How should security teams decide between patching a critical flaw and remediating a known exploited vulnerability?

Why exploited vulnerabilities usually outrank a generic critical flaw

Severity tells you how bad a flaw could be in the abstract, but exploitation tells you how urgent it is in your environment right now. A critical rating is only one input; a known exploited vulnerability already has evidence of active abuse, so it can represent a more immediate path to compromise than a higher-scoring issue that no attacker is using today. That is why prioritisation should start with exposure and exploitability, not the label alone.

When a vulnerability is in the wild and already on the CISA Known Exploited Vulnerabilities catalogue, the decision shifts from theoretical risk to confirmed adversary behaviour. The CISA Known Exploited Vulnerabilities Catalog is the clearest public signal that a flaw has crossed that line, while the NIST National Vulnerability Database is better used to understand the broader record, affected products and severity context around the issue.

That distinction matters because patch queues are finite. A team that treats every critical finding as equal can spend its fastest response window on the wrong issue, leaving a known exploit path open. The real prioritisation question is whether the flaw is reachable, exposed and already being used by attackers, because that combination changes the probability of compromise much more than severity language alone.

How to choose when both issues affect the same environment

Start by asking which issue gives an attacker the shortest path to meaningful access. If the exploited vulnerability is reachable in your asset set, especially on internet-facing systems or high-value services, it generally deserves first attention even if another flaw has a higher severity score. If the critical flaw is not exposed, not reachable, or not in an actively exploited class, it may be the lower-priority item for immediate action.

Use practical signals, not just CVSS. Prioritisation should weigh exposure, exploit activity, asset criticality, compensating controls and whether the vulnerable component can be hit remotely. The FIRST EPSS model can help estimate exploitation likelihood, while the Vulnerability Management Guide is useful for turning those signals into a repeatable triage process with SLAs, exceptions and verification.

Where the two issues are close in risk, rank them by blast radius. A moderately severe flaw on a system that stores credentials, supports authentication, or fronts a critical business flow may matter more than a more severe bug on a low-value internal tool. The point is not to ignore severity, but to subordinate it to realistic compromise pathways and operational consequence.

What to do when patching cannot happen immediately

If you cannot patch the exploited vulnerability right away, treat it as a containment problem first. Reduce exposure by disabling the vulnerable feature, restricting network reachability, tightening access paths, adding detection coverage and applying any vendor mitigation or compensating control that truly breaks the attack path. Temporary controls should be specific to the exploit route, not generic comfort measures.

This is also where speed matters most. Use the vendor advisory and the CISA KEV entry for authoritative remediation guidance, then verify whether the vulnerable asset is actually present in your estate before you assume the problem is closed. The CISA cyber threat advisories page is a practical companion for understanding the threat context around urgent remediation decisions.

After mitigation, search for signs of earlier compromise. If exploitation was already possible, you should assume the attacker may have attempted access even if no alert fired. Look for unusual authentication events, unexpected new accounts, changed configurations, suspicious outbound connections, and evidence that secrets or sessions were accessed through the vulnerable component.

Risk and Threat Considerations

An unpatched exploited vulnerability creates immediate exposure because it combines known weakness with known attacker interest. The risk is not only initial compromise, but also follow-on access, credential theft, lateral movement and persistence if the attacker reaches a system before remediation lands.

Failure mechanism: Attackers exploit a reachable flaw before defenders patch it, then use that foothold to collect credentials, tamper with systems or pivot deeper into the environment.

Impact: The organisation can move from vulnerability exposure to confirmed compromise in the time it takes to work through a normal patch cycle, especially on externally reachable assets.

Practitioner Guidance

What to prioritise: Put confirmed exploitation ahead of abstract severity unless the critical flaw is the only reachable, weaponisable path into a high-value environment. The highest score is not always the highest risk.

Decision rule: If one issue is on the KEV catalogue and the other is only a generic critical finding, default to the exploited item first unless you can show the critical flaw is more immediately reachable and more damaging in your environment.

What to verify: Confirm asset presence, internet exposure, compensating controls and whether the issue affects a production path that can be used today. If you cannot prove exposure is absent, assume it may still matter.

Practitioner takeaway: Use severity as a sorting aid, but use exploitation evidence to make the final call, because remediation priority should track real attacker opportunity, not just headline score.

Related resources from NHI Mgmt Group

• How should security teams decide between patching a file-share flaw and remediating the data stored on it?
• How should security teams handle patching when a critical vulnerability creates a choice between downtime and ransomware exposure?
• What is the difference between patching a vulnerability and reducing identity blast radius?
• How do security teams know whether a control-plane auth flaw was exploited before patching?