When a scan returns more High and Critical findings than your team can patch this week, you need an order of work. Sorting by CVSS score feels objective, but it answers the wrong question. Combining it with EPSS, the KEV catalogue and your own asset context gives a much better one.
What CVSS measures, and what it does not
The Common Vulnerability Scoring System (CVSS), maintained by FIRST, describes how severe a vulnerability is. The base score reflects the vulnerability's intrinsic characteristics and assumes a reasonable worst case across all the environments it could be deployed in. FIRST's CVSS v4.0 user guide is explicit that base scores measure severity and "should not be used alone to assess risk".
Yet the base score is usually all you get. The same guide notes that product maintainers and the US National Vulnerability Database typically publish only base scores. Adding information about current threats and about your own environment is left to you.
A CVSS vector shows how the score was built. For example:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8, Critical)This reads as: reachable over the network, low complexity, no privileges or user interaction needed, high impact on confidentiality, integrity and availability. It says nothing about whether anyone is exploiting it, or whether the affected system in your network is exposed at all.
CVSS v3.1 and v4.0 at a glance
CVSS v4.0 was published in November 2023. Both versions use the same qualitative bands: Low 0.1 to 3.9, Medium 4.0 to 6.9, High 7.0 to 8.9 and Critical 9.0 to 10.0. You will see both versions in advisories for some time.
| Topic | CVSS v3.1 | CVSS v4.0 |
|---|---|---|
| Metric groups | Base, Temporal, Environmental | Base, Threat, Environmental, Supplemental |
| Exploit information | Temporal group with three metrics | Threat group with Exploit Maturity only |
| Wider impact | Scope metric | Separate impacts on the vulnerable system and on subsequent systems |
| Attack conditions | Attack Complexity | Attack Complexity plus a new Attack Requirements metric |
| User interaction | None or Required | None, Passive or Active |
| Labelling | One score | CVSS-B, CVSS-BT, CVSS-BE or CVSS-BTE, depending on which groups were used |
The v4.0 labels are helpful. A score marked CVSS-B is a base score only, so you know threat and environment have not been considered. Supplemental metrics, such as whether exploitation can be automated, add context without changing the score.
EPSS - how likely is exploitation?
The Exploit Prediction Scoring System (EPSS), also run by FIRST, estimates the probability that a published CVE will be exploited in the wild in the next 30 days. Scores run from 0 to 1 and are published daily for every CVE, free of charge, as a CSV download and through an API.
FIRST's user guide suggests combining EPSS with CVSS as a simple quadrant:
| Low CVSS | High CVSS | |
|---|---|---|
| High EPSS | Likely to be exploited, limited on its own; check whether it can be chained | Patch first |
| Low EPSS | Can generally be deprioritised | Severe but less likely to be exploited; monitor for changes |
The guide is equally clear about the limits. EPSS covers only the threat side of risk, so it "should never be treated as a risk score". It does not know which systems you run, how exposed they are or what data they hold. A low score also never means zero.
KEV - is it already being exploited?
The CISA Known Exploited Vulnerabilities (KEV) catalogue lists vulnerabilities with reliable evidence of exploitation in the wild. A vulnerability is only added when three conditions are met:
- it has a CVE ID
- there is reliable evidence of active exploitation; scanning, research and proof-of-concept code alone do not count
- there is clear remediation guidance, such as a vendor update
Binding Operational Directive 22-01 requires US federal civilian agencies to fix KEV entries by set deadlines. Other organisations are not bound by it, but CISA strongly recommends that everyone treats KEV entries as a priority in their vulnerability management.
European organisations have a second source. ENISA's European Vulnerability Database (EUVD), operational since May 2025 under the NIS2 Directive, includes a dashboard of exploited vulnerabilities. CVE data, vendor advisories and the KEV catalogue are automatically fed into it.
A simple prioritisation approach
Use KEV and EPSS to decide how urgent something is, and your own asset knowledge to decide where it matters. The tiers below are a starting point we suggest, not a standard. Adjust the timings to your own capacity and risk appetite.
| Tier | Condition | Suggested target |
|---|---|---|
| 1 | In KEV or flagged as exploited in EUVD, on an internet-facing or business-critical system | Days, using mitigations if no patch is possible yet |
| 2 | In KEV on internal systems, or high EPSS on an exposed system | Next patch cycle, within about two weeks |
| 3 | High or Critical CVSS with low EPSS, not exposed | Normal monthly cycle; recheck EPSS and KEV regularly |
| 4 | Everything else | Routine maintenance, or accept the risk and record why |
Asset context is what turns a score into a decision. Ask three questions of every system: is it reachable from the internet, what data or access does it hold, and what would an outage cost? In CVSS terms, these are your environmental metrics.
An illustrative example
Imagine two findings on the same day. The first is rated 9.8 on an internal test server with no sensitive data, with a low EPSS score and no KEV entry. The second is a 7.8 local privilege escalation in the KEV catalogue, present on every staff laptop.
Sorting by score puts the first one on top. The approach above puts the second one first. It is being exploited, and it sits on every laptop, where one successful phishing email can give an attacker the foothold it needs. The test server still gets fixed, in the normal cycle.
Where to start
- Make sure your scanner or asset inventory records the CVE ID for every finding.
- Pull in the daily EPSS scores and the KEV list, or use a tool that already does.
- Tag assets by exposure and business importance, even if only as "internet-facing" and "critical".
- Agree target times per tier with management and track them.
- When an advisory gives only a vector, read it with our CVSS calculator and adjust it to your environment.
If you would rather have this run continuously, our managed security service can take on vulnerability tracking and prioritisation for you.
