---
name: vulnerability-management
description: "Prioritize vulnerabilities using exact affected versions, reachable exposure and known exploitation, then patch and retest with rollback. Use for vulnerability management, patch prioritization, KEV matching, dependency risk or verifying a security fix."
category: security
version: "1.0.200"
triggers:
  - "vulnerability management"
  - "patch prioritization"
  - "kev catalog"
  - "verify patches"
tools:
  - file_read
  - file_write
  - shell_execute
  - cyber_defense
---

# Vulnerability Management

## Workflow

1. Collect resolved software versions, asset owners and exposure evidence; distinguish product names from exact package identities.
2. Compare vendor advisories and a dated CISA KEV export; read the local JSON matching example. KEV absence never proves safety.
3. Confirm affected version ranges and reachable attack conditions; rank exploitation evidence, exposure and business impact together.
4. Prepare vendor-supported remediation, compatibility checks and a tested rollback path.
5. Verify installed and running versions after remediation, then rerun the original security check plus normal functional controls.
6. Record remaining exceptions, compensating controls, owner and revisit date; do not call a version bump alone a verified fix.

## Worked example and prerequisites

Read [references/workflow.md](references/workflow.md) before execution. Use only registered OSA tools named in the frontmatter; command examples run through `shell_execute`. Check `command -v` for each external executable on the actual target. Optional packages, external collectors and vendor accounts are not bundled or presumed installed.

## Evidence and completion

Return scope, prerequisites, exact checks, observed results, evidence paths, limitations, remediation, rollback and retest status. Mark unavailable checks as blocked or unverified. Preserve original evidence and report redacted copies where needed. Work within the authorized environment; do not silently expand to external targets.

## Sources

Original OSA workflow and examples. Primary references are linked in the bundled workflow reference, so they remain available when this skill is installed separately. No third-party skill collection or rule pack is vendored.