CVSS v3.1 exploitability is driven chiefly by the four base exploitability metrics:
• Attack Vector (AV) – Network (N) is the easiest to reach when Internet-facing.
• Attack Complexity (AC) – Low (L) requires no unusual circumstances.
• Privileges Required (PR) – None (N) means the attacker is unauthenticated.
• User Interaction (UI) – None (N) means no victim action is needed. Of the listed hosts, “blane” is the only one whose vulnerability is scored AV:N, AC:L, PR:N, UI:N, giving the highest possible Exploitability Sub-Score (3.9). When the systems become publicly reachable, that combination makes “blane” the most readily exploitable and therefore the first system that should be patched.

A. brown – AV is Adjacent (A); the attacker must be on the same subnet, so exposure after Internet publishing is lower than “blane.”
B. grey – Requires User Interaction (UI:R); phishing or social engineering is still needed, lowering exploitability.
D. sullivan – Privileges Required is High (PR:H); an attacker must already possess elevated credentials, greatly reducing likelihood of compromise.

1. FIRST.org, “Common Vulnerability Scoring System v3.1: Specification Document,” §§2.1, 2.1.1-2.1.4, pp. 3-7.

2. FIRST.org, “CVSS v3.1: User Guide,” §3.1, p. 10 (exploitability sub-score formula & max of 3.9).

3. MIT OpenCourseWare, 6.858 “Computer Systems Security,” Lecture 13 notes, p. 2 (discussion on remote, unauthenticated, no-interaction exploits).

4. NIST SP 800-30 Rev.1, §2.3.1, pp. 9-10 (likelihood of threat exploitation increases with low complexity and no required privileges).