When a CVE headline lands, run five checks before reacting: do we run the product, is our version in range, is the vulnerable path reachable, is it being exploited, and is a fix available. If the first two answers are no, you can stop and write that down. The headline score is not the decision.
Check 1: do we run it
Search your inventory for the product and for the library names it ships. The product name in a headline is often not the package name in your lockfile. If you do not have an inventory, the first useful action is to build one, even a rough one.
Check 2: is our version in range
Compare the exact versions. Many headlines hide that only one release line is affected, or that a fix landed in a minor release you already have.
Check 3: is it reachable
A vulnerable component can sit in your build without the vulnerable function ever being called, or without the service being exposed to the network. This is where a hands on look beats a score. Ask whether untrusted input can reach the affected code in your deployment.
Click through it at your own pace, or open it full screen.
Check 4: is it exploited
CISA describes its Known Exploited Vulnerabilities catalog as the authoritative source of vulnerabilities exploited in the wild, and suggests using it as an input to prioritisation. EPSS is a different signal: the FIRST FAQ says it estimates the probability of exploitation in the next 30 days. One is about the past and present, the other about the near future. Neither replaces the other.
Check 5: is there a fix
If a fixed release exists, plan the upgrade. If not, look for a mitigation and set a review date.
What to write down
Four lines are enough: product and version checked, reachable or not, exploited or not, decision and date. That record answers the manager who asks "did we see the news about X?" in the hallway.
Why not just read the score
The CVSS specification says the base score reflects intrinsic severity, and that other considerations such as customer impact are outside its scope. Use it as one input. The five checks above supply the rest.
Quick check
Do I wait for the score to be published?
No. If the product is one you run, start checks 1 to 3 right away. The score is not needed to know whether you are exposed.
What if the headline has no CVE number yet?
Track it by product name and version, and re-check when an identifier and advisory appear.
Sources
- FIRST, CVSS specification document
- CISA, Known Exploited Vulnerabilities Catalog
- FIRST, EPSS frequently asked questions
Last reviewed: 19 October 2026.
