VULNERABILITY TRIAGE CHECKLIST — BLANK TEMPLATE
Keep real evidence and credentials in an appropriate private assessment workspace.

INTAKE AND VALIDATION
Finding ID / title / source / received date:
Affected product, version, environment, endpoint, or dependency:
Related threat / authorization test IDs:
Authorized reproduction steps and expected versus observed behavior:
Evidence location, collection date, reviewer, confidence, and limitations:
[ ] Applicability and reachability checked; uncertainty is recorded below.
Attacker access, privileges, interaction and other prerequisites:
Affected data, tenants, operations and business impact:

EXPLOITATION AND CONTEXT
Observed exploitation of this application / evidence / incident-response referral:
External exploitation reports / source / publication and checked dates:
Existing compensating controls / evidence / gaps:
Unknowns and next validation steps:
CVE (optional; not applicable if none):
CVSS version / score / vector / source / assessment date (optional):
KEV catalog entry and checked date (optional; absence is not proof of no exploitation):
EPSS probability / percentile / score date / source (optional; published CVEs only):
[ ] Technical severity is recorded separately from remediation priority.
[ ] Suspected active exploitation has been referred to the incident-response process.

DECISION AND TRACKING
Disposition (escalate now / remediate / investigate / accept or defer):
Rationale based on exposure, impact, exploitation evidence and uncertainty:
Immediate containment or investigation action:
Responsible owner / decision-maker / target date under local policy:
For accept/defer: authorized approver / residual risk / review date / revisit triggers:
Status / tracking reference:

RETEST AND CLOSURE
Required expected behavior, response-data checks and side-effect checks:
Retest environment/version/date, reviewer and evidence:
[ ] Original failure no longer reproduces under the relevant access contexts.
[ ] Allowed behavior still works and related paths have been checked.
Residual risk and approval to close:
Closure date (leave empty until verified):

Companion guide: https://www.brandoneckert.com/vulnerability-triage-checklist/