CVSS, EPSS and CISA KEV are often placed beside each other in vulnerability dashboards. They are not three versions of the same score. Each answers a different question.
CVSS: how severe could the vulnerability be?
CVSS describes technical characteristics and impact. The Base score is designed to be consistent across environments. FIRST explicitly states that the CVSS Base score measures severity, not risk, and should not be used alone for patch prioritisation. The vector is as important as the number because it explains attack vector, complexity, privileges, user interaction and impact.
EPSS: how likely is exploitation soon?
FIRST EPSS estimates the probability that a published CVE will be exploited in the wild during the next 30 days. It is updated daily and also provides a percentile showing where the score sits relative to other CVEs. EPSS is population-level evidence. It does not know whether you use the affected product, whether the system is exposed or what controls you have.
CISA KEV: is there evidence of exploitation?
CISA’s Known Exploited Vulnerabilities catalog identifies vulnerabilities with evidence of active exploitation and provides required actions for US federal civilian agencies. CISA encourages wider organisations to use KEV as an input to prioritisation. KEV is a strong authority signal, but it still does not establish whether the vulnerability is present and reachable in your environment.
How to combine them
| Evidence | Question | Operational use |
|---|---|---|
| CVSS | What is the technical severity? | Understand impact and exploitation conditions. |
| EPSS | How likely is exploitation in the next 30 days? | Rank large populations and identify rising probability. |
| KEV | Is exploitation confirmed? | Accelerate exposure validation and treatment. |
The decision sequence
- Confirm the affected product and version exist.
- Establish reachability and exposure.
- Use KEV and credible exploitation evidence to identify immediate threats.
- Use EPSS to distinguish higher-probability issues across the remaining population.
- Use CVSS vectors and vendor guidance to understand technical consequences.
- Add asset criticality, controls and operational constraints.
That is why a CVSS 7.5 in KEV on an internet-facing appliance can justify action ahead of an unexposed CVSS 9.8 with negligible exploitation evidence.
Primary references
FIRST CVSS v4.0 User Guide, FIRST EPSS and the CISA KEV Catalog.