A systems administrator is reviewing the output of a vulnerability scan.

192.168.76.5 — Patch; upgrade IIS to the current release

The correct remediation target is 192.168.76.5 , which is associated with an unsupported Microsoft IIS version and a CVSS score of 9.2 in the matching hotspot data. The remediation standard assigns vulnerabilities above 9.0 to the shortest remediation window, meaning the system requires action in seven days and therefore necessarily falls within the requested fourteen-day maximum. The corresponding remediation is to patch or upgrade IIS to a currently supported release .

The key vulnerability-management principle is that remediation priority is not determined exclusively by the existence of a vulnerability. Analysts must consider severity, asset context, exposure, business importance, exploitability, available remediation, and organizational service-level requirements. A product that has reached an unsupported state represents additional risk because standard security updates may no longer be supplied.

Upgrading the affected IIS installation directly removes the unsupported software condition rather than merely reducing exposure around it. A compensating control would be appropriate when remediation cannot immediately be performed, but it would not supersede a supported upgrade when that upgrade is operationally available.

Study Guide Reference: Vulnerability Management → Vulnerability Prioritization → CVSS → Remediation Timeframes → End-of-Life/Unsupported Software → Patching and Upgrading.