TL;DR
- CVSS measures how severe a vulnerability could be, EPSS estimates how likely it is to be exploited within 30 days, and the CISA KEV catalog confirms which flaws attackers are exploiting now. Each answers a different question.
- Ranking by CVSS alone directs remediation capacity toward theoretical severity and away from observed attacker behavior.
- A defensible program layers all three signals, weights them by asset exposure, and records the reasoning behind every deferral. CISA’s 2026 directive for federal agencies now follows the same logic.
Enterprise scanners now report thousands of findings each quarter, and most security teams can remediate only a fraction of them within a single patch cycle. Deciding which vulnerabilities to fix first has moved from an operational detail to a governance matter. PCI DSS v4.0.1 Requirement 6.3.1 expects organizations to identify vulnerabilities and assign risk rankings using reputable external sources, and ISO/IEC 27001:2022 Annex A control 8.8 requires management of technical vulnerabilities. Auditors and risk committees increasingly ask how a severity decision was reached, not only whether a patch was applied.
Three signals dominate this discussion: CVSS, EPSS, and the CISA Known Exploited Vulnerabilities (KEV) catalog. Each answers a different question, and treating any one of them as the complete answer leads to predictable misallocation of remediation effort.
What Does CVSS Measure, and Where Does It Fall Short?
The Common Vulnerability Scoring System (CVSS) measures how severe a flaw could be if exploited. It is an open framework maintained by FIRST that produces a score from 0.0 to 10.0 based on technical characteristics such as attack vector, attack complexity, and privileges required. CVSS v4.0, published in November 2023, adds a threat metric group that can reflect exploit maturity.
CVSS describes potential impact, not likelihood. A score of 9.8 indicates that a successful exploit would be serious, but it does not show whether threat actors are scanning for that flaw this week. Many critical-rated vulnerabilities never see exploitation, while mid-severity flaws in edge devices are routinely used in intrusion campaigns. The threat metrics also depend on consistent input from whoever scores the vulnerability, and that input varies in practice. CVSS is a sound basis for impact analysis, but it cannot serve as the sole prioritization input.
How Does EPSS Estimate Exploitation Likelihood?
The Exploit Prediction Scoring System (EPSS) estimates the probability that a CVE will be exploited in the wild within the next 30 days. Each CVE receives a probability between 0 and 1 and a percentile that ranks it against all scored vulnerabilities. FIRST maintains the model and recalculates scores daily. Version 4, released in March 2025, draws on exploit availability, threat intelligence signals, and observed exploitation history.
EPSS is valuable because it tracks attacker behavior. Adversaries choose targets based on the cost of exploitation and the availability of working code, so a model built on those signals follows the decisions that drive real-world risk. This is the gap between a flaw that exists and one that is exploitable. Its limitation is that it predicts rather than confirms. A high score signals elevated probability, and the score shifts as new intelligence arrives. Teams should treat EPSS as a ranking input with documented thresholds, not as a binary verdict.
Why Does the CISA KEV Catalog Matter for Prioritization?
The KEV catalog, maintained by the Cybersecurity and Infrastructure Security Agency (CISA), lists vulnerabilities with reliable evidence of active exploitation. An entry needs an assigned CVE ID, that evidence, and clear remediation guidance, which gives the catalog a high signal-to-noise ratio. The catalog is publicly available to any organization, and KEV status is a core input to the federal remediation rules described below.
KEV is retrospective by design. A vulnerability appears only after attackers have already used it, so the catalog cannot provide early warning. It also covers only confirmed cases, which means an unlisted flaw is not necessarily safe. KEV works best as the mandatory top tier of a prioritization model, while EPSS and CVSS handle the rest of the backlog.
How Do CVSS, EPSS, and KEV Compare Across Key Attributes?
CVSS measures severity, EPSS measures likelihood, and KEV confirms exploitation. The table below compares each signal by its purpose, output, and primary limitation.
| Attribute | CVSS | EPSS | CISA KEV |
| Question answered | How severe is the flaw if exploited? | How likely is exploitation in the next 30 days? | Is exploitation confirmed? |
| Output | Score from 0.0 to 10.0 | Probability and percentile | Catalog listing with remediation guidance |
| Maintainer | FIRST | FIRST | CISA |
| Timing | Assigned at disclosure, refined as analysis matures | Recalculated daily | Added after confirmed exploitation |
| Primary limitation | Ignores exploitation activity and environment | Probabilistic, not confirmed | Retrospective and limited to confirmed cases |
How Should Organizations Combine These Three Signals?
A layered model assigns each finding a priority tier using all three signals, then adjusts for the organization’s own exposure. KEV status sets the top tier, EPSS ranks the remaining backlog, and CVSS sets impact within each band. The following sequence is a practical starting point:
- Place every KEV-listed vulnerability in the highest tier and set the shortest deadlines for internet-facing and crown-jewel assets first.
- Rank the remaining findings by EPSS, using thresholds your risk committee approves. FIRST notes that only about 2 to 3 percent of vulnerabilities see exploitation, so a cutoff near 0.5 would deprioritize almost everything. A 90th-percentile cutoff, near a probability of 0.04, produces a list roughly the size of a CVSS Critical filter. FIRST’s guidance recommends tuning that cutoff locally over time.
- Use CVSS to set impact within each band, then adjust for asset criticality, network exposure, and whether exploitation can be automated.
- Record the rationale for every deferral, including the scores at the time of decision, the reviewer, and any compensating controls.
- Validate remediation through rescanning or exposure validation, and retain the evidence for PCI DSS Requirement 6.3.1 or ISO/IEC 27001:2022 control 8.8 assessments.
Why the Sequence Matters
The order reflects what each signal can and cannot tell you. KEV identifies confirmed attacker activity, so it overrides every other input. EPSS predicts which unresolved flaws attackers will target next, which makes it the best guide for the large, unconfirmed backlog. CVSS determines how much damage a successful exploit would cause, which matters most after likelihood has been assessed. Each signal covers a gap the others leave open. Organizations building a risk-based vulnerability management program around this model can document each tier as a written standard that auditors can trace.
Why Multiplying the Scores Does Not Work
Some teams combine CVSS and EPSS into a single product score. FIRST cautions against this shortcut because EPSS is a calibrated probability while CVSS is an uncalibrated ordinal scale, so the product has no stable interpretation. A layered tier model with explicit rules produces decisions that can be explained to auditors and risk committees.
Where Do Prioritization Programs Typically Break Down?
Most failures trace back to a small number of structural errors, and each one is straightforward to correct once identified:
- Sorting by CVSS alone. This directs effort toward theoretically severe flaws that attackers are not using, while exploited mid-severity vulnerabilities remain open.
- Ignoring asset context. A medium-severity flaw on an internet-facing payment gateway carries more risk than a critical flaw on an isolated lab system.
- Treating KEV as a complete list. Absence from the catalog does not confirm safety. Teams need threat intelligence for weaponized vulnerabilities that have not yet been confirmed.
- Using stale EPSS snapshots. Because scores update daily, an export from several weeks ago can misrepresent current exposure.
- Lacking an evidence trail. A decision that cannot be reconstructed during an audit creates regulatory exposure, even when the technical judgment was sound. Gaps in evidence management often surface in ISO/IEC 27001:2022 Annex A control 8.8 reviews.
What Should Security and Compliance Leaders Do Next?
Leaders should formalize the three-signal model as a written standard and fold it into a continuous threat exposure management (CTEM) cycle. Start by measuring how many open findings fall into each tier, then set service-level targets for the KEV tier first. BOD 26-04’s 3-, 14-, and 60-day windows offer a useful reference point. Boards respond more readily to exposed assets and time-to-remediate than to raw vulnerability counts, so report those measures to the risk committee.
Conclusion
CVSS, EPSS, and KEV answer three different questions: how damaging a flaw could be, how likely it is to be used, and whether attackers are already using it. Teams that rely on one signal misallocate remediation capacity and weaken their audit position. A layered model anchored by confirmed exploitation, with rationale recorded at every decision point, reduces exposure faster and holds up under regulatory review.
Align KEV, EPSS, and asset exposure with PCI DSS Requirement 6.3.1 and ISO/IEC 27001:2022 Control 8.8.
People Also Ask
Is a high CVSS score enough to prioritize a vulnerability?
No. CVSS measures potential impact, not whether attackers are using the flaw. Pair the score with EPSS likelihood and CISA KEV status, then adjust for how exposed the affected asset is to external networks.
Can a vulnerability have a high CVSS score and a low EPSS score?
Yes, and it is common. A flaw can be technically critical but have no public exploit and little observed attacker activity, which keeps its EPSS probability low. These findings usually fit a normal patch cycle unless the affected asset is highly exposed.
What should I patch first?
Start with any vulnerability in the CISA KEV catalog, since exploitation is confirmed, and prioritize those on internet-facing or business-critical assets. Then rank the remaining findings by EPSS likelihood, using CVSS to gauge the impact of a successful exploit.
Should I multiply CVSS by EPSS to get one risk score?
No. EPSS is a calibrated probability and CVSS is an ordinal scale, so the product has no stable meaning. FIRST specifically cautions against it. Treat them as separate inputs in a tiered model, with KEV status as an override.
What is SSVC?
SSVC, or Stakeholder-Specific Vulnerability Categorization, is a decision-tree framework developed by CISA and the Carnegie Mellon Software Engineering Institute. It assigns remediation priority using exploitation status, technical impact, automatability, and organizational context. CISA’s BOD 26-04 is built on the same SSVC decision points.
Enjoyed reading this blog? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn.
