CVSS scores how severe a vulnerability is on paper. EPSS estimates how likely it is to be exploited in the next 30 days. SSVC is a decision method that tells you how urgently to act. They answer different questions, so use them together, not as substitutes for each other.
What is CVSS?
The Common Vulnerability Scoring System is a published standard from FIRST for describing a vulnerability's main characteristics and producing a number from 0 to 10. The qualitative labels are the same in v3.1 and v4.0: None is 0.0, Low is 0.1 to 3.9, Medium is 4.0 to 6.9, High is 7.0 to 8.9, and Critical is 9.0 to 10.0. FIRST says using the labels is optional.
CVSS describes severity, not your risk. The specification says factors such as the number of customers affected, money lost and threat to life or property are outside its scope. A 9.8 in a library you never call can matter less than a 6.5 on your public login page.
What changed from v3.1 to v4.0?
v3.1 has three metric groups: Base, Temporal and Environmental. Base holds the qualities that stay constant, Temporal covers things that change over time such as exploit availability and patch status, and Environmental covers your own setting.
FIRST's page says v4.0 is the current version, with its initial release in November 2023. v4.0 has four groups: Base, Threat, Environmental and Supplemental. Supplemental adds context that does not change the score.
The practical change is naming. v4.0 says a score should be labeled by what went into it: CVSS-B for Base only, CVSS-BT for Base and Threat, CVSS-BE for Base and Environmental, and CVSS-BTE for all three. If a tool shows you "8.1" without that label, ask which one it is. Most public databases publish Base scores, so many numbers you see are CVSS-B.
What is EPSS?
The Exploit Prediction Scoring System is a machine learning model from FIRST. It gives each published CVE a probability, from 0 to 1, of being exploited in the wild in the next 30 days, updated daily, plus a percentile showing where that CVE ranks against all others. It is built on observed exploitation data, not opinion, and the data is free.
EPSS says nothing about impact. A likely exploited bug in a throwaway test tool is still low priority for you.
What is SSVC?
Stakeholder Specific Vulnerability Categorization came out of Carnegie Mellon's Software Engineering Institute with CISA in 2019. CISA's own decision tree uses five inputs: exploitation status, technical impact, automatable, mission prevalence and public well being impact.
It ends in one of four outcomes. Track means no action now, keep monitoring. Track star means closer monitoring. Attend means supervisory staff address it and fix it sooner than normal. Act means leadership gets involved and remediation happens as soon as possible.
SSVC differs from the other two because the answer is a decision, not a number.
How do they fit together?
- How bad could this flaw be in the abstract? CVSS.
- How likely is exploitation soon? EPSS.
- What do we do, and how fast? SSVC.
- Does my code even call the vulnerable function? Reachability.
The last item is not a standard. It is a check on your own software. Safeguard's reachability analysis classifies findings as reachable, conditionally reachable, unreachable or unknown and feeds that into a priority score together with CVSS, EPSS and Known Exploited Vulnerabilities status. Its documentation also lists limits, such as weaker results with reflection or eval.
Try it at /demos/exploitability-check.
What to do
- Stop sorting by CVSS alone. Add EPSS and whether the CVE is on the Known Exploited Vulnerabilities list.
- Ask your tools which CVSS version and which labels they show.
- Pick a simple decision rule, even a short one, and write it down.
- Add context only you have: is the code reachable, is it internet facing, what data sits behind it.
- Review the rule every quarter.
Quick check
Is a CVSS 9.8 always urgent?
No. CVSS rates severity in the abstract. Urgency also depends on exploitation likelihood, reachability and where the component runs.
Does EPSS replace CVSS?
No. EPSS estimates likelihood and CVSS describes severity. FIRST points to using EPSS with CVSS and other signals.
Sources
- FIRST: CVSS overview, fetched 18 October 2026
- FIRST: CVSS v4.0 specification, fetched 18 October 2026
- FIRST: CVSS v3.1 specification, fetched 18 October 2026
- FIRST: EPSS, fetched 18 October 2026
- CISA: SSVC, fetched 18 October 2026
- Safeguard documentation: Reachability analysis, fetched 18 October 2026
Last reviewed: 18 October 2026.
