Use all three signals for different jobs: treat CISA’s Known Exploited Vulnerabilities (KEV) Catalog as a priority trigger when it lists a vulnerability, use EPSS to rank vulnerabilities without confirmed exploitation evidence, and use CVSS to understand technical severity and impact. Then account for your own exposure, asset importance, compensating controls, and remediation capacity. CVSS alone is not organizational risk, and multiplying CVSS by EPSS does not create a meaningful combined score.
So, should you prioritize CVSS, EPSS, or CISA KEV when deciding what to patch first? Start with KEV and any deadlines that apply to your organization; use EPSS and CVSS as distinct inputs to decide what comes next.
As an Amazon Associate I earn from qualifying purchases.
What each signal tells you
| Signal | What it measures | Best use | Important limitation |
|---|---|---|---|
| CVSS | Standardized technical characteristics and severity. The Base group describes intrinsic vulnerability characteristics; Environmental scoring can add organization-specific context. | Understand potential technical impact. Examine the underlying metrics and vector, not just the headline score. | A CVSS Base score by itself is not organizational risk or a sufficient patch-priority rule. FIRST CVSS v3.1 User Guide; FIRST CVSS v4.0 User Guide |
| EPSS | A data-driven estimate from 0 to 1 of the probability that a published CVE will be exploited in the wild in the next 30 days. Scores and percentiles are published daily. | Rank vulnerabilities where direct exploitation evidence is absent; choose thresholds based on your capacity and risk tolerance. | It is a population-level forecast, not a guarantee about an individual CVE or a replacement for local context. FIRST EPSS; FIRST EPSS FAQ |
| CISA KEV | A living catalog of CVEs for which CISA identifies evidence of active exploitation. | Use catalog presence as a strong prioritization trigger. Covered Federal Civilian Executive Branch agencies must meet applicable BOD 22-01 due dates; CISA urges other organizations to prioritize timely remediation too. | It is not a complete list of every vulnerability that may be exploited. Catalog inclusion records exploitation evidence; EPSS forecasts exploitation probability. CISA Known Exploited Vulnerabilities Catalog |
The measures are not interchangeable: CVSS addresses technical severity, EPSS estimates near-term exploitation likelihood, and KEV records vulnerabilities CISA identifies as actively exploited. A single CVE can therefore have a high CVSS score, a low EPSS score, or KEV inclusion without those signals contradicting one another.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchHow to order remediation work
- Check KEV and obligations. Match the CVE to the affected product and version, confirm whether the component is present and exposed in your environment, and check any due date that applies to your organization. BOD 22-01 requires covered federal agencies to remediate catalog entries by their listed due dates. CISA’s August 12, 2025 alert says it strongly urges other organizations to prioritize timely remediation as well. CISA KEV Catalog
- Rank the remaining vulnerabilities with EPSS. A higher score means a higher estimated chance of observed exploitation in the wild over the next 30 days, not certainty that a specific CVE will be exploited. Since EPSS scores are updated daily, use and record the score date when making operational decisions. FIRST EPSS
- Use CVSS to understand technical consequences. Review the metrics and vector behind the score; apply Environmental context where appropriate. A high Base score can flag serious technical impact, but FIRST cautions that it should not alone determine patch priority. FIRST CVSS v4.0 FAQ
- Apply local exposure and impact. Determine whether the vulnerable component is reachable, exposed, and important to business operations. Consider effective compensating controls and the work required to remediate. Prioritize the combination of genuine exposure, likely exploitation, and meaningful impact.
- Keep the signals separate in your decision record. Document KEV status and applicable due dates, EPSS score and date, CVSS vector and relevant context, plus the asset and exposure factors that shaped the schedule.
How to handle conflicting signals
What if a CVE is in KEV but has a low EPSS score?
Follow KEV as the stronger priority signal. The two measures answer different questions: KEV reflects CISA’s evidence of exploitation, while EPSS is a forward-looking estimate of exploitation probability over the next 30 days. FIRST’s practitioner guidance says to follow KEV when the signals conflict. FIRST EPSS FAQ
#1 Best Overall
Does a high CVSS score mean you must patch immediately?
Not by itself. CVSS communicates technical severity, not whether the affected asset is exposed in your environment or how much harm exploitation would cause there. Use the score and its metrics to inform your assessment, then consider reachability, business consequence, controls, and exploitation evidence.
What if a vulnerability is not in KEV?
Absence from KEV does not establish that a vulnerability is safe or that no exploitation is occurring. CISA describes KEV as a living catalog based on exploitation evidence, not a complete inventory of every vulnerability that may be exploited. Use EPSS to help rank the wider population, then apply CVSS and local context.
Choosing an EPSS threshold
There is no universal EPSS cutoff. FIRST says a useful threshold depends on remediation capacity, risk tolerance, and asset context. Test candidate thresholds against the work they would create and the expected exploitation coverage, then adopt a threshold your team can sustain. Threshold translations in FIRST guidance are starting points for programs moving from CVSS-based filtering, not universal policy. FIRST EPSS FAQ; FIRST EPSS User Guide
Interpret EPSS as a calibrated probability across groups of vulnerabilities with similar scores: it can estimate aggregate rates, but it does not promise that an individual CVE will or will not be exploited. Recheck the score and its date as priorities change, since scores are published daily. FIRST EPSS; Why Use EPSS?
Rank #3
Why not multiply CVSS by EPSS?
Because the result has no interpretable meaning. EPSS is a calibrated probability; CVSS is a severity assessment. Multiplying a probability by a severity score does not produce a valid probability or a reliable combined risk measure. FIRST explicitly warns against treating that product as a meaningful score. Keep the inputs visible and make the prioritization decision using a documented method that includes local conditions. FIRST EPSS FAQ
Quick Recap
Rank #4
A practical decision rule
- KEV-listed: verify the affected asset and exposure, then prioritize remediation and meet any applicable deadline.
- Not KEV-listed: use EPSS to sort by estimated near-term exploitation likelihood, and use CVSS metrics to understand potential technical impact.
- In every case: adjust the schedule for reachability, business consequence, compensating controls, and remediation capacity; do not let one score stand in for the full decision.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
