Sipping From the CVE Firehose - Prioritizing Emerging Threats for Real-World Impact

Nate Robb presents the workflow used by an emerging-threats team at an attack surface management firm to triage newly published vulnerabilities. With tens of thousands of CVEs released each year, the team needs a way to discard the many that cannot scale across internet-facing systems and to move quickly on the few that can. He outlines how advisories are gathered, how CVE records are coordinated and enriched, and how CVSS, CISA's exploited-vulnerabilities catalog and EPSS fit into the picture.

The core argument is that CVSS measures technical severity but not real-world reach. Robb walks through curl reports where scores looked inflated given edge-case configuration or rarity, and an appliance flaw that scored highly yet had very few internet-facing instances. He then lists filters the team applies: authentication requirements, user interaction, denial-of-service-only impact and local-only access are generally dropped, while common enterprise software, remote code execution, public proof-of-concept code, in-the-wild exploitation and default configurations raise priority. Shodan, BinaryEdge and fingerprinting tools support the exposure checks.

Two case studies test the method. An Apache Tomcat flaw drew heavy coverage but needed several non-default settings, so it was rated low threat despite a public proof of concept and a KEV listing. The React Server Components remote code execution flaw met every criterion, with default configuration, pre-auth RCE, wide framework use and heavy exploitation, and was rated critical. The takeaway is to combine severity with exposure and exploitation evidence before deciding how fast to act.