vuln-research

To assess if a CVE is exploitable, map the vulnerable code path to your runtime usage to determine reachability, check CISA KEV and EPSS scores for active exploitation signals, and confirm affected versions against your deployed dependencies. This yields a structured assessment with an actionable remediation decision.

Reachability analysis determines whether a vulnerable code path in a dependency is actually executed through your product's runtime paths. It classifies exposure as direct, indirect, not reachable, or unknown, helping you decide whether to patch immediately, mitigate, or accept risk with re-evaluation.

Perform a CVE deep-dive by correlating canonical sources like NVD, vendor advisories, and GitHub advisories to confirm affected version ranges. Cross-reference patch commits and release notes to identify precise vulnerable versions, then check public PoCs and CISA KEV for exploitation urgency.

Yes, EPSS and CISA KEV data are integrated to prioritize patching by checking exploitation signals. EPSS scores estimate exploit probability while CISA KEV confirms active exploitation, allowing you to structure accept-risk decisions only with compensating controls and re-evaluation triggers.

Accept the risk of a high-severity CVE when reachability analysis shows the vulnerable code path is not reachable in your environment and exposure urgency is low. Structure accept-risk decisions with compensating controls like WAF filters, service segmentation, or added detection, and define re-evaluation triggers.

When a vulnerable dependency cannot be patched immediately, mitigation options include disabling affected features, deploying WAF or proxy filters, segmenting services, and adding detection mechanisms. These compensating controls reduce risk while you plan patching based on the structured vulnerability assessment.