When several zero-days land at once, rank them by four questions: is the system exposed to untrusted networks, is exploitation reported, how valuable is what it protects, and how hard is the fix. Work the highest score first, assign separate owners per flaw, and avoid splitting your best people across all three.
Why a method helps
Under pressure, people chase whichever alert is loudest. A simple scoring sheet makes the order visible and defensible. It also gives executives a reason when you say one flaw waits a day.
Score each flaw
| Factor | 0 | 1 | 2 |
|---|---|---|---|
| Exposure | Internal only | Partner access | Internet-facing |
| Exploitation | None known | Proof of concept public | Exploited, for example a KEV listing |
| Asset value | Low | Medium | Customer data or core service |
| Fix effort | Hard, long | Moderate | Quick or workaround exists |
Add the numbers. Use fix effort as a tie breaker, since quick wins reduce risk fast. Adjust the scale to your needs, but write it down before the event so you do not tune it to the answer you want.
Run separate tracks
Give each flaw its own owner, channel thread and status line. The incident owner keeps a single board that lists all three with their scores and states. Avoid merging them in one document, because updates blur.
If one system is hit by two flaws, patch once for both when the fix allows, so you do not reboot twice.
Watch for shared causes
Check whether the three flaws touch the same product family or the same team. If they do, that team is your bottleneck. Borrow help from other groups, and consider mitigations that reduce all three at once, such as removing public access to a management interface.
Communicate the order
Tell executives which flaw is first and why, using the scores. Tell system owners what they are on the hook for, with times. Review the board at every update.
CISA's KEV catalog is positioned as an input to prioritization, so a listing there should raise the exploitation score.
Example
Flaw A scores 2, 2, 2, 1 for an exposed, exploited, customer-facing system with a quick fix, so it totals 7. Flaw B scores 0, 1, 1, 0 for an internal tool, so it totals 2. Flaw A goes first, and B waits for the normal window with a note explaining why.
Try it yourself
Click through it at your own pace, or open it full screen.
Sort the findings and notice how severity, exposure and fix status change the order.
Quick check
Should the highest CVSS score always go first?
No. Exposure and confirmed exploitation often matter more than the base score. See the scoring table above.
Can we fix all three at once?
Sometimes, if one team owns all three and a shared mitigation exists. Otherwise run separate tracks.
Sources
Last reviewed: 19 October 2026.
