In vulnerability management, one of the biggest challenges is not finding vulnerabilities—it is deciding which ones to fix first. Security teams often rely on three important sources of information: the Common Vulnerability Scoring System (CVSS), the Exploit Prediction Scoring System (EPSS), and the CISA Known Exploited Vulnerabilities (KEV) Catalog.
But what happens when these sources send different signals?
A vulnerability might have a critical CVSS score but a low EPSS score. Another might have a moderate CVSS score but a high probability of exploitation. A third might appear less severe on paper but already be actively exploited in the wild.
The key is to understand what each signal tells you and combine them with real-world threat intelligence and business context. This allows security teams to move beyond severity-based patching and focus on the vulnerabilities that pose the greatest risk to their organization.
Before prioritizing vulnerabilities, it is important to understand the purpose of each metric.
The Common Vulnerability Scoring System (CVSS) measures the technical severity of a vulnerability. It considers factors such as exploitability, required privileges, user interaction, and potential impact on confidentiality, integrity, and availability.
CVSS scores range from 0.0 to 10.0.
CVSS helps security teams understand how damaging a vulnerability could be if exploited.
However, a high CVSS score does not necessarily mean attackers are actively exploiting the vulnerability. It describes severity, not the likelihood of exploitation in the real world.
The Exploit Prediction Scoring System (EPSS) estimates the probability that a software vulnerability will be exploited in the wild over the next 30 days.
EPSS provides a probability score between 0 and 1, which can also be expressed as a percentage.
For example, an EPSS score of 0.75 indicates an estimated 75% probability of exploitation within the next 30 days, according to the model's prediction.
EPSS helps security teams identify vulnerabilities that may attract attackers, even when their CVSS severity is not critical.
However, EPSS is a prediction, not confirmation that exploitation has occurred. A low score also does not guarantee that a vulnerability is safe to ignore.
The CISA Known Exploited Vulnerabilities (KEV) Catalog identifies vulnerabilities for which exploitation has been observed in the wild.
Inclusion in the catalog provides an important signal that a vulnerability is associated with real-world attacks.
Unlike CVSS, which measures severity, or EPSS, which estimates exploitation probability, CISA KEV provides evidence of known exploitation.
Organizations should treat KEV-listed vulnerabilities as high-priority remediation candidates, particularly when the affected systems are exposed or business-critical. Applicable regulatory requirements and remediation deadlines should also be considered.
Each metric answers a different question, so conflicting scores are not necessarily contradictory. They provide different perspectives on the same vulnerability.
Consider these common scenarios.
The vulnerability could cause significant damage, but current data suggests a relatively low likelihood of exploitation. It still requires assessment based on exposure, asset criticality, and available mitigations.
Attackers may have a strong incentive to exploit the vulnerability despite its moderate severity. Security teams should investigate exposure and remediation options instead of dismissing it because of its CVSS score.
This is a particularly important case. Known exploitation has been documented, even though the predicted exploitation probability is low. KEV inclusion should trigger urgent investigation and remediation based on organizational exposure and applicable requirements.
These scenarios highlight why relying on a single score can create blind spots in vulnerability management.
Instead of treating CVSS, EPSS, and KEV as competing scores, use them as complementary inputs in a risk-based prioritization process.
Start by checking whether the CVE appears in the CISA KEV Catalog.
If it does, elevate its priority and determine whether the affected assets are vulnerable, reachable by potential attackers, and important to business operations.
For organizations subject to specific compliance obligations, check the applicable remediation deadlines. For example, Binding Operational Directive 22-01 establishes requirements for Federal Civilian Executive Branch agencies; it is not a universal deadline for every private organization.
If a vulnerability is not in KEV, continue evaluating its severity, exploitation probability, and environmental context. Absence from the catalog does not mean absence of risk.
Next, review the latest EPSS score and percentile.
A high EPSS score can help identify vulnerabilities that deserve attention even when their severity is moderate or high rather than critical. The percentile provides additional context by showing how the vulnerability ranks against other vulnerabilities in the EPSS dataset.
Use EPSS to support prioritization, not as an absolute cutoff. Thresholds should reflect the organization's risk tolerance, exposure, and remediation capacity.
CVSS remains an important input because it describes the technical characteristics and potential consequences of exploitation.
A critical vulnerability affecting a public-facing authentication service may deserve faster remediation than a similarly scored issue on an isolated test system.
Consider both the CVSS score and its underlying vector, including attack complexity, privileges required, and potential impact.
Threat intelligence alone does not determine business risk. The affected asset matters just as much.
Evaluate whether the vulnerable system is:
A vulnerability with moderate technical severity can become a high business risk when it affects a critical, exposed asset.
Combine these signals into an actionable decision rather than simply averaging their scores.
The following framework can serve as a starting point.
These categories are illustrative, not universal deadlines. Organizations should define their own SLAs and escalation rules based on risk, operational constraints, and applicable obligations.
Imagine a security team identifies three vulnerabilities across its infrastructure.
There is no universal ranking for all three based on these figures alone. If Vulnerability A affects an exposed, business-critical system while Vulnerability B exists only on a segmented internal server, their actual priorities could change.
The lesson is simple: the highest CVSS score should not automatically win, and a low EPSS score should not override known exploitation.
Even with access to multiple risk signals, organizations can make prioritization mistakes.
Severity-based patching can consume valuable resources on vulnerabilities that are less likely to be exploited while leaving more immediate threats unresolved.
EPSS is a predictive model. Threat activity, available exploit code, and attacker behavior can change, so scores should be reassessed regularly.
Known exploitation is a strong reason to investigate and elevate a vulnerability. A moderate severity rating does not eliminate the risk of real-world attacks.
A fixed EPSS cutoff or CVSS threshold can hide important context. Use thresholds as decision aids, combined with asset exposure, business impact, and security requirements.
A vulnerability's priority can change when new exploit intelligence emerges, a CVE is added to KEV, or an asset becomes exposed. Prioritization should be an ongoing process rather than a one-time assessment.
SecOps Solution helps organizations strengthen vulnerability management by identifying vulnerabilities, assessing risk, and supporting remediation workflows through its vulnerability and patch management capabilities.
By bringing vulnerability information and risk prioritization into the security workflow, teams can make more informed decisions about which issues need attention first.
Its Athera vulnerability management solution supports risk prioritization using factors such as CVSS, EPSS, and the CISA KEV Catalog, helping security teams assess vulnerabilities beyond severity scores alone. Organizations can use this context to focus their remediation efforts on vulnerabilities that present more meaningful risks to their environments.
For teams managing large and distributed infrastructures, a structured approach to vulnerability prioritization can help reduce alert overload, improve remediation planning, and make security operations more efficient.
Learn more about Athera
When CVSS, EPSS, and CISA KEV give different signals, the solution is not to choose one metric and ignore the others. Each provides a distinct piece of the risk picture.
CVSS explains how severe a vulnerability could be. EPSS estimates how likely it is to be exploited. CISA KEV indicates that exploitation has been observed in the wild.
By combining these signals with asset criticality, exposure, business impact, and remediation requirements, organizations can build a more effective, risk-based vulnerability management strategy.
The ultimate goal is not to patch vulnerabilities in score order. It is to remediate the vulnerabilities that pose the greatest risk to the organization—before attackers can take advantage of them.
SecOps Solution is an agentless patch and vulnerability management platform that helps organizations quickly remediate security risks across operating systems and third-party applications, both on-prem and remote.
Contact us to learn more.
.jpg)
.jpg)
