Kenna Security) already incorporate advanced risk-based prioritization capabilities. Defenders should engage with their vendors to understand and activate these features, moving away from default CVSS-only settings.

1. Adopt CVSS v4.0 (but don't stop there): While CVSS v4.0 offers additional metrics and a more nuanced scoring system, Burr notes it's still insufficient on its own. It provides a better picture but still misses critical threat intelligence. If not using advanced platforms, moving to v4.0 is a step forward, but it's not the ultimate solution.

1. Integrate EPSS and CISA KEV Immediately: These two resources are paramount and should be the first additions to any prioritization framework, primarily because they are free and highly impactful.

• EPSS (Exploit Prediction Scoring System): Continuously monitor EPSS scores for all vulnerabilities. Prioritize vulnerabilities with high EPSS scores, even if their CVSS is moderate, as they represent a higher likelihood of active exploitation within 30 days.
• CISA KEV (Known Exploited Vulnerabilities) Catalog: Regularly cross-reference your vulnerability inventory against the CISA KEV catalog. Any vulnerability on this list should be considered a top-tier priority for immediate remediation, as it signifies active exploitation in the wild.

1. Incorporate Business Context: This is arguably the most critical and often overlooked component. Customize vulnerability scores based on the specific context of the affected assets:

• Asset Value: What is the financial or operational impact if this system goes down or is compromised?
• Data Sensitivity: Does the asset process or store PII, PHI, or other sensitive/regulated data (e.g., PCI scope)?
• Attack Surface: Is the asset internet-facing, internal, in a segmented network, or behind multiple layers of defense?
• Compensating Controls: Are there existing security measures (e.g., WAF, IPS, strong authentication, network segmentation) that mitigate the risk of exploitation?
• Maintenance Windows: Understand the practical constraints on when systems can be taken offline for patching.

1. Expand Threat Intelligence Feeds: Once EPSS and CISA KEV are integrated, consider adding other threat feeds:

• Vendor Advisories: Stay current with specific patches and advisories from your software and hardware vendors.
• Community Feeds: Explore free resources like MISP and AlienVault OTX for broader threat intelligence.
• Paid Platforms: If budget allows, invest in commercial threat intelligence platforms for deeper insights and tailored threat landscapes.

1. Focus on the "2%": Actively shift remediation efforts to focus on the small percentage of vulnerabilities that are truly exploitable and pose a material risk. This means moving away from a "patch everything critical" mentality to a "patch what matters most" strategy. This targeted approach will reduce wasted resources and combat security team burnout.

1. Automate Responsibly and Iterate: If developing custom automation (like the prototype demoed), follow secure development practices. Start with validation, tune scoring weights for your unique environment, and gradually automate. Crucially, build in robust exception handling for business-critical systems that cannot be patched immediately for legitimate reasons, ensuring these exceptions are documented and regularly reviewed.

1. Measure Risk, Not Just Vulnerability Count: Change key performance indicators (KPIs) and reporting from simply counting vulnerabilities or critical CVEs to measuring the overall reduction in business risk. This aligns security efforts with business objectives and facilitates better resource allocation discussions with leadership.

By embracing these defensive implications, organizations can transform their vulnerability management programs from a reactive, overwhelming task into a strategic, proactive effort that effectively reduces their attack surface and protects critical assets.

Key Takeaways

• CVSS Alone is Insufficient for Risk: The Common Vulnerability Scoring System (CVSS) measures technical severity, not actual business risk. Relying solely on its base score leads to misprioritization and a false sense of security.
• Context is Everything: The same vulnerability can pose vastly different levels of risk depending on the business context of the affected asset. Factors like asset value, data sensitivity, attack surface, and existing compensating controls drastically alter its true priority.
• Focus on the 2%: Historically, only about 2% of all disclosed CVEs are ever exploited in the wild. Organizations must prioritize efforts on these truly exploitable vulnerabilities rather than attempting to patch the entire flood of "critical" CVEs.
• Leverage Exploit Prediction and Known Exploitation: Integrate EPSS (Exploit Prediction Scoring System), which predicts exploit likelihood, and the CISA KEV (Known Exploited Vulnerabilities) Catalog, which lists actively exploited vulnerabilities. These free resources are crucial for identifying immediate threats.
• Measure Risk to Business, Not Just Vulnerability Count: Shift organizational metrics from simply counting vulnerabilities to assessing and reducing overall business risk. This ensures limited resources are invested where they matter most to protect critical assets and operations.
• Rapid Weaponization Demands Speed: The average time from disclosure to weaponization has shrunk to approximately 72 hours. Prioritizing effectively and patching critical, exploitable vulnerabilities quickly is essential to stay ahead of attackers.

About the Speaker(s)

Courtney Burr is a Senior Security Solutions Architect at Qualys, a role he describes as a "fancy title for sales engineer." With a deep background in vulnerability management, he previously spent six years at Microsoft, contributing to both the Azure Threat and Vulnerability Management team and the Xbox Threat and Vulnerability Management team. Beyond his professional roles, Burr is a dedicated and "perpetual volunteer," actively contributing to the cybersecurity community. He serves as a co-organizer for the volunteers at Seattle B-Sides, volunteers for initiatives like the Diane Initiative, and is a Defcon SOC volunteer (specifically for the "make a whole kind, not the free hux kind"). He also identifies as a veteran. Courtney Burr's extensive experience across enterprise security, product security, and community engagement makes him a credible voice on the challenges and solutions in vulnerability management.

Andrew Nelson is acknowledged as a co-author of the presentation. While he was not physically present to deliver the talk at SAINTCON, Courtney Burr made sure to credit him for his contributions to the research and content. No further biographical details were provided in the transcript for Andrew Nelson.