CVSS vs EPSS vs KEV: Which Signal Should Drive Vulnerability Priority?

CVSS, EPSS, and the CISA Known Exploited Vulnerabilities catalog answer different questions. CVSS describes technical severity characteristics. EPSS estimates the probability that a published CVE will be exploited in the wild in the next 30 days. KEV records evidence that exploitation has occurred. None knows whether you run the affected product, expose it, can detect it, or would suffer major consequence.

Use the signals together, then let local context determine the action.

Read Each Signal Correctly

CVSS v4.0 distinguishes Base, Threat, Environmental, and Supplemental metrics; the Base score is severity, not a complete risk score. EPSS is updated daily and estimates 30-day exploitation probability, not impact. CISA KEV is evidence of exploitation in the wild and should be an input to prioritization.

Preserve version, vector, score date, and source because the values and underlying evidence can change.

Add the Context That Changes Action

Confirm affected version and configuration, reachable path, asset owner, business and safety consequence, control strength, threat relevance, exploit reliability, active targeting, remediation cost, workaround, and recovery. Give extra urgency to exposed assets with known exploitation or credible targeted activity.

Keep an exception path for rare but intolerable consequences and for evidence newer than public scoring.

Use Rules to Queue, Analysts to Resolve Exceptions

Automate signal refresh, asset matching, deadlines, and expiry. Show why an item is high, which data is missing, and what would lower priority. Review thresholds against later exploitation and incident outcomes.

For the complete prioritization workflow, see Vulnerability Intelligence: What to Fix First. A useful queue tells an owner what to do and why—not merely which number is largest.