Which Vulnerability Should Be Remediated First: Web Server RCE?
A company must manage the remediation of several vulnerabilities. To do so, a security engineer assesses how software is used in the organization and finds the following:
Which of the following vulnerabilities should the security engineer remediate first?
Community Insight
The exam tests prioritizing vulnerabilities by exploitability, exposure, and impact; the trap is choosing a technically severe-sounding flaw that is less exposed or requires more preconditions than a public-facing RCE.
This question tests vulnerability remediation prioritization by exposure, exploitability, and business impact. The page establishes that the web server remote code execution flaw should be fixed first because an internet-facing RCE is remotely exploitable and can lead to full host compromise.
A common mistake is selecting buffer overflow or CRM privilege escalation because it sounds technically severe, while overlooking that a publicly reachable web server RCE can be exploited remotely and grants host-level control.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Web server remote code execution is the highest-priority remediation because the affected service is typically internet-facing and reachable by unauthenticated attackers. An RCE flaw allows an attacker to execute arbitrary commands at the system level, take control of the host, move laterally, and deploy destructive payloads such as ransomware. The software-usage assessment in the exhibit is a prioritization input, but it does not reduce the severity of a remotely exploitable flaw on an externally exposed service. Given the choices, the combination of high exposure and full host compromise makes the web server RCE the first item to remediate.Why the Other Options Are Wrong
A buffer overflow can be severe, but its risk depends on the attack vector, whether the vulnerable code is remotely reachable, and whether exploit mitigations are present. The file transfer solution data leakage is primarily a confidentiality breach; serious, but it does not inherently give an attacker command execution or full host control. CRM privilege escalation is also significant, but it generally requires authenticated application access and has a narrower blast radius than an internet-facing RCE. None of these options combines the same level of remote reachability with complete system compromise as the web server RCE.Community Comment Notes
BWH9492 supports the web server RCE answer, explaining that an RCE flaw lets an unauthenticated attacker run arbitrary system-level commands, take complete control of the host operating system, pivot laterally, and deploy destructive payloads. The comment also emphasizes that a web server is "almost always publicly facing and directly reachable from the internet," making the exposure argument central to prioritization. This aligns with the exam doctrine of remediating the most remotely exploitable, highest-impact vulnerability first when several issues compete for attention.Official Reference
Exam Strategy
When remediation resources are limited, rank by internet exposure and exploitability before raw severity alone. Look for an unauthenticated, remotely reachable flaw that can lead to full host compromise, then consider data-confidentiality or authenticated privilege-escalation issues.
Frequently Asked Questions
Why is web server RCE prioritized over CRM privilege escalation?
RCE on an internet-facing host can be exploited remotely without valid CRM credentials and yields OS-level control, while CRM privilege escalation requires application access and has a narrower blast radius.
Does a high-impact data leakage flaw ever outrank RCE?
Only if the data leakage is broadly exposed and the RCE is heavily constrained; by default, externally reachable RCE gets first priority because it enables full host compromise.