"""
The Applicant must be active in its management of computers and network devices. It must routinely
...
remove or disable unnecessary software (including applications, system utilities and network services)
"""
So, based on the quote above, curl.exe must be removed if it is not used, no matter whether it is vulnerable or not (yes I know it is a misreading, but it's frightening that the most literal interpretation is a misreading).
This is a quote from the Cyber Essentials requirements (https://www.ncsc.gov.uk/files/Cyber-Essentials-Requirements-...):
""" The Applicant must be active in its management of computers and network devices. It must routinely
...
remove or disable unnecessary software (including applications, system utilities and network services) """
So, based on the quote above, curl.exe must be removed if it is not used, no matter whether it is vulnerable or not (yes I know it is a misreading, but it's frightening that the most literal interpretation is a misreading).