When CVE-2023-23397 (Microsoft Outlook EoP) was disclosed, attackers had already exploited it for months. Understanding the vulnerability lifecycle—from discovery to exploit to patch—is crucial for prioritizing defenses. This lesson teaches you to model risk using CVSS, EPSS, and KEV, and to design a patch management process that minimizes the window between disclosure and remediation.
A vulnerability is born when a flaw is introduced. Discovery can happen internally (vendor) or externally (researcher). Responsible disclosure gives the vendor time to patch before public release. A zero-day is a vulnerability that is actively exploited before a patch is available. The window of exposure (WOE) is the time between public disclosure and patch deployment on your systems. Your goal: shrink the WOE to as close to zero as possible.
# Example: query NVD API for a specific CVE
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2023-23397" | jq '.vulnerabilities[0].cve.metrics.cvssMetricV31[0].cvssData'The output shows the CVSS base score and vector, helping you understand severity. But severity alone doesn't indicate exploitability in the wild.
CVSS measures inherent severity (0-10). EPSS (Exploit Prediction Scoring System) predicts the probability of exploitation in the next 30 days. CISA's Known Exploited Vulnerabilities (KEV) catalog lists vulns actively exploited. A CVE with high CVSS, high EPSS, and on the KEV must be patched immediately. Patch all KEV items within mandated timelines; prioritize high EPSS for others. This data-driven approach prevents patch-anything-everything fatigue.
| Score/Rating | Meaning | Action |
|---|---|---|
| CVSS 9.0+ | Critical severity | High priority |
| CVSS 7.0-8.9 | High severity | Schedule within SLA |
| EPSS >0.5 | >50% chance of exploitation in 30 days | Treat as imminent |
| On KEV | Actively exploited | Patch immediately per CISA BOD 22-01 |
When a zero-day is announced but no patch exists, mitigation is key. Apply workarounds: disable vulnerable services, use firewall rules to block exploit traffic, enable exploit protection features (EMET, ASR rules), and increase monitoring. Attack surface reduction and privilege management become your primary defenses. Ensure your incident response plan includes a zero-day procedure.
⚠️ The average time-to-exploit for critical vulnerabilities has dropped to under 15 days. If your patching cycle is monthly, you are exposed for weeks. Consider more frequent, automated patch deployment.
Verify exercises to earn ★ 150 XP and unlock next lab level.