Triage reachability and impact

A vulnerability identifier is the start of investigation. Product context determines urgency and containment.

Verify the installed version and whether the affected function reaches production. Consider attacker prerequisites and worst credible impact. Patch high-impact reachable paths quickly, but continue tracking lower-risk findings with evidence and deadlines.

A critical advisory affects an XML parser used only by a local documentation command. Another medium advisory affects an internet-facing parser running with database access. Severity alone would rank them in the wrong operational order.

Reachability evidence can justify priority, but it can become an excuse to postpone patches forever. Give every accepted delay an owner and review date.

Triage one real advisory by recording the installed version, vulnerable function, runtime path, attacker prerequisites, privileges, data exposure, and fix. Save evidence for each conclusion. Then force the vulnerable feature into a test build or disable the suspected call path and verify whether the reachability conclusion changes.