> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/software-composition-analysis-sca-vulnerability-issues/navigate-to-cve-vulnerability-issues/reference-a-prioritization-metrics.md).

# Reference A: Prioritization metrics

## Urgency-based prioritization

Urgency combines runtime exposure, business impact, exploit intelligence, reachability, and fix availability to prioritize each CVE vulnerability issue. Use the following hierarchy:

| Urgency Level      | Criteria                                                                                                                   | Recommended Action                                                                    |
| ------------------ | -------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- |
| **Top Urgent**     | High EPSS, KEV-listed, reachable, and affecting an internet-exposed production asset with critical application criticality | Upgrade immediately. Escalate to a Case. Apply compensating controls if no fix exists |
| **Urgent**         | High CVSS, a fix is available, and affects a staging or production asset, or sensitive data                                | Upgrade within the current SLA window                                                 |
| **Not Urgent**     | Low EPSS, not reachable, or affects a low-criticality development or testing asset                                         | Schedule remediation during the next maintenance cycle                                |
| **Not Applicable** | No Code-to-Cloud trace exists and SCA-specific signals are unavailable                                                     | Link the repository to the relevant application                                       |

For detailed metric definitions and calculation context, see [Urgency](/application-security/application-security-posture-management-aspm/urgency.md) and [Understand Urgency metrics](/application-security/application-security-posture-management-aspm/urgency/urgency-metrics.md).

{% hint style="info" %}

### Important

Urgency signals related to deployment context are populated only when the SCA asset is traced to deployed cloud resources through the Code-to-Cloud mapping. If no Code-to-Cloud trace exists, deployment-related urgency signals display as Not Applicable. SCA-specific signals (EPSS Score, KEV Status, Reachability, Has Fix) are always available regardless of Code-to-Cloud traceability.
{% endhint %}

## Severity-based prioritization

Severity reflects inherent CVE risk from its CVSS score. Use it as a baseline filter:

| Severity          | Remediation Priority                                                                                                                          |
| ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
| **Critical**      | Remediate immediately. The vulnerability enables remote code execution, privilege escalation, or data exfiltration with low attack complexity |
| **High**          | Remediate within the current sprint. The vulnerability exposes a significant attack vector                                                    |
| **Medium**        | Schedule remediation. The vulnerability requires specific exploitation conditions                                                             |
| **Low**           | Address during routine maintenance. The vulnerability has minimal security impact                                                             |
| **Informational** | No action required. The finding is advisory                                                                                                   |

## CVE details

The CVE details section provides vulnerability intelligence for the detected CVE:

* **CVE ID:** The Common Vulnerabilities and Exposures identifier with a link to the NVD entry.
* **CVSS Score:** The CVSS v3.1 base score and severity rating.
* **EPSS Score:** The Exploit Prediction Scoring System probability with percentile ranking.
* **KEV Status:** Whether the CVE is listed in the CISA Known Exploited Vulnerabilities catalog.
* **Attack Vector:** The attack vector classification (Network, Adjacent, Local, Physical).
* **Attack Complexity:** The complexity required to exploit the vulnerability (Low, High).
* **Published Date:** The date the CVE was published in the NVD.
* **Description:** The full CVE description from the NVD advisory.

## Package details

The Package details section provides dependency context for the vulnerable package:

* **Package Name:** The name of the vulnerable open-source package.
* **Installed Version:** The version declared in the dependency manifest.
* **Fix Version:** The minimum package version that resolves the vulnerability.
* **Root Package:** The top-level dependency that introduces a transitive vulnerability.
* **Dependency Path:** The full dependency chain from the root package to the vulnerable package.
* **Package Manager:** The package manager ecosystem, such as npm, Maven, or PyPI.
* **License:** The open-source license of the vulnerable package.

## Code evidence

The Code evidence section displays source context for the vulnerable dependency:

* **Repository Name:** The repository containing the vulnerable dependency.
* **File Path:** The dependency manifest path with a VCS provider link.
* **Code Block:** The manifest snippet with the vulnerable declaration highlighted.
* **Commit Details:** The author, hash, and timestamp of the introducing commit.

## Code to cloud graph

The Code to cloud graph traces the dependency manifest to its deployed cloud resource. Use it to understand which production assets inherit the vulnerable package.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/software-composition-analysis-sca-vulnerability-issues/navigate-to-cve-vulnerability-issues/reference-a-prioritization-metrics.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.