Prioritize a fielded vulnerability for review. The score does not determine acceptable residual risk; that requires manufacturer criteria, evidence, and risk-owner approval.
Reviewed by
Christian Espinosa
Founder & CEO, Blue Goat Cyber
1. Is the vulnerable code reachable in the deployed device configuration?
Reachability = an attacker can actually invoke the affected code path given how the device ships and is used.
2. If exploited, what is the worst credible patient-safety consequence (ISO 14971)?
3. What is the public exploit signal today?
Use CISA KEV, EPSS, public PoC, and active-exploitation reporting.
4. What access does an attacker need?
5. What compensating controls are in place right now?
6. Can you detect exploitation attempts in fielded devices?
What you'll see after you submit
Common misconceptions
Myth: A high CVSS score means uncontrolled risk.
Reality: CVSS measures the vulnerability, not your residual risk. A technical score cannot establish controlled risk. Assess exploit paths, credible patient harm, and tested controls against manufacturer criteria.
Myth: If we patched it, it was never uncontrolled.
Reality: Document risk at discovery and reassess after mitigation or remediation. A later patch does not erase the original risk or any reporting obligations.
Myth: Uncontrolled risk always means a recall.
Reality: It triggers customer notification, mitigation, and 21 CFR 806 evaluation - which may or may not be a recall depending on the correction.
References & further reading
Plan monitoring and testing; assess patch urgency and reporting separately.
Read Postmarket cadence calculatorDraft optional VEX communication using product-specific affectedness evidence, separately from risk acceptance.
Read SBOM Diff & VEX DrafterWe support ongoing evidence review; the manufacturer owns risk classification, acceptance, and reporting.
Read Postmarket SBOM & VEX monitoringDefinition, FDA framing, and worked example.
Read Glossary: Controlled vs Uncontrolled Risk