In one line: patch what is on CISA KEV first (it is confirmed exploited), use EPSS to rank the rest by how likely they are to be attacked, and use CVSS to judge how bad the damage would be. Severity (CVSS) is not the same as likelihood (EPSS), and neither is the same as confirmed attacks (KEV).
At a glance
| CVSS | EPSS | CISA KEV | |
|---|---|---|---|
| What it measures | Severity — how much damage if exploited | Probability it will be exploited in the next 30 days | Confirmed exploitation in the wild (evidence, not a guess) |
| Output | Score 0.0–10.0 (Low–Critical) | Probability 0–100% + a ranking percentile | A yes/no catalog entry |
| Maintained by | FIRST.org (CVSS SIG) | FIRST.org (EPSS SIG) | CISA (US government) |
| Updates | When the CVE is published or revised | Every day, for every CVE | When CISA confirms exploitation |
| Answers | “How bad would this be?” | “How likely is it to be attacked soon?” | “Is it being attacked right now?” |
| Best used for | Impact context and tie-breaking | Ranking vulnerabilities not yet known-exploited | Your drop-everything patch list |
CVSS — how severe is it?
The Common Vulnerability Scoring System, maintained by FIRST.org, produces a 0.0–10.0 score that captures a vulnerability’s severity — the difficulty of exploiting it and the impact if it is. Scores map to Low, Medium, High and Critical. CVSS v4.0 is the current version (2023).
Crucially, CVSS is not a measure of how likely a vulnerability is to be exploited. A 9.8 “Critical” describes worst-case damage, not the odds of an attack. Relying on CVSS alone tends to flag far more “must-fix” vulnerabilities than any team can realistically patch.
EPSS — how likely is it to be exploited?
The Exploit Prediction Scoring System, also from FIRST.org, is a data-driven model that estimates the probability a vulnerability will be exploited in the wild in the next 30 days. It outputs a value from 0 to 100%, plus a percentile ranking it against every other CVE, and is republished every day.
Because it targets likelihood rather than severity, EPSS is well suited to ranking the large pool of vulnerabilities that are not (yet) known to be exploited. A high percentile is a strong signal to move a vulnerability up the queue.
CISA KEV — is it being exploited right now?
The Known Exploited Vulnerabilities catalog from CISA lists vulnerabilities with reliable evidence of active exploitation in the wild. It is not a score or a forecast — it is confirmed fact. The catalog currently holds 1,687 entries, of which 21% are linked to ransomware campaigns.
Under CISA directive BOD 22-01, US federal agencies must remediate KEV entries by a set due date. For everyone else, KEV is the clearest “patch this now” signal available — see our State of Exploited Vulnerabilities and how fast vulnerabilities get exploited.
How to prioritize with all three
- KEV first. If a vulnerability is on the CISA KEV catalog, it is confirmed exploited — patch it before anything that is only theoretically risky.
- Then rank by EPSS. Among vulnerabilities not on KEV, the highest EPSS scores and percentiles are the most likely to be attacked next.
- Use CVSS for impact. Let severity break ties and weight against how critical the affected asset is — not as the sole driver of what to fix first.
The three are complementary, not competing: KEV tells you what is happening, EPSS tells you what is likely, and CVSS tells you how much it would hurt.
Frequently asked questions
What is the difference between CVSS and EPSS?
CVSS measures a vulnerability’s severity — how much damage it could do if exploited — on a 0–10 scale. EPSS measures something different: the probability (0–100%) that the vulnerability will actually be exploited in the wild within the next 30 days. A flaw can be Critical on CVSS yet have a low EPSS score, meaning it is severe but unlikely to be attacked soon.
What is the CISA KEV catalog?
The CISA Known Exploited Vulnerabilities (KEV) catalog is a list of vulnerabilities with reliable evidence of active exploitation in the wild. Unlike CVSS and EPSS, it is not a score or a prediction — it is confirmed fact. It currently holds 1,687 entries, and US federal agencies must remediate them by set deadlines under CISA directive BOD 22-01.
Should I use CVSS or EPSS to prioritize patching?
Use all three, in order. Patch anything on the CISA KEV catalog first, because it is confirmed exploited. Among the rest, rank by EPSS to surface what is most likely to be attacked next. Use CVSS for impact context — how severe the damage would be — rather than as a standalone predictor of what gets attacked.
Does a high CVSS score mean a vulnerability will be exploited?
No. CVSS reflects potential severity, not the likelihood of attack. Most published vulnerabilities — including many rated Critical — are never confirmed exploited. That gap is exactly why EPSS (likelihood) and the CISA KEV catalog (confirmed exploitation) exist alongside CVSS.
How often is EPSS updated?
EPSS is recalculated and published every day for every CVE, so a vulnerability’s exploitation probability can rise or fall over time as new evidence appears.
Definitions are drawn from FIRST.org (CVSS, EPSS) and CISA (KEV). Live counts are direct, daily-refreshed counts over the CISA KEV catalog. Snapshot as of 2026-09-02.