# Vulnerability Management

> Vulnerability identification, assessment, and remediation tracking. Use when managing security vulnerabilities across the organization.

- Skill: `saolalab/vulnerability-management` (Agent Skill)
- Install (CLI): `npx skillmds@latest add saolalab/vulnerability-management`
- Raw SKILL.md: https://api.skillmd.com/api/skills/saolalab/vulnerability-management/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: saolalab (https://skillmd.com/u/saolalab)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/saolalab/vulnerability-management

---


# Vulnerability Management

## Vulnerability Lifecycle

```
Discovery → Assessment → Prioritization → Remediation → Verification → Closure
```

## CVSS Scoring Guide

### Severity Levels

| CVSS Score | Severity | Remediation SLA |
|------------|----------|-----------------|
| 9.0 - 10.0 | Critical | 24-72 hours |
| 7.0 - 8.9 | High | 7 days |
| 4.0 - 6.9 | Medium | 30 days |
| 0.1 - 3.9 | Low | 90 days |

### Key CVSS Factors

- **Attack Vector** — Network, Adjacent, Local, Physical
- **Attack Complexity** — Low, High
- **Privileges Required** — None, Low, High
- **User Interaction** — None, Required
- **Scope** — Unchanged, Changed
- **Impact** — Confidentiality, Integrity, Availability

## Vulnerability Report Template

```markdown
## Vulnerability Report

### Summary
- **ID**: [CVE-XXXX-XXXXX or internal ID]
- **Title**: [Brief description]
- **Severity**: [Critical/High/Medium/Low]
- **CVSS**: [Score and vector]
- **Status**: [Open/In Progress/Remediated/Verified]

### Affected Assets
- [List affected systems, applications, versions]

### Technical Details
- **Vulnerability Type**: [SQLi, XSS, RCE, etc.]
- **Root Cause**: [Technical explanation]
- **Proof of Concept**: [Steps to reproduce]

### Impact Analysis
- **Confidentiality**: [Impact description]
- **Integrity**: [Impact description]
- **Availability**: [Impact description]
- **Business Impact**: [Business context]

### Remediation
- **Recommended Fix**: [Technical solution]
- **Workaround**: [Temporary mitigation if available]
- **Owner**: [Person responsible]
- **Due Date**: [Based on severity SLA]

### References
- [CVE link, vendor advisory, etc.]
```

## Scanning Cadence

| Scan Type | Frequency | Scope |
|-----------|-----------|-------|
| External | Weekly | Internet-facing assets |
| Internal | Bi-weekly | Internal network |
| Container | On build | All container images |
| Dependencies | On commit | All code repos |
| Web App | Monthly | Production apps |

## Prioritization Matrix

Consider these factors beyond CVSS:

1. **Asset criticality** — Crown jewels get higher priority
2. **Exposure** — Internet-facing vs. internal
3. **Exploitability** — Active exploitation in the wild
4. **Data sensitivity** — PII, financial, health data
5. **Compensating controls** — WAF, network segmentation

## Metrics to Track

- **Mean Time to Remediate (MTTR)** — By severity
- **Vulnerability Age** — Days open by severity
- **Open Vulnerability Count** — Trend over time
- **SLA Compliance** — % remediated within SLA
- **Recurrence Rate** — Same vuln types reappearing