Guides

CVSS, EPSS and KEV explained: how to decide which vulnerability to patch first

Thousands of CVEs are published every month and you cannot patch them all at once. Three public signals help you choose.

CVSS: how bad could it be?

CVSS scores the technical severity from 0 to 10 using factors such as network reach, complexity, privileges needed and impact. It says nothing about whether anyone is attacking the flaw. A 9.8 that needs a rare configuration can matter less than a 7.5 that is already being exploited.

EPSS: how likely is exploitation?

EPSS, from FIRST, estimates the probability that a CVE will be exploited in the next 30 days. A score of 0.50 means about a 50% chance. Most CVEs score close to zero, so a high EPSS stands out.

KEV: is it being exploited right now?

The CISA Known Exploited Vulnerabilities catalog lists flaws with confirmed exploitation in the wild. If a CVE is on KEV, treat it as urgent regardless of its CVSS score. Federal agencies must fix KEV entries by a due date, and the list is a good guide for everyone else.

A practical order

1. On KEV and reachable from the internet: patch immediately.
2. High EPSS (top 5%) or a public exploit: patch within days.
3. Critical or high CVSS, no exploitation signs: patch within your normal window (about two weeks).
4. Everything else: routine monthly patching.

This is the idea behind the priority score on every page of this site: it combines severity, EPSS, KEV, ransomware use, public exploits and remote reachability into one number, and shows the reasons. See today's ranking on the home page.

FAQ

Is a high CVSS score enough to patch first?

No. CVSS measures potential severity, not the chance of attack. Combine it with EPSS and the CISA KEV list.

What does it mean when a CVE is on the CISA KEV list?

It means exploitation in the wild has been confirmed, so it should be patched ahead of vulnerabilities that are only theoretically serious.

← All guides