Severity levels
Every finding XBOW reports has a severity: Critical, High, Medium, Low, or Informational. Severity describes how serious a weakness is in technical terms, and it helps you decide which findings to fix first. XBOW sets severity from the Common Vulnerability Scoring System (CVSS).
How severity is set
A finding’s severity comes from its CVSS score, using the standard qualitative ratings defined by FIRST. XBOW shows FIRST’s None rating (0.0) as Informational:
| CVSS score | Severity |
|---|---|
| 9.0–10.0 | Critical |
| 7.0–8.9 | High |
| 4.0–6.9 | Medium |
| 0.1–3.9 | Low |
| 0.0 | Informational |
You can change a finding’s severity if your assessment differs from XBOW’s. For a finding with a CVSS score, edit the score and the severity updates to match. For a finding without one, set the severity directly.
For more about CVSS, see the CVSS v3.1 specification from FIRST. For the vulnerability classes XBOW reports and how they map to CWEs, see Vulnerability classification.
What each severity means
Read the description and impact for each finding, because individual findings vary. Use the table as general context only; it does not establish requirements or remediation deadlines.
Some compliance frameworks set fixed limits. For example, PCI DSS requires security patches for critical and high-risk vulnerabilities within one month of the patch’s release.
For guidance on handling urgent and routine fixes differently, see NIST SP 800-40 Revision 4. Set your own timeframes in line with your vulnerability management and change management policies, and with any compliance obligations you have.
| Severity | Typical characteristics | Typical remediation approach |
|---|---|---|
| Critical | Few or no obstacles to exploitation, such as a network-reachable weakness that needs no login or user action. Successful exploitation has a severe impact on the confidentiality, integrity, or availability of data or systems. | Treat these findings as the highest priority. Address them first and release fixes outside the standard release cycle. |
| High | Exploitation is realistic and the impact is serious, but it may need a condition such as a low-privilege account or a user action. | A high priority, usually scheduled soon after any Critical findings. If your next release is not soon, consider an out-of-cycle patch release. |
| Medium | Exploitation needs specific conditions, such as an advanced technique, a privileged account, or a secondary weakness, or the impact is limited. | Usually scheduled as part of the standard release cycle. |
| Low | Exploitation is difficult, or the impact is minimal. | Usually scheduled as capacity allows. Business factors, such as how long the asset will remain in service, may delay or remove the need to fix it. |
| Informational | A potential issue or unusual configuration that XBOW did not confirm as exploitable. It may reveal information that helps an attacker plan or refine an attack. | Usually addressed after validated findings. Addressing it can make the attacker’s reconnaissance (information gathering) harder. |
Adjust priority for your context
Severity is a starting point for prioritization. Raise or lower a finding’s priority based on context that may not be fully reflected in its CVSS score:
- Known exploitation: If a vulnerability is being exploited in the wild, fix it sooner regardless of severity. For a list of vulnerabilities with evidence of active exploitation, see the CISA Known Exploited Vulnerabilities catalog.
- Exposure: A weakness on an internet-facing asset is more urgent than the same weakness on an asset that few people can reach.
- Data sensitivity: Findings on assets that handle sensitive data or critical business functions usually warrant faster action.
- Compensating controls: Existing safeguards that block exploitation, such as a web application firewall, may justify a longer timeframe. Record the reasoning in the finding’s Notes field.
When you fix a finding, or decide it is intended behavior, mark it “Fixed” or “Intended” so the asset’s risk score reflects your current exposure. To mark a finding, see Explore and fix XBOW results. For how status affects the score, see Risk score.