A penetration tester delivers a web application vulnerability scan report to a client. The penetration tester rates a vulnerability as medium severity. The same vulnerability was reported as a…

A hot fix that resolves the underlying issue would typically result in the vulnerability being removed from the report entirely, not simply reduced in severity.

A significantly changed threat landscape would more likely raise severity rather than lower it, as new threat actors and attack techniques tend to increase risk over time.

Adding new features to the codebase does not reduce the severity of a pre-existing vulnerability and could even expand the attack surface.

CVSS severity scoring includes exploitability metrics that directly influence the overall score. When no known public exploits exist for a vulnerability, the exploitability subscore drops significantly, which can lower the overall rating from critical to medium. This reflects the reduced likelihood that an attacker can successfully leverage the flaw in the current threat environment.