Prioritise an RCE finding from exploit maturity, authentication needed, network exposure, patch status and lateral movement potential.
Exploit maturity and the authentication barrier dominate likelihood, because a weaponised unauthenticated exploit on an internet-facing host is being scanned for within hours of disclosure. Impact pairs the value of the host with what an attacker can reach from it, since RCE is rarely the objective — it is the foothold. Patch queues are always longer than the maintenance window, so an RCE list ordered by exposure and lateral movement fixes the ones that actually end in a breach first.
Remote Code Execution Risk
Likelihood = mean(vector, exploit maturity, authentication needed, network exposure, patch status); impact = mean(asset criticality, lateral movement potential).
Likelihood = mean(vector, exploit maturity, authentication needed, network exposure, patch status); impact = mean(asset criticality, lateral movement potential). Exploit maturity and the authentication barrier dominate likelihood, because a weaponised unauthenticated exploit on an internet-facing host is being scanned for within hours of disclosure. Impact pairs the value of the host with what an attacker can reach from it, since RCE is rarely the objective — it is the foothold.
Patch queues are always longer than the maintenance window, so an RCE list ordered by exposure and lateral movement fixes the ones that actually end in a breach first.
This calculator takes 7 inputs: RCE vector, Public exploit maturity, Authentication required to reach the sink, Network exposure, Patch or mitigation status, Asset criticality, Lateral movement potential from the host. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
A virtual patch blocks the exploit shapes you know about at the edge, which buys days, not safety: request smuggling, alternate encodings and any internal path that skips the WAF all get through. It scores 6 rather than 1 because the vulnerable code is still there.