Vulnerability Triage: The Real Challenge Is Judging Business Impact, Not Patching

The Three Dilemmas of Vulnerability Operations

Modern vulnerability management faces a "tsunami" of CVEs: 59,000 predicted for 2026, with major vendors' disclosures up 578% year-over-year. The median time-to-exploit has collapsed from one year (2021) to one day (2026), and 30.2% of critical vulnerabilities are exploited on disclosure day. Against this pace, on-site operators confront three compounding problems:

Unclear impact scope — Knowing a vulnerability exists but not which servers or middleware are affected. The Log4Shell incident showed that 24-hour remediation failed largely because the root vulnerability lay three or more layers deep in indirect dependencies.

Fear of breaking changes — Security teams cannot simply demand immediate upgrades. New versions may alter API behavior, break compatibility, or introduce fresh defects. Patching a single third-party Java dependency triggers a full chain: business-owner sign-off, code review, canary release, and rollback planning.

Knowledge lag — Traditional knowledge bases and even large language models lack data on vulnerabilities disclosed after their training cutoff. A model trained before 2026 has simply never seen CVE-2026-42945 or CVE-2026-91403.

「真正难的从来不是发现漏洞，而是判断它到底会不会搞挂我的业务。」

Building an AI-Assisted Vulnerability Workbench

The author developed a "Field Vulnerability Operations Workbench" to address these gaps. The tool maintains a sanitized deployment inventory (servers, IPs, OS, middleware, versions) and, given a CVE ID, uses an LLM to cross-reference the inventory against authoritative vulnerability facts.

STEP 01: Get It Running Without CORS Headaches

Initial pure-frontend design (HTML + direct LLM API calls) failed due to CORS and file:// origin restrictions. The solution: a Python backend that hosts the frontend and proxies LLM requests, so the browser only talks to localhost.

STEP 02: Multi-Provider LLM Configuration

The backend stores multiple LLM configurations (DeepSeek, Qwen, local Ollama, custom endpoints) with API keys kept server-side. Operators can switch providers instantly if one hits rate limits or quota exhaustion.

STEP 03: Make the LLM Understand Your Environment

A deployment manifest lists every server, IP, OS, environment, middleware, and version. At query time, the manifest and CVE ID are sent to the model with the instruction: "Determine which of my servers are affected by this vulnerability."

STEP 04: Ground the LLM in Authoritative Facts

Early attempts treated the LLM as a vulnerability database — it hallucinated or claimed ignorance for 2026 CVEs. The revised architecture:

Backend fetches ground-truth data from NVD and OSV.dev — affected product/version ranges, CVSS scores, official descriptions, fix links.

These facts are fed to the LLM with a strict system prompt: "Use only the provided authoritative sources; do not fabricate."

「大模型不是漏洞库，它只是个读过很多书但从不联网的'顾问'——你问它昨天刚爆的漏洞，它只能一脸茫然。」

Real-World Validation: Two 2026 CVEs

CVE-2026-42945 — NGINX rewrite module heap overflow, CVSS 9.2, actively exploited. The tool pulled authoritative data, compared against the field's NGINX 1.30.4, and concluded: not affected (version above the affected range). Zero wasted effort on unnecessary patches.

CVE-2026-91403 — Oracle Java SE JSSE component, CVSS 9.1, disclosed 2026-10-21. The tool matched the field's Java 17.0.21 as directly affected and, crucially, identified transitive exposure in Nacos, Kafka, and XXL-JOB because they bundle that JDK. This cross-component chain is exactly what manual java -version checks miss.

What previously required hours of manual inventory checks now resolves in ~30 seconds.

Closing Perspective

The ultimate goal of vulnerability management is not "zero vulnerabilities" — an impossibility in software engineering — but keeping risk within acceptable bounds. The workbench is a force multiplier; the human operator at 3 AM, watching monitors after hitting the upgrade button, remains the final decision point. The tool ensures every such decision is backed by facts, not guesswork.