1 min read
How we triage critical CVEs for clients
A look at Qutzl’s patch priority process when a core product vulnerability hits the news.
Not every CVE deserves an all-hands page. Critical, internet-facing, weaponized flaws do.
Our rough triage
- Exposure: Is the product reachable from the internet?
- Privilege: Does exploit yield RCE or auth bypass?
- Exploit status: PoC or active abuse?
- Compensating controls: WAF, offline, network isolation?
- Blast radius: How many client sites/devices?
Communication
We prefer short, actionable notices over CVE theater: what is affected, what we are doing, what we need from you.
If you want that kind of coverage for your stack, talk to us.