How to Prioritize Vulnerability Patching: CVSS, EPSS and CISA KEV

Most security teams cannot patch everything at once. Three free, public signals help you decide what to fix first: CVSS tells you how severe a flaw is, EPSS estimates how likely it is to be exploited, and the CISA KEV catalog lists flaws that are already being exploited. This guide shows how to combine them into a simple triage order.

What each signal tells you

CVSS scores the technical severity of a vulnerability from 0.0 to 10.0 (Low 0.1–3.9, Medium 4.0–6.9, High 7.0–8.9, Critical 9.0–10.0). It describes the flaw itself, not the risk to your environment.
EPSS (Exploit Prediction Scoring System, from FIRST) gives the estimated probability, between 0 and 1, that a CVE will be exploited in the wild in the next 30 days. It is updated daily and also published as a percentile.
The CISA Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilities with evidence of active exploitation. US federal civilian agencies must remediate KEV entries by a due date, and many other organisations use it as a priority list.

A practical triage order

Use this as a starting point and adjust it to your own risk appetite and change windows.

Fix first: the CVE is in KEV and the affected product is exposed to the internet or to untrusted users. Treat this as an emergency change.
Fix next: a high EPSS score (or high percentile) on a reachable system, even if the CVSS score is only Medium or High.
Schedule and mitigate: a High or Critical CVSS score with low EPSS on a system that is not exposed. Patch in the normal cycle and add compensating controls such as segmentation or a WAF rule if the patch must wait.
Batch with routine maintenance: low CVSS, low EPSS, internal systems.

Add context the scores cannot see

Exposure: is the service reachable from the internet, a partner network or only from an admin segment?
Asset value: does the system hold sensitive data or sit on a critical business path?
Compensating controls: segmentation, authentication in front of the service, EDR coverage, virtual patching.
Exploit availability: a public proof of concept or exploit kit raises urgency even before KEV lists the flaw.
Patch practicality: vendor fix available, downtime needed, rollback plan.

A simple illustrative example

Imagine two findings on the same day. Finding A has a CVSS score of 9.8 but sits on an isolated lab host, has low EPSS and is not in KEV. Finding B has a CVSS score of 7.5, is listed in KEV and affects a VPN gateway that faces the internet. A CVSS-only queue puts A first. A KEV-and-exposure queue correctly puts B first, because attackers are already using that flaw against reachable systems. (This example is hypothetical and is only meant to show the reasoning.)

Common mistakes

Sorting only by CVSS base score, which treats a lab host and an internet-facing gateway the same.
Treating EPSS as a verdict. It is a probability, so a low score is not a guarantee of safety.
Ignoring KEV due dates and additions. KEV changes as new exploitation is confirmed, so check it regularly.
Using stale data. EPSS is refreshed daily and new KEV entries are added often, so re-run your prioritisation rather than relying on last month’s list.

Follow exploited vulnerabilities as they happen

Our vulnerability coverage calls out when a flaw is exploited or added to KEV, and the weekly digest collects the week’s most important patches in one place. To scope exposed networks while you triage, try the subnet calculator, and see our guide to CVE identifiers if you want to understand the IDs in these reports.