Every week vendors publish dozens of security advisories. If you run a small network, with a firewall, a NAS, a few switches and a couple of servers, you don't have time to install every update the day it comes out. The real question is not "what is vulnerable?" but "what should I fix first?".
This guide walks through a three-question method, the same one PatchRadar uses to rank advisories.
1. Is it already being exploited?
This is the most important question. A vulnerability that attackers are already using is a concrete threat, not a theoretical one: there are often automated tools scanning the whole Internet for vulnerable devices.
The most widely used reference is the Known Exploited Vulnerabilities (KEV) catalog from CISA, the US cybersecurity agency. It only lists vulnerabilities with evidence of real-world exploitation and, for each one, a due date by which US federal agencies must fix it. It doesn't apply to private companies, but it is a great yardstick: if CISA gives a government agency two or three weeks, you shouldn't take longer.
There are also statistical estimates such as EPSS (Exploit Prediction Scoring System, from FIRST), which estimates the probability that a vulnerability will be exploited in the next 30 days. It helps when there are many advisories, but a vulnerability that is already exploited still comes before one that is "likely to be exploited".
2. Can the device be reached from the Internet?
The same vulnerability weighs very differently depending on where the device sits:
| Where it sits | Examples | Priority |
|---|---|---|
| Exposed to the Internet | SSL VPN, remote access portal, firewall management interface, NAS with an open port | Highest |
| Reachable by many internal users | Mail server, business applications, Wi‑Fi controller | High |
| Isolated in a management network | Switches and appliances reachable only from a dedicated VLAN | Normal |
Most successful attacks on firewalls and NAS devices in recent years have hit exactly that: management interfaces and VPNs exposed to the Internet. Reducing exposure therefore protects you against tomorrow's vulnerabilities too.
3. How severe is it according to CVSS?
The CVSS score (0 to 10) measures the technical severity of a vulnerability: how easy it is to exploit and how much damage it can do. The ranges used in version 3 are:
- Critical: 9.0 to 10
- High: 7.0 to 8.9
- Medium: 4.0 to 6.9
- Low: 0.1 to 3.9
CVSS is useful for sorting advisories, but on its own it misleads: it measures severity "in the abstract", not the risk to your network. A medium vulnerability that is already exploited on an exposed VPN is more urgent than a critical one in a service you don't use or that nobody can reach.
Putting it together
Combining the three answers gives a simple order:
- Exploited and exposed to the Internet: fix it now, even out of hours. If no update is available, apply the vendor's mitigations or temporarily turn the service off.
- Exploited but internal, or critical and exposed: within a few days.
- High or critical on internal systems: in the next scheduled maintenance window.
- Everything else: with your regular updates.
How PatchRadar helps
On the All advisories page you can filter by vendor, product and version and sort by Priority: exploited vulnerabilities first, then by severity and date.