---
name: vulnerability-triage
description: Score incoming vulnerability reports the same way every time, tie each score to a fix deadline, and run disclosure on a predictable clock. Use when a vulnerability report arrives or when standing up a process to handle them.
---

# Vulnerability triage

A stream of vulnerability reports with no method produces panic or paralysis:
everything feels urgent, so nothing gets a real deadline. The cure is to score
every report by the same rule, convert the score into a due date, and answer the
reporter on a schedule they can predict.

## Method

1. **Reproduce before you rate.** Close duplicates and non-issues fast. For the
   rest, capture the affected version, the attack prerequisites, and a minimal
   reproduction, so the score rests on facts and not on the reporter's
   adjectives.
2. **Score with CVSS 3.1 and keep the vector string.** Compute the base score
   from 0 to 10 and store the full vector (AV, AC, PR, UI, and the rest) so
   anyone can audit the rating later. Apply environmental metrics when your
   deployment differs from the generic assumption.
3. **Convert the score into a fix window.** Critical (9.0 to 10.0) inside 7
   days, High (7.0 to 8.9) inside 30, Medium (4.0 to 6.9) inside 90, Low into
   the next planned release. Start the clock at triage, not at the fix.
4. **Weight by real exploitability, not the base number.** A Medium with a
   public exploit or active use in the wild (check the CISA KEV catalog) jumps
   the line. Internet-reachable and unauthenticated outranks a bug that sits
   behind admin login.
5. **Track every report in one system** with named states: reported, triaged,
   fixed, verified, disclosed. Assign an owner to each finding, because a
   vulnerability nobody owns is a vulnerability nobody is fixing.
6. **Disclose on a stated timeline.** Acknowledge the reporter inside a fixed
   window, agree an embargo (90 days is common), request a CVE, and publish an
   advisory naming affected and fixed versions when the patch ships.
7. **Verify the class is closed, not just the case.** Re-run the original
   reproduction and its obvious variants, then land a regression test so the same
   bug cannot quietly return two releases later.

## Signals

- Does every open report carry a CVSS vector, an owner, and a due date?
- Is any Critical past its 7-day window with no explicit escalation on record?
- Could you produce the advisory and CVE for the last vulnerability you shipped
  a fix for?

## Boundaries

CVSS rates technical severity, not business impact: a low-scored bug on a
crown-jewel system can still deserve the front of the queue, and that call is
human. Legal and communications own the public wording of a major incident.
This skill gets the fix scheduled and the facts straight.