Triage a CVE properly

A ticket arrives with an identifier and nothing else. CVSS already answered “how bad is it”, badly. The real question is do we act now, and how do I justify either answer.

1. What is true

Look up CVE-2021-44228. Is it in KEV, what is the EPSS score, and what is the SSVC decision?

vulnetix_vuln returns, among ~10 KB:

{
  "id": "CVE-2021-44228",
  "kev": {
    "vendorProject": "Apache",
    "product": "Log4j2",
    "dueDate": "2021-12-24T00:00:00Z",
    "knownRansomware": "Known",
    "requiredAction": "For all affected software assets..."
  },
  "epss": { "score": 0.99999, "percentile": 1.0 },
  "ssvc": { "decision": "Act", "priority": "immediate", "automatable": "YES" },
  "exploitationMaturity": { "level": "ACTIVE" },
  "affectedRoutines": [ "..." ],
  "affected": { "total": 676 }
}

Four independent signals agreeing: a binding CISA deadline, near-certain exploitation probability, an SSVC decision of Act, and known ransomware use. That is evidence, not a severity label.

2. Is it being exploited, or just exploitable

Is it being exploited?

vulnetix_exploits:

{
  "exploitCount": 19868,
  "activeSources": [
    { "source": "poc", "count": 15259 },
    { "source": "crowdSec", "count": 101 },
    { "source": "nmapNse", "count": 70 }
  ]
}

Then vulnetix_sightings for whether that is history or current:

{ "count": 2568, "lastObservation": "2026-08-08T00:00:00Z", "daysSinceLastSeen": 2 }

Seen two days ago. Five years after disclosure.

3. How fast does this class move

How long did it take to be weaponised?

vulnetix_timeline:

"meta": {
  "publicationToFirstExploitDays": 20,
  "lifecycleStage": "LEGACY",
  "insights": ["Exploit published within 1 month", "Patches available in 986 versions"]
}

Twenty days from disclosure to a public exploit. That is the sentence to put in front of whoever is asking for a two-week deferral.

4. Does it reach your code

Tools cannot answer this, because it is your repository. affectedRoutines from step 1 gives you what to look for, and the local workflow does the rest:

/mcp__vulnetix__vulnetix_vuln CVE-2021-44228

The prompt cross-references your lockfiles and, with the CLI installed, runs a tree-sitter reachability scan, a real AST pass over your project instead of a heuristic. reachability.direct and .transitive are authoritative when present.

5. Decide, with the reasoning attached

On Pro and above:

{
  "identifier": "CVE-2021-44228",
  "context": "internal batch service, no untrusted input, Java 8, behind a WAF"
}

vulnetix_triage_reason returns a priority band, the rationale, the dominant factors, and what would change the answer. That last one is what makes the decision reviewable instead of an opinion.

On Community you get the same inputs and reason it through yourself; the tool returns the data and says the analysis was tier-gated.

6. Fix and verify

What is the remediation plan, and which action first?

vulnetix_remediation returns 37 ranked actions with concrete steps, effort and impact ratings, distribution patches and registry fixes.

Then locally:

/mcp__vulnetix__vulnetix_fix CVE-2021-44228
/mcp__vulnetix__vulnetix_verify_fix CVE-2021-44228

verify_fix re-scans and gates on the result, writing the verdict to .vulnetix/memory.yaml so the decision survives the conversation.

If you cannot patch

Is there a workaround, and can I detect exploitation meanwhile?

vulnetix_workarounds for mitigations that need no patch. vulnetix_detection_rules for deployable Snort, YARA and Nuclei content. The rules come back whole, because you cannot deploy a description.

The whole thing as one prompt

/mcp__vulnetix__vulnetix_vuln CVE-2021-44228

The prompt runs this sequence with the thresholds and the CWSS scoring already written. Use the tools directly when you want one specific fact; use the prompt when you want the procedure.