Two flaws have similar severity scores. One is actively exploited on an Internet-facing system. Which should generally be prioritized?

1. The flaw with the longer identifier
2. The flaw reported by the oldest scanner
3. The exposed, actively exploited flaw
4. Whichever appears alphabetically first