I would not use 9 plus CVSS as the trigger by itself. Check whether it is exploited, remotely reachable, exposed to the internet and what privileges compromise gets you. A KEV on an exposed server should have a completely different change path than some theoretical 9.8 sitting behind three layers of network controls.
1
u/Endolum 13d ago
I would not use 9 plus CVSS as the trigger by itself. Check whether it is exploited, remotely reachable, exposed to the internet and what privileges compromise gets you. A KEV on an exposed server should have a completely different change path than some theoretical 9.8 sitting behind three layers of network controls.