---
name: emergency-vulnerability-response
description: Run an emergency response to a critical, actively exploited vulnerability (zero-day or new KEV entry, e.g. on edge devices, file-transfer appliances or widely used libraries) — rapid exposure inventory, vendor mitigations, compromise assessment, patch tracking and communications. Use when a vendor/CISA emergency advisory drops or exploitation of a product you run is reported.
license: MIT
metadata:
  category: vulnerability-management
  version: "2.0.0"
  verification: documented
---

# Emergency Vulnerability Response

## T+0 to T+4 hours

1. **Confirm the facts**: vendor advisory, affected versions/configurations, exploitation status (CISA KEV, vendor, credible intel), available patch/mitigation, IOCs.
2. **Inventory exposure** quickly from multiple sources: CMDB, scanner (create a targeted check), EDR software inventory, cloud asset inventory, external ASM/Shodan/Censys of your own ranges, SBOM search for libraries (`sbom-vulnerability-analysis`, e.g. `grype sbom:./sbom.json | grep CVE-...`).
3. **Mitigate internet-facing instances first**: vendor workaround, disable feature, restrict access (ACL to known IPs), take offline if necessary (with business approval).
4. **Assume compromise if exposed during the exploitation window**: run vendor/CISA integrity tools, collect device logs before they rotate, look for IOCs and webshells, check for new admin accounts and config changes (`incident-scoping` if found).
5. **Communicate**: status to leadership and owners with a single tracker.

## T+4 hours onward

- Patch per `patch-campaign` with expedited change process; verify versions afterward.
- Deploy detections for exploitation attempts and post-exploitation behaviour (`intel-to-detection`).
- Re-check exposure inventory for missed instances (shadow IT, test environments, cloud images).
- After patching edge devices, rotate credentials/secrets stored on or passing through them (VPN appliances often expose session tokens and AD credentials).

## Tracker

```
Vuln <CVE> — <product>  KEV: <date>  Patch available: <y/n>
Instances: total <n> | internet-facing <n> | mitigated <n> | patched <n> | compromise checked <n> | compromised <n>
Actions due: <>   Next update: <time>
```

## Related skills

`vuln-prioritization`, `exposure-validation`, `patch-campaign`, `intel-to-detection`, `incident-scoping`

## References

- CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- CISA Emergency Directives: https://www.cisa.gov/news-events/directives
- FIRST PSIRT services framework: https://www.first.org/standards/frameworks/psirts/