Next to the CVSS scores, the NVD record for CVE-2026-0322 carries a block most dashboards ignore: an SSVC entry from CISA, dated 14 October 2026. SSVC, the Stakeholder-Specific Vulnerability Categorization, replaces a single score with a few plain questions. This post shows where to find the block and how to read it.
What's affected
The record is for the PAN-OS code injection bug added to CISA's KEV catalog on 14 October 2026. In the NVD API response the block sits under metrics.ssvcV203, with source role "CISA Coordinator", SSVC version 2.0.3, and three decision points:
| Decision point | Value |
|---|---|
| exploitation | active |
| automatable | no |
| technicalImpact | total |
CISA's SSVC guide names five decision points: exploitation status, technical impact, automatable, mission prevalence and public well-being impact. The last two depend on your own environment, so the NVD block cannot include them. It also does not state an outcome.
What to do now
- Pull the block:
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-0322" \
| jq '.vulnerabilities[0].cve.metrics.ssvcV203[0].ssvcData.options'
- Read each value as a plain statement. Exploitation active: there is evidence of exploitation. Automatable no: the exploit steps cannot be reliably automated at scale. Technical impact total: the attacker gains full control of the software's behavior.
- Add your two decision points. For a firewall management interface, ask how central the device is to your mission and what harm follows if it fails.
- Map the result to one of CISA's four outcomes: Track (no action needed now), Track* (monitor closely), Attend (needs attention from supervisory people) or Act (needs supervisory and leadership attention).
- Compare with the KEV due date. For this entry CISA set 17 October, three days after adding it, a clear signal of urgency.
Why it matters
A CVSS number mixes severity with assumptions. SSVC splits the question into facts you can check, such as whether exploitation is active, and facts only you know, such as how much the asset matters. That makes disagreement useful: you can see which input differs.
Quick check
Why does the NVD block not include a final decision like Act or Track?
Two of the five decision points, mission prevalence and public well-being impact, depend on your environment, so only you can complete the decision.
