Exposure Response Filters

The expected impact of the affected asset's information confidentiality loss. Choose from High, Low, or None. For example, an affected asset with High may have a catastrophic adverse effect on your organization or customers.

Whether a vulnerability allows attackers to compromise resources beyond an affected asset's normal authorization privileges. Choose from Unchanged or Changed. Changed means the vulnerability increases the affected asset's privileges.

Whether a vulnerability requires other users (such as end users) for attackers to be able to use it. Choose from Required or None. None is more severe since it means that no additional user interaction is required.

The conditions beyond the attacker's control that must exist to exploit the vulnerability.

The resources, access, or specialized conditions required for an attacker to exploit the vulnerability.

The context where vulnerability exploitation is possible, such as Network or Local.

A numeric value between 0.0 and 10.0 that represents the intrinsic characteristics of a vulnerability independent of any specific environment.

The level of privileges an attacker must possess to exploit the vulnerability.

The impact on the availability of systems that can be impacted after the vulnerable system is exploited.

The impact on the confidentiality of systems that can be impacted after the vulnerable system is exploited.

The impact on the integrity of systems that can be impacted after the vulnerable system is exploited.

The level of user involvement required for an attacker to exploit the vulnerability.

The impact on the availability of the vulnerable system when successfully exploited.

The impact on the confidentiality of the vulnerable system when successfully exploited.

The impact on the integrity of the vulnerable system when successfully exploited.

The percentage likelihood that a vulnerability will be exploited, based on the third-party Exploit Prediction Scoring System (EPSS). Type a number from

0 to 100 with up to three decimal places, for example, 75.599.

The exploit maturity based on sophistication and availability. This information is drawn from Tenable’s own research as well as key external sources. Options are High, Functional, PoC, or Unproven.

The date the vulnerability corresponding to a finding was first identified.

The date a vulnerability was first known to be exploited.

The date a vulnerability's first proof of concept was found.

If a vulnerability currently has a Tenable plugin that detects it. Options are Yes or No.

The ID of the Tenable plugin that detected the vulnerability, for example 157288. To look up plugin IDs, go to the Tenable website.

The name of the Tenable plugin that detected the vulnerability, for example TLS Version 1.1 Protocol Deprecated.

The Tenable-calculated Vulnerability Priority Rating (VPR) score, as a number from 1 to 10.

The numerical VPR (Beta) score itself. Allows filtering by specific ranges or values of the updated vulnerability priority rating.

Filter on a specific CVE ID for the CVE that is a primary contributor to the calculated VPR (Beta) score for a vulnerability.

Allows filtering on CVEs that are part of an exploit chain.

Filter on current availability and maturity of exploit code. Options are High, Functional, POC, and Unproven.

Filter on the probability of exploitation produced by the VPR (Beta) threat model for the CVE.

Filter on the probability of exploitation produced by the VPR (Beta) threat model for the CVE.

Filter on categories of news sources that have referenced the CVE within the last 30 days. Select from one or more of Academic and Research Institutions, Blogs and Individual Researchers, Code Repositories, Cybersecurity News Media, Cybersecurity Vendors, Forums and Community Platforms, Government and Regulatory, Mainstream News and Media, Security Research, Technology Companies, Tools and Resources, Other.

Filter on the volume of observed malware exploiting the CVE within the last 30 days. Options are Very Low, Low, Medium, High, Very High.

Filter on the recency of observed malware exploiting the CVE. Options are No Recorded Events, 60 to 180 days, 30 to 60 days, 14 to 30 days, 7 to 14 days, 0 to 7 days.

Filter on whether the CVE is listed on the CISA Known Exploited Vulnerabilities list. Options are Yes, No.

Allows filtering on specific industries where attacks leveraging the CVE have been observed. Sample options include Banking, Technology, Government.

Allows filtering on specific geographic regions where attacks leveraging the CVE have been observed.

Filter on the VPR (Beta) score percentile ranking of the CVE, indicating its position relative to other vulnerabilities.

Yes - This vulnerability was originally identified as a zero-day vulnerability. This value displays Yes even if a fix was made available after the vulnerability was publicized.

No - This vulnerability has a publicly available fix that existed before the vulnerability was publicly disclosed or known to be exploited.