CVSS vs EPSS vs KEV: Which One Should Decide What You Patch First?

The short version

CVSS: how bad the flaw is

The Common Vulnerability Scoring System captures the main characteristics of a vulnerability and turns them into a score that reflects its severity. The base score is built from the flaw’s own characteristics, which do not change over time.

• Versions in use. CVSS v4.0 is the current version, first published in November 2023. It has four metric groups: Base, Threat, Environmental and Supplemental. Many records still carry v3.1 scores, which use three groups: Base, Temporal and Environmental. Older CVEs on NVD can also show a v2 score.
• The ratings. In v3.1, 0.1 to 3.9 is Low, 4.0 to 6.9 is Medium, 7.0 to 8.9 is High and 9.0 to 10.0 is Critical.
• What it leaves out. FIRST’s own v4.0 FAQ says base scores are not risk and should not be used alone for patch prioritisation. A high score says the flaw would be serious if used, not that anyone is using it.

EPSS: how likely exploitation is

The Exploit Prediction Scoring System is a machine-learning model that estimates the probability that a published CVE will be exploited in the wild in the next 30 days. More precisely, the score estimates how likely it is that EPSS data partners will detect and record exploitation activity for that CVE in the next 30 days. A new score is published every day for every CVE.

• Probability. 0.05 means a 5% estimated chance of observed exploitation activity in the next 30 days. Among many CVEs scored around 0.05, about 1 in 20 would be expected to see it.
• Percentile. A relative rank. A CVE at the 90th percentile has a higher EPSS score than 90% of all scored CVEs. Most scores sit near zero, so FIRST notes that a probability of 0.10 currently sits around the 95th percentile.
• Model version. The model is retrained from time to time. The daily score file for 28 October 2026 names the model version as v2026.06.15.
• What it leaves out. EPSS does not measure how much damage exploitation would cause, or whether the flaw affects your environment. FIRST describes it as an input to a risk decision, not a complete risk score.

CISA KEV: what is already being exploited

The Known Exploited Vulnerabilities catalog is CISA’s list of vulnerabilities that have been exploited in the wild. A vulnerability goes on the list only when all three of these are true:

• It has a CVE ID.
• There is reliable evidence that it has been actively exploited in the wild.
• There is a clear remediation action, such as a vendor update.

The catalog held 1,760 entries in the version released on 27 October 2026. Each entry carries the date it was added, a required action, a due date, and whether it is known to have been used in ransomware campaigns.

Due dates and the directives behind them. Binding Operational Directive 22-01, issued on 3 November 2021, required US federal civilian agencies to fix KEV entries by their due dates: within six months for CVEs assigned before 2021, and within two weeks for the rest. On 10 June 2026 CISA revoked BOD 22-01 and replaced it with BOD 26-04, which sets timelines based on KEV status, whether the asset is publicly exposed, whether the exploit can be automated and the technical impact. The shortest timeline in BOD 26-04 is three days.

These directives bind US federal agencies only. CISA still recommends that every organisation make addressing KEV vulnerabilities part of its vulnerability management plan.

How they differ

• Severity, likelihood, evidence. CVSS describes the flaw. EPSS predicts what attackers will do next. KEV records what they have already done.
• Fixed versus moving. A CVSS base score stays the same. An EPSS score can change overnight when new signals arrive, such as public exploit code. A KEV entry, once added, tells you exploitation has been confirmed.
• Coverage. Every CVE can have a CVSS and an EPSS score. KEV is small by design: FIRST notes it lists roughly 0.5% of published CVEs, while exploitation activity is seen for roughly 2.5 to 3% in any 30-day window. Not being in KEV does not mean a CVE is safe.

Worked example: CVE-2017-0144

CVE-2017-0144 is a remote code execution flaw in the SMBv1 server in Windows. Microsoft fixed it in security bulletin MS17-010 on 14 March 2017. Here is what each source says about it:

Sorted by CVSS alone, this flaw sits behind every Critical finding in your queue. EPSS and KEV both say it belongs at the top. The six-month due date also matches the BOD 22-01 rule for CVEs assigned before 2021.

A simple patch order for a small team

This is our suggestion, not a standard. Adjust the thresholds to the time your team has.

• 1. Anything in KEV. Fix KEV entries found on your machines first, starting with machines reachable from the internet.
• 2. High EPSS next. Then fix CVEs with an EPSS probability of 0.1 or more. Raise the line if the list is longer than you can work through.
• 3. Everything else by CVSS. Work through the rest in your normal patch cycle, Critical before High.
• 4. Use CVSS to judge impact, not to rank alone. Within each group, the CVSS score helps decide which fix comes first. Do not multiply the scores together.

How Sentrivox uses these sources

Sentrivox enriches vulnerability findings with NVD, CISA KEV, EPSS and Microsoft MSRC data, so the inputs for a rule like the one above come from the same public sources described here.