Decide in this order: are we affected, is it being exploited, does a fix exist, and can we ship safely with a mitigation. Each answer narrows the choice. Do not slip the launch for a CVE you are not affected by, and do not ship over one that is exploited and reachable.
Step 1: are we affected
Ask for a yes or no with evidence within hours, not days. Is the vulnerable component in the shipped build, and can the vulnerable code run? OpenVEX distinguishes a component that is not present, vulnerable code that is not present, and vulnerable code that is present but not in the execute path. Those distinctions give you a vocabulary for the answer.
Step 2: is it exploited
Check whether the CVE is listed in CISA's Known Exploited Vulnerabilities catalog, which CISA describes as an input for prioritization. Look at the EPSS score as well; FIRST describes it as an estimate of the probability of exploitation in the next 30 days, meant to complement other inputs. Severity scores alone do not tell you this.
Step 3: does a fix exist
If a fixed version exists, check what upgrading costs. A patch release is meant to be backward compatible under Semantic Versioning, so it is often a small change. A fix that needs a major upgrade is a different decision.
Step 4: can we ship with a mitigation
Possible mitigations include a configuration change, disabling a feature through a flag that removes the vulnerable path, or restricting network exposure. Verify them rather than assuming.
Decision table
| Affected | Exploited | Fix available | Likely call |
|---|---|---|---|
| No | Any | Any | Ship, record a not affected statement |
| Yes | Yes | Yes | Patch before launch, if testing allows |
| Yes | Yes | No | Hold or ship only with a verified mitigation and exec sign off |
| Yes | No | Yes | Patch, or ship with a dated follow up |
| Yes | No | No | Ship with monitoring and a recorded exception |
Record the decision
Write who decided, on what evidence, the time, and the follow up date. If you ship with an exception, give it an owner and an expiry. After launch, close it out and tell customers who asked.
Try it yourself
Click through it at your own pace, or open it full screen.
See how a new advisory is matched against the components you ship, which is the quickest way to answer step 1.
Quick check
Should we always delay launch for a critical CVE?
No. If you are not affected, or a verified mitigation exists, you can often ship.
Who has the final say?
Agree this before launch week. Usually the product owner decides with security and engineering input.
Safeguard's zero-day discovery and reachability analysis help answer the affected question quickly, and the free scan is at gold.safeguard.sh/scan.
Sources
- CISA Known Exploited Vulnerabilities Catalog
- FIRST EPSS
- OpenVEX specification
- Semantic Versioning 2.0.0
Last reviewed: 19 October 2026.
