How to Communicate a Dependency Vulnerability in English
Learn the English structure for reporting and communicating a vulnerable dependency: severity, exposure, and the patch timeline, without causing panic or complacency.
A dependency vulnerability report needs to land in the narrow space between causing needless panic and being ignored as noise, and getting that balance right depends heavily on precise language about severity, actual exposure, and what’s actually being done about it. This guide covers that vocabulary.
Key Vocabulary
CVE / advisory — the formal identifier and description of a known vulnerability, the reference point that grounds a report in something verifiable rather than a vague “we heard there’s an issue.” “This is CVE-2026-31402, affecting versions of the logging library before 4.2.1 — full advisory linked below.”
Severity score — the standardized rating (often CVSS) indicating how serious the vulnerability is in the abstract, distinct from how exposed your specific system actually is to it. “The CVE has a CVSS score of 9.8, critical — but that’s the abstract severity; our actual exposure depends on whether we use the affected code path, which we’re checking next.”
Exploitability / exposure — the assessment of whether and how your specific system is actually reachable or vulnerable given the CVE, which can be much lower than the abstract severity suggests. “Despite the critical severity score, our exposure is limited — we don’t call the vulnerable deserialization function anywhere in our codebase, so exploitability here is effectively zero.”
Patch timeline — the concrete plan and dates for updating the affected dependency, distinguishing an already-patched state from one still in progress. “Patch timeline: dependency bump merged to main today, deployed to production by end of day tomorrow after the standard staging soak.”
Compensating control — a temporary mitigation applied while waiting for the actual patch, reducing risk in the interim without requiring the full fix to be rushed. “As a compensating control until the patch deploys, we’ve added a WAF rule blocking the specific request pattern the exploit relies on.”
Common Phrases
- “What’s the severity score, and separately, what’s our actual exposure to it?”
- “Is this exploitable given how we actually use this dependency, or just in theory?”
- “What’s the patch timeline, and has it already shipped or is it still pending?”
- “Do we have a compensating control in place while we wait for the patch?”
- “Is this CVE confirmed to affect the version we’re running, or just the general library?”
Example Sentences
Opening a vulnerability report to the team: “Reporting CVE-2026-31402 (critical, CVSS 9.8) in our logging library. Exposure assessment: we don’t use the affected code path directly, so exploitability is low, but we’re patching regardless. Patch timeline: today.”
Reassuring stakeholders without minimizing the issue: “This is a serious CVE in the abstract, but our exposure assessment shows we’re not calling the vulnerable function anywhere — we’re still patching promptly, just want to be clear this isn’t an active exploit against us.”
Escalating a genuinely urgent case: “Unlike the last advisory, this one is directly exploitable in our setup — we do call the affected function on a public-facing endpoint. Treating this as urgent: patch timeline is within the hour, compensating control (rate limiting) applied in the meantime.”
Professional Tips
- Cite the CVE or advisory number on first mention — it lets anyone verify the claim independently instead of taking your summary on faith.
- Separate severity score from actual exposure explicitly — a critical CVE with zero exposure and a medium CVE with full exposure need very different urgency, and conflating them either over- or under-reacts.
- State the patch timeline as concrete dates or “already shipped,” never “we’re looking into it” without a date attached — vague timelines read as deprioritized even when they aren’t.
- Mention any compensating control applied in the interim — it reassures stakeholders that risk is being actively managed while the real fix is in progress, not just acknowledged and left alone.
Practice Exercise
- Write a short vulnerability report distinguishing severity score from actual exposure.
- Write a sentence describing a compensating control for a hypothetical vulnerability.
- Write a patch timeline update using concrete dates.