Vulnerability scanners may allow for the administrator to assign which of the following in order to assist in prioritizing remediation activities?

Definitions for each exposure type are predefined by the scanner's vulnerability database (e.g., CVE/NVD entries) and are not something an administrator assigns to prioritize remediation.

Vulnerability attack vectors are standardized attributes defined within the CVSS scoring system by the vulnerability's publisher, not configurable values assigned by a scanner administrator.

Assigning asset values to networks allows administrators to weigh the criticality of each asset when reviewing scan results, so that vulnerabilities on high-value systems (e.g., servers holding sensitive data) are remediated before those on low-value assets. This business-context weighting is a built-in feature of enterprise vulnerability management platforms like Tenable Nessus and Qualys, where asset criticality scores directly influence prioritized remediation workflows.

Exploit code metrics are part of the CVSS Temporal score and reflect publicly available exploit availability, which is sourced externally and not an administrator-assigned value within the scanner.