Remediation Guides

Priority 1

Immediate

CVSS ≥9.0 — Critical severity, unauthenticated exploitation, active ransomware campaigns. Patch or isolate within 24–48 hours.

Priority 2

7 Days

CVSS 7.0–8.9 — High severity, exploitation requires minimal conditions. Part of CISA BOD requirements for federal agencies.

Priority 3

30 Days

CVSS 4.0–6.9 — Medium severity, requires privileges or user interaction. Still in KEV, so exploitation is confirmed.

Priority 4

90 Days

CVSS <4.0 — Low severity but still exploited. Address in next regular patch cycle.