Guides
CVSS, EPSS and KEV: how to use them together
Three different measures to decide which vulnerabilities to fix first: how severe it is, how likely it is to be exploited, whether it is already exploited.
Three different questions
More than a hundred vulnerabilities with a CVE ID are published every day: fixing them all at once is impossible, so you need an order. The three most widely used measures answer different questions:
- CVSS: how severe would it be if someone exploited it?
- EPSS: how likely is it to be exploited in the next 30 days?
- KEV: is it already exploited in real attacks?
None of them is enough on its own. Together, and with the context of whoever uses the products, they tell you what to fix first.
CVSS: technical severity
The Common Vulnerability Scoring System, maintained by FIRST, gives each vulnerability a score from 0 to 10 based on its characteristics: where it can be attacked from, how complex the attack is, whether credentials or user interaction are needed, and what the attacker gains (data, changes, service disruption). The bands are: none (0), low (0.1 to 3.9), medium (4.0 to 6.9), high (7.0 to 8.9) and critical (9.0 to 10.0).
The score comes with a vector, for example AV:N/AC:L/PR:N/UI:N: attackable over the network (AV:N), without credentials (PR:N) and without user interaction (UI:N). It is often more useful than the number.
The limit: CVSS measures severity, not risk. Many critical vulnerabilities are never exploited, and some medium ones end up in attack campaigns. The versions in use are 3.1 and 4.0.
EPSS: probability of exploitation
The Exploit Prediction Scoring System, also from FIRST, estimates every day, for every published CVE, the probability that it will be exploited in the following 30 days. The model learns from observed attacks and from features such as the availability of a public exploit or the type of product.
It is read in two ways: the probability (for example 5%) and the percentile (for example 92%, a score higher than that of 92% of CVEs). Probabilities are almost always low: even a few percentage points put a vulnerability among the most likely.
The limit: it is a statistical estimate, which changes quickly when an exploit appears, and it does not know whether you use the product or whether it is exposed to the internet.
KEV: confirmed exploitation
The Known Exploited Vulnerabilities catalogue of CISA, the US cybersecurity agency, has listed since November 2021 the vulnerabilities with reliable evidence of exploitation in real attacks. An entry needs a CVE ID, evidence of active exploitation and clear remediation guidance; for each entry the catalogue also says whether it has been used in ransomware campaigns.
For US federal agencies every entry has a remediation deadline; for everyone else it is the most widely used reference of vulnerabilities that are really exploited. In Europe, ENISA publishes the European Vulnerability Database (EUVD), set up by the NIS2 directive, which also flags exploited ones.
The limit: a vulnerability enters the catalogue after the first evidence of exploitation, and not every exploited vulnerability makes it there. The catalogue entries, vendor by vendor, are on the exploited vulnerabilities page.
How to use them together
A practical order, for the products you actually use:
- First the ones already exploited: in the KEV catalogue or with exploitation confirmed by official sources, starting with systems reachable from the internet and edge devices (firewalls, VPNs, gateways).
- Then the likely and severe ones: high EPSS and high CVSS, especially if attackable over the network without credentials.
- Then the rest, in the normal update cycle.
Context weighs more than numbers: the same score matters much more on a system exposed to the internet than on an internal one. That is why the first thing to know is which products you use, and where.
How DefenceLevel uses them
The DEFCON level of the day is calculated by explicit, verifiable rules: technical severity starts from the official CVSS score, the probability of exploitation also takes EPSS into account, and exploitation is confirmed by official sources such as the KEV catalogue, national CERTs and vendors, together with the attention of hundreds of sources. Thresholds and weights are in the methodology.
For every CVE that appeared in the briefings of the last 12 months, its page shows CVSS, EPSS, the addition to the KEV catalogue and the days it appeared in the briefings.
Frequently asked questions
Must a vulnerability with CVSS 9.8 be fixed immediately?
If you use the product and the vulnerability is already exploited, or likely according to EPSS, yes. Otherwise it can go into the normal update cycle: a high score says how severe it would be, not that someone is using it.
Does a low EPSS mean I am safe?
No. It is an estimate that changes every day, and evidence of exploitation always counts more than the estimate: a vulnerability in the KEV catalogue must be treated as exploited, whatever its EPSS.
Does the KEV catalogue apply in Europe too?
The catalogue belongs to CISA, but vulnerabilities are the same everywhere: it is a reference used worldwide. In Europe there is also the ENISA database (EUVD).
Where can I find this data for a CVE?
On NVD and cve.org for every CVE; on DefenceLevel, on the CVE's page, if it appeared in the briefings of the last 12 months.