Why CVSS Alone Is Not Enough for Vulnerability Prioritization
CVSS measures severity, not the probability or reality of exploitation. Learn how EPSS and CISA KEV complement CVSS to produce a defensible remediation backlog.
Many organizations still prioritize vulnerabilities by CVSS score alone. That approach is understandable — CVSS is widely known and easy to sort — but it is not sufficient for deciding what to fix first.
Executive summary
CVSS (Common Vulnerability Scoring System) measures the technical severity of a vulnerability in isolation. It does not measure how likely a vulnerability is to be exploited, and it does not tell you whether exploitation is already happening in the wild. Relying on severity alone causes teams to chase high-scoring issues that will never be targeted while leaving actively exploited, lower-scoring issues unpatched.
A defensible prioritization model combines three independent signals:
- Severity — how bad the impact is (CVSS).
- Probability — how likely exploitation is (EPSS).
- Reality — whether exploitation is already observed (CISA KEV).
What CVSS measures — and what it does not
CVSS produces a score from 0 to 10 based on attack vector, complexity, privileges required, user interaction, and impact. It is a useful, standardized measure of potential severity.
What CVSS does not capture:
- Whether an exploit is publicly available.
- Whether the vulnerability is actually being exploited.
- Whether the affected software is reachable in your environment.
- Whether compensating controls already reduce the risk.
A CVSS 9.8 vulnerability in a component you do not expose is not an emergency. A CVSS 6.5 vulnerability that is being actively exploited on your internet-facing service is.
EPSS: probability of exploitation
EPSS (Exploit Prediction Scoring System), maintained by FIRST, estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. It is a probability between 0 and 1, derived from a model trained on real exploitation data.
EPSS answers a different question than CVSS: not “how bad is this?” but “how likely is this to be exploited?” A high-EPSS, moderate-CVSS finding often deserves attention ahead of a high-CVSS, near-zero-EPSS finding.
CISA KEV: confirmed exploitation
The CISA Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilities with confirmed active exploitation. For organizations in scope of U.S. federal binding operational directives, KEV entries carry mandated remediation timelines — but the catalog is useful to any organization as a ground-truth signal of what attackers are actually using.
KEV should be treated as a strong prior: if a vulnerability is on the KEV list and present in your environment, it warrants immediate attention regardless of its CVSS score.
Severity vs probability vs exploitation
| Signal | Question it answers | Source |
|---|---|---|
| CVSS | How severe is the impact? | FIRST / NVD |
| EPSS | How likely is exploitation? | FIRST |
| CISA KEV | Is exploitation confirmed? | CISA |
These are complementary, not competing. The most urgent findings are those that score high on all three: severe, probable, and confirmed.
A practical prioritization approach
- Start from an accurate asset inventory — you cannot prioritize what you cannot see.
- Match vulnerabilities to the software and systems you actually run.
- Enrich each finding with CVSS, EPSS, and KEV status.
- Add environment context: internet exposure, reachability, asset criticality, and compensating controls.
- Rank by a documented rationale, not by a single number.
The output should be a backlog where every “Critical” or “High” item carries an explanation of why, not just a score.
Business impact
Prioritizing by CVSS alone has measurable consequences: teams burn remediation capacity on low-probability issues, leave actively exploited vulnerabilities open, and struggle to explain decisions to leadership or auditors. A multi-signal model focuses effort where it reduces real risk — and produces evidence you can defend.
Recommendations
- Keep CVSS as a severity input, but never as the sole prioritization criterion.
- Incorporate EPSS and CISA KEV into your vulnerability workflow.
- Enrich findings with asset and exposure context before ranking.
- Document the scoring rationale so decisions are auditable and repeatable.
References
- FIRST — CVSS: https://www.first.org/cvss/
- FIRST — EPSS: https://www.first.org/epss/
- CISA — Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- NIST — National Vulnerability Database: https://nvd.nist.gov/
Disclaimer
This content is provided for informational purposes only and does not constitute a security assessment of any specific environment. Always validate technical guidance against authoritative sources and your own architecture before acting.