@@ -1949,10 +1949,10 @@ This assessment is done based on the definitions in the [Annex R](#annex-r-norma
### 6.3.1 KEV_EXPLOIT-1
**Objective:**
**Objective:** Automatic or other vulnerability scans at the assessment day prove that the product is without known exploitable vulnerabilities that are not addressed and mitigated.
Verify that:
1. Known exploitable vulnerabilities affecting the product are identified.
1. Known exploitable vulnerabilities affecting the product are identified and the scanning delivered no additional results.
2. For each identified known exploitable vulnerability, one of the following applies:
* the vulnerability assessment demonstrates that the vulnerability is not exploitable in the product; or
* specific user guidance is provided to prevent exploitation.
@@ -1981,8 +1981,9 @@ Verify that:
**Verdict:**
* Pass: Known exploitable vulnerabilities affecting the product are identified, and each such vulnerability is covered either by a vulnerability assessment demonstrating non-exploitability in the product, or by specific user guidance preventing exploitation.
* Fail otherwise.
1. Pass, if no known exploitable vulnerabilities affecting the product are identified,
2. and each of them is identified and covered either by a vulnerability assessment, demonstrating non‑exploitability in the product, or by specific user guidance preventing exploitation.
