CVSS vs EPSS vs CISA KEV: how to prioritize vulnerabilities

The short version:

• CVSS answers "how bad could this be?", EPSS answers "how likely is exploitation soon?", KEV answers "is it being exploited now?"
• Fix KEV-listed vulnerabilities first, use EPSS to order the rest, use CVSS for impact.
• Absence from KEV is not evidence of safety; it means no confirmed exploitation yet.

Why severity alone is not enough

A typical scan of a small business returns dozens of Critical and High findings. Sorting by CVSS puts them all near the top, and the team ends up working through a list where most items will never be exploited while a few medium-scored flaws that attackers actively use wait their turn. Three public signals, used together, fix that.

CVSS: how severe a vulnerability could be

The Common Vulnerability Scoring System, maintained by FIRST, rates a vulnerability from 0 to 10 based on how it can be attacked and what an attacker gains. Most scanners and the US National Vulnerability Database publish the base score. Version 3.1 is still the most common; version 4.0, released in 2023, is appearing in more records.

CVSS qualitative severity ratings

• Critical: 9.0 to 10.0
• High: 7.0 to 8.9
• Medium: 4.0 to 6.9
• Low: 0.1 to 3.9

Strength: a consistent, widely available measure of impact. Limit: the base score ignores whether anyone is exploiting the flaw and how exposed the affected system is.

EPSS: how likely exploitation is in the next 30 days

The Exploit Prediction Scoring System, also from FIRST, estimates the probability that a CVE will see exploitation activity in the next 30 days. It is published daily for every CVE as a probability between 0 and 1, plus a percentile showing how the CVE ranks against all others.

• An EPSS of 0.02 means about a 2 percent chance of observed exploitation activity in 30 days.
• A percentile of 0.95 means the CVE scores higher than 95 percent of all scored CVEs.
• Most CVEs have very low EPSS scores, which is exactly why it is useful for thinning a long list.

Strength: a data-driven likelihood signal that changes as threat activity changes. Limit: it is a forecast that moves daily, it only covers vulnerabilities with a CVE, and a low score is not a guarantee.

CISA KEV: confirmed exploitation in the wild

The Known Exploited Vulnerabilities catalog is maintained by the US Cybersecurity and Infrastructure Security Agency. A CVE is added only when there is reliable evidence of active exploitation and a clear remediation is available. Each entry includes a due date, which is mandatory for US federal civilian agencies under Binding Operational Directive 22–01, and a field showing whether the vulnerability is known to be used in ransomware campaigns.

Strength: the strongest public evidence that a vulnerability matters right now. Limit: it lists only confirmed cases, so it is deliberately incomplete. A vulnerability can be exploited for weeks before it is added.

Never report a KEV miss as "not exploited"_ If a CVE is not in KEV, the accurate statement is "no confirmed exploitation recorded by CISA". Clients read "not exploited" as a guarantee._

Putting them together

What each signal tells you

• Question answered: How bad could it be?; How likely soon?; Is it exploited now?
• Maintained by: FIRST; FIRST; CISA
• Format: Score 0 to 10; Probability and percentile; Listed or not, with due date
• Changes: Rarely; Daily; When entries are added
• Best use: Impact and tie-breaks; Ordering the long tail; The top of the list

A practical order: KEV entries with ransomware use, then other KEV entries, then CVSS 9.0 or above, then the remaining findings with a CVE ordered by severity and EPSS, then findings without a CVE that still matter, then low and informational items. Adjust within each group for exposure: an internet-facing system goes ahead of an isolated one.

Varaxon Scan Hub uses exactly this order as six fixed priority bands. KEV matching fails closed (if the KEV data cannot be checked, the report says so rather than assuming no match), and EPSS is shown for every finding but never moves one down a band, because a probability that changes daily should not decide what a client signs off on. See it in the sample reports.

Common questions

What is a good EPSS threshold?

There is no universal one. Many teams treat an EPSS probability above roughly 0.1, or a percentile above 0.95, as worth fast-tracking, but the right threshold depends on how many findings you can realistically fix each cycle.

How often is the CISA KEV catalog updated?

CISA adds entries whenever it confirms new exploitation, often several times a week. Check against the current catalog every time you produce a report.

Is CVSS 4.0 replacing CVSS 3.1?

CVSS 4.0 was released by FIRST in 2023 and is being adopted gradually. Many scanners and databases still publish 3.1 scores, so reports should state which version a score comes from.

This guide first appeared on varaxontech.com.

I'm building Varaxon Scan Hub. It turns exports from Nessus, Greenbone/OpenVAS, Qualys, Rapid7, Nuclei, Burp, Defender and other network, host and web scanners into clear, client-ready reports, and can open HaloPSA or ConnectWise tickets after you review them. Your first three reports are free, and a free pre-flight check shows what it can read from your export first.

— Brandon Sooknanan Founder, Varaxon Technologies