CAPG-v2: Impact-Weighted, Multi-Path Vulnerability Prioritization over CVE-Centric Attack-Position Graphs

Abstract

: Vulnerability management routinely relies on per-CVE (Common Vulnerabilities and Exposures) severity scores or exploitability scores, yet real intrusions are multi-step: attackers chain exploits across hosts to reach high-impact goals. Attack graphs capture these dependencies, but many prioritization methods still under-represent two practical realities: (i) overlap the same CVE can appear on many distinct attack paths, so patching it can block multiple routes; and (ii) impact heterogeneity different goals (e.g., domain admin vs. data exfiltration) imply different losses. Building on CAPG, a recent CVE representation designed to construct attack-position graphs, we introduce CAPG-v2: a lightweight extension that adds probabilistic semantics and goal impact annotations, enabling impact-weighted and overlap-aware prioritization. We formalize (a) a path-based score that aggregates across distinct goal-reaching paths and (b) an enumeration-free Monte Carlo marginal expected-loss reduction score that avoids explicit path enumeration. Rather than treating vulnerabilities as isolated items, CAPG-v2 supports patch prioritization as a graph-aware risk-reduction problem in which remediation decisions are guided by attacker behavior, shared attack routes, and the business impact of reachable goals. We further provide JSON artifacts and a reference evaluator to support replication and extension.