Skip to main content

How do I triage a vulnerability report?

Open the report in Submissions, acknowledge it first, then score it with the CVSS calculator and record a report classification. Acknowledge first because the acknowledgment clock is what the SLA measures, and a breached acknowledgment is visible evidence of a process that is not working.

Key takeaways​

  • Acknowledge first, investigate second.
  • Score severity with the built-in CVSS calculator.
  • Article 14 obligations apply when you tick Actively exploited in the wild. They also apply when the classification is an incident and the severity is High or Critical.
  • Every action is written to the append-only audit log.
Silent walkthrough. Follow the numbered steps below for the full text.

Steps​

  1. Open Submissions and select the report.
  2. Select Acknowledge report.
  3. Score the report with the CVSS calculator and select Apply to Submission.
  4. In Severity & Art.14 Obligations, set the Report Classification. The change saves at once.
  5. Tick Actively exploited in the wild only when you have evidence of active exploitation.

Last updated 17 September 2026.