CVSS, EPSS and KEV: How to Rank What to Fix First

Severity measures what could go wrong if the flaw is used. It says little about whether anyone will use it, or whether the affected system matters to your business. A critical finding on a test server with no data can wait behind a medium finding on the login page of your customer portal. The three tools below each answer a different question, and the best order comes from reading them together with what you know about your own systems.

The Common Vulnerability Scoring System is maintained by FIRST. The current version is CVSS 4.0, released on 1 November 2023. It has four metric groups: Base, Threat, Environmental and Supplemental. Version 4.0 also made the score name say what went into it: CVSS-B is Base only, CVSS-BT adds Threat, CVSS-BE adds Environmental, and CVSS-BTE uses all three.

That naming matters when you read a report. Most scores published with a vulnerability are Base scores. They describe the flaw in the abstract and know nothing about your network. If a report gives only a Base score, ask whether the tester adjusted it for your environment, for example because the affected server is reachable only from a management network, or because it holds customer records.

The Exploit Prediction Scoring System, also run by FIRST, is a model that estimates the probability that a published CVE will be exploited in the wild in the next 30 days. It publishes a score between 0 and 1 for every CVE each day, together with a percentile, and the data is free as a CSV file and through an API. A high score means attackers are likely to try the flaw soon; a low score means it is unlikely to be tried this month, not that it is safe. Because EPSS covers only published CVEs, it says nothing about a flaw in your own application code, such as a missing permission check, which has no CVE at all.

The Known Exploited Vulnerabilities catalog is kept by CISA, the United States cyber defense agency. CISA describes it as the authoritative source of vulnerabilities that have been exploited in the wild, and advises organizations to use it as an input to their prioritization. A CVE on that list is not a prediction; it has already been used against someone. If an internet-facing system of yours runs software with a listed flaw, that finding goes to the top of the queue. The list is deliberately short, so a CVE missing from it is not a clean bill of health.

1. Listed in KEV and reachable from the internet: fix first, or isolate the system until you can.
2. High EPSS score on an important system: fix next.
3. High CVSS with a low EPSS score, or on an internal system: schedule it inside your normal patch cycle.
4. Flaws in your own code or settings: these have no CVE, so rank them by what an attacker could reach. Broken access control and exposed admin panels usually outrank a noisy medium-severity library warning.

A tool can list CVE numbers and scores. A tester adds the part a tool cannot: whether the flaw can really be reached in your setup, what chaining it with another finding would allow, and which fix removes several findings at once. When you read a report, look for that reasoning next to each rating. Our guide to reading a VAPT report shows where to find it, and the sample report shows how we write it.

If you want findings ranked for your systems and not only scored, say so when you scope the work. A vulnerability assessment gives the broad list, and a penetration test shows which items can actually be used. Send us an inquiry with a short description of your systems and we will suggest a scope.

• FIRST: CVSS v4.0 specification document
• FIRST: Exploit Prediction Scoring System (EPSS)
• CISA: Known Exploited Vulnerabilities catalog