This week’s most important technical learning for me (so far) was that there is a big difference between the severity of a vulnerability and its exploitability. The general press often seems to make no difference between the two, which leads to a lot of initial hysteria and often to a subsequent non-event, which is then, of course, not reported. In the past two weeks, several vulnerabilities were published with a high severity score, which caught a lot of media attention. But their exploitability ‘seems’ to have been nowhere near what their severity score suggested.
Let’s have a look at a rather good example, CVE-2026-99999, a vulnerability much hyped for a day because of its severity rating and potential impact if it could be easily exploited remotely. After all, the vulnerability would enable a Virtual Machine escape and host compromise. Sounds bad, doesn’t it?
I was alarmed as well when the news broke, and wanted to patch my bare metal hosts as soon as possible. Debian provided an immediate patch, Red Hat provided an immediate patch, but Canonical didn’t. Two weeks later, and Canonical still has no patch available for Ubuntu for CVE-2026-9999, which is rated 9.3 on the CVSS 3 severity scale. How come!?
The screenshot above gives the answer. While its severity is rated close to the top of the scale, Canonical has come to the conclusion that it is not likely that the vulnerability can be exploited easily. Therefore, Canonical rates the exploitability as ‘medium‘. Others such as Debian and Red Had have come to slightly different (initial) conclusions concerning its exploitability and have provided patches sooner.
So Canonical comes to the conclusion that despite the high severity score, the situation it is ‘not so bad’. Hence, they have not yet provided a patch and have given other things a higher priority to be worked on. Is this good or bad? Hard to say. The best answer I came up with for myself is that according to KEV databases (Known Exploited Vulnerabilities), the vulnerability is not yet actively exploited in the wild and hence I can still sleep easy. For example, there is no entry for this vulnerability yet in the EU’s KEV database at the time of this writing. Also, the prediction of how likely it is that this will be exploited in the next 30 days in the screenshot above is only 0.79%.
Perhaps the following two definitions help:
- Severity: If this vulnerability could be exploited, how bad would the impact be?
- Exploitability: How easy is it to exploit this remotely? The catch: At the beginning, this is a matter of judgement. While no exploit is available, it’s anyone’s best guess of how long it might take before someone finds out a way to exploit this remotely. Different companies come to different conclusions.
So, the main takeaway here is to carefully read a press report about a vulnerability and evaluate if it contains information about severity and exploitability at the time of publication and, if not instantly exploitable, how long it might potentially take before a vulnerability becomes exploitable. If one of these things is missing, the article is just hype and worthless as an indicator of how fast one should act.