Question
A security analyst is performing a penetration test on an organization’s internal network. A vulnerability scanning tool detects a high-risk vulnerability in a critical server, suggesting it could allow remote code execution. However, the penetration tester is unable to exploit the vulnerability successfully due to unknown system configurations and patch levels.
Should the company immediately consider this vulnerability as a confirmed security risk?
Submit