CVE Prioritization Report

Overview

This workflow ranks the vulnerabilities discovered by External Attack Surface Management (EASM) by how dangerous they are and how likely they are to be exploited, then produces a prioritized remediation report. It pulls the CVEs found on the organization's external-facing assets, enriches each one with Zynap's proprietary Threat Intelligence (CVSS, EPSS, CISA KEV status, public-exploit availability, associated threat actors, and remediation status), applies a transparent two-dimension scoring model inspired by CISA's SSVC decision methodology, and renders a self-contained HTML report that tells security teams exactly what to fix first.

How It Works

EASM Vulnerability Retrieval: An Integration Node (easm-api / getCves) queries the External Attack Surface Management system to retrieve every CVE identified on the organization's external-facing assets, producing the raw list of exposures to triage.
CVE Extraction: A Scripting Agent Node parses the EASM response and normalizes it into a structured list of CVE findings ready for enrichment.
Per-CVE Threat Intelligence Enrichment: A Loop Node iterates over every discovered CVE. For each item:
- A Scripting Agent Node isolates the CVE identifier for the current iteration.
- An Integration Node queries Zynap's proprietary Threat Intelligence CVE service (cves-v2 / vulnerability / get) to enrich the CVE with its CVSS scores (all available versions), EPSS exploitation probability, CISA KEV membership, public-exploit availability, attributed threat actors, and patch / mitigation status.
- The enriched record is returned to the loop and accumulated until every CVE has been processed.
Dataset Consolidation: Once the loop completes, a Script Node merges the enriched per-CVE results into a single normalized dataset suitable for scoring.
Prioritization Scoring: A Script Node applies the scoring model (see How the prioritization score is calculated below) to each CVE, producing a 0–100 priority score, a priority tier, and a fully itemized breakdown, then ranks all findings highest-priority first.
Report Generation: A Script Node renders a styled, self-contained HTML remediation report — a tier-ordered summary table plus per-CVE cards showing the score breakdown, the exploitation-evidence stage, threat-actor attribution, and remediation status — so the ranking is fully explainable.

How the prioritization score is calculated

Each CVE is scored out of 100 on two independent dimensions that sum to the final score. The design deliberately avoids a flat weighted sum of correlated signals: rather than counting confirmed exploitation four separate times (once each for KEV, threat actors, public exploits, and EPSS), those signals are collapsed into a single saturating dimension, following the spirit of CISA's SSVC model. This keeps impact and exploitation in balance and prevents any one CVE from double-counting the same underlying fact.

Dimension 1 — CVSS Severity (0–40 pts). Linear on the CVSS base score (cvss / 10 × 40), taken from the newest available CVSS version (v4 > v3 > v2), because scores from different CVSS versions are not directly comparable. This dimension answers "how severe is the flaw rated?"

Dimension 2 — Exploitation Evidence (0–60 pts). A single saturating ladder that answers "how real and how active is exploitation?" The strongest available piece of evidence sets the stage; corroborating signals (EPSS probability and threat-actor count) only refine the position within that stage's band — they never stack past the ceiling:

Stage	Points band	Triggered when
None	0	No exploitation evidence at all
PoC	6–21	Some EPSS probability (≥ 0.10) but nothing weaponized
Weaponized	24–39	A ready-to-run public exploit exists
Active	45–60	Confirmed active exploitation — on CISA KEV or used by named threat actors

CISA KEV and threat-actor usage are both treated as "confirmed active exploitation", so they reinforce to the same top stage (a maximum, not a sum). A CVE actively used by threat actors but not yet listed on KEV still lands in Active, and a KEV CVE with no attributed actors also lands in Active. Within a stage, EPSS and the threat-actor count position the score toward the ceiling; the threat-actor count follows a diminishing-returns curve that reaches its maximum contribution at 15 actors.

Priority tiers. The final score maps to a tier: CRITICAL (≥ 80), HIGH (≥ 60), MEDIUM (≥ 40), LOW (≥ 20), or INFORMATIONAL (below 20).

Exploitation-stage tier floors. Because confirmed or ready exploitation must never be under-ranked simply because a CVE's severity score is modest, some stages floor the final tier regardless of the numeric score — mirroring CISA KEV's "patch regardless of CVSS" mandate:

Active exploitation floors the priority at HIGH.
Weaponized exploitation floors the priority at MEDIUM.

Findings are then ranked by tier first and score second, so a floored finding always sits above a lower-tier one. Patch / mitigation availability is reported for context only and never affects the score.

Who is this for?

Vulnerability management teams triaging externally-exposed CVEs discovered by EASM
Security operations teams needing an explainable, threat-informed remediation order rather than a raw CVSS list
Threat intelligence analysts correlating external exposures with active exploitation and threat-actor activity
CISOs and security leadership requiring clear, evidence-backed reports on which external vulnerabilities demand immediate action
Risk and compliance professionals documenting how external vulnerabilities are prioritized and why

What problem does this workflow solve?

Turns a flat, unordered list of EASM-discovered CVEs into a defensible remediation priority, so teams fix what attackers are most likely to exploit first
Automatically enriches every finding with proprietary Threat Intelligence (CVSS, EPSS, CISA KEV, public exploits, threat actors, patch status), eliminating manual cross-referencing across multiple sources
Prevents the double-counting and impact-blindness of naive weighted-sum scoring by modeling exploitation evidence as a single saturating dimension in the spirit of CISA SSVC
Ensures confirmed or ready-to-use exploitation can never be buried by a modest CVSS score, through exploitation-stage tier floors
Delivers a fully explainable HTML report — with per-CVE score breakdowns, exploitation stages, and threat-actor attribution — that stakeholders can act on and auditors can trust

Updated: 2026-07-24