No I'm not. It doesn't matter whether an exploit is locally or remotely exploitable potentially. It matters whether it's exploitable for an attacker. For exam

No I'm not. It doesn't matter whether an exploit is locally or remotely exploitable potentially. It matters whether it's exploitable for an attacker. For example, CVE-2017-5645 is a remote code execution vulnerability in Log4j that will light up your vulnerability scanner like a Christmas tree, but requires you to use Log4j functionality that you will never realistically use in an application container.