# Exploit Wednesday: Vulnerability Triage Worksheet

HackWednesday | Version: 2026-09-06
Guide: https://hackwednesday.com/exploit-wednesday

Use one record per advisory and asset group with the same owner and action.
Keep this worksheet in your approved internal workspace. Nothing entered into
this downloaded file is sent to HackWednesday. Do not publish asset details,
credentials, sensitive logs, or private incident evidence.

This is a proposed operating aid, not a compliance certification or fixed SLA.
Follow current vendor guidance and applicable response requirements. Do not wait
until Wednesday when urgent exposure requires earlier action.

## Six checks

- [ ] Capture the advisory, affected versions, prerequisites, and timestamp.
- [ ] Verify affected assets; assign discovery for unknowns.
- [ ] Prioritize exploitation, attack path, impact, and effective controls.
- [ ] Patch or mitigate through an approved, tested change with rollback.
- [ ] Check for compromise during the exposure window; preserve evidence.
- [ ] Verify effective remediation and service health before closing.

## Case record

| Field | Your evidence or decision |
| --- | --- |
| Case ID and CVE/advisory | |
| Vendor source URL and checked-at UTC | |
| Affected asset group and owner | |
| Affected versions/features and applicability evidence | |
| Reachability, privileges, and potential attack path | |
| Known exploitation evidence and timestamp | |
| Severity, EPSS if used, and timestamps | |
| Business impact and effective existing controls | |
| Priority and decision rationale | |
| Patch/mitigation action and change ticket | |
| Deadline in UTC under your response policy | |
| Mitigation scope, validation, expiry, and exception owner | |
| Test and rollback plan | |
| Post-change version/mitigation and service-health evidence | |
| Exposure-window investigation reference and logging gaps | |
| Status: unknown / affected / mitigated / fixed / not affected | |
| Remaining uncertainty and next update UTC | |

## Completion rules

- Unknown is not not-affected. Assign an owner and discovery deadline.
- Mitigated is not fixed. Track expiry and permanent remediation.
- A deployed package is not proof of a running patched version.
- A patched system is not proof that no compromise occurred earlier.
- An absence from KEV is not proof of safety; EPSS is not an asset assessment.
- If suspicious activity is found, activate the incident-response process.
- Keep repeated runs linked to the same case; record changes rather than
  opening duplicate tickets for unchanged evidence.

## Worked example (fictional, not real CVEs)

| Asset | Evidence | Proposed action |
| --- | --- | --- |
| A: Internet gateway | Affected version; active exploitation; privileged path | Urgent approved fix/mitigation and exposure-window investigation |
| B: Internal test service | Critical severity; affected; isolated lab with no known production dependency | Validate isolation/dependencies; schedule prompt tested remediation |
| C: Identity infrastructure | Potentially affected; stale inventory; high impact | Urgent discovery in parallel with A; reassess as evidence arrives |

This is not a universal ordering or a permission to delay action. New evidence,
business impact, and applicable requirements can change the response.

## Copyable team update

As of [UTC timestamp], [asset group] is [status] for [advisory/CVE].
Evidence: [approved internal reference].
Known exploitation and exposure: [evidence, not assumptions].
Owner and next action: [owner / action / deadline UTC].
Mitigation and expiry: [scope / validation / expiry or not applicable].
Verification and investigation: [result / reference / remaining gaps].
Unresolved risk or blocker: [specific issue and decision needed].
Next evidence update: [UTC timestamp].

## Reference sources

- Microsoft update cycle: https://learn.microsoft.com/en-us/windows/deployment/update/release-cycle
- Microsoft advisories: https://msrc.microsoft.com/update-guide/en-us/
- CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- FIRST EPSS: https://www.first.org/epss/

Prepared with AI assistance; human editorial review pending. Review this
template with your security and operations owners before operational use.