Field Notes
Why a high can outrank a critical
Two findings land in the queue on the same morning.
The first is a CVSS 9.1. It isn't on CISA's Known Exploited Vulnerabilities list, its EPSS score is 0.004, and it sits on a segmented test box.
The second is a CVSS 7.5. It's on KEV, and it sits on an internet-facing system that production depends on.
Sort by CVSS and the 9.1 goes first. Sort by what can hurt you and the 7.5 does, because attackers are using it and they can reach it.
Most people agree once they see the two side by side. Agreeing is the easy part. A team needs a rule it can apply to every finding without holding a debate on each one. The method I use does it in two stages.
Stage 1: the gate
A finding goes straight to P1 when two things are true together. It is exploited, which means it's on KEV, otherwise known to be exploited, or carries an EPSS score of 0.90 or higher. And the system it's on faces the internet.
The 7.5 passes both tests, so it never gets a score. It's a P1, due in 24 hours.
Exploitation alone doesn't pass the gate. The same KEV flaw on a host the internet can't reach is still serious, and the second stage treats it that way, but it isn't the same emergency.
Stage 2: the score
Everything else gets a composite score: severity × exploit likelihood × asset criticality × exposure, each rated 1 to 4.
For the 9.1, severity is 4, the top of the scale. Exploit likelihood is 1, because the EPSS score is under 0.01 and nobody is known to be using the flaw. Asset criticality is 1 for a non-production system. Exposure is 2 for a segmented network. That's 4 × 1 × 1 × 2 = 8, out of a possible 256, which makes it a P4, due in 180 days.
The factors are multiplied so that one low factor pulls the whole score down. Add them up instead and the 9.1 on a test box lands next to findings that can hurt you.
The 9.1 still gets a deadline
CVSS stays in the method. Severity is one of the four factors, and a critical on an exposed production system scores high on all of them. The 9.1 here still has an owner and a date. It just stops jumping ahead of the finding that's being exploited.
The whole method is published at flintscope.com/method, with every threshold and more worked examples. It's CC BY, so you can cite it, copy it into your own policy, or argue with it.