CVSS measures how severe a vulnerability is in the abstract. EPSS estimates the probability it will be exploited in the next 30 days. SSVC is a decision tree that ends in an action: Track, Track*, Attend or Act. They answer different questions, so use them together, not as substitutes.
This is a reference page, written to be linked. Every definition below comes from the publisher of the system: FIRST for CVSS and EPSS, CISA for SSVC. Where a figure is not in those sources, we left it out.
What does CVSS v3.1 measure?
The v3.1 base group has eight metrics, split into exploitability and impact: Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, and the Confidentiality, Integrity and Availability impacts. The qualitative scale is:
| Rating | Score |
|---|---|
| None | 0.0 |
| Low | 0.1 to 3.9 |
| Medium | 4.0 to 6.9 |
| High | 7.0 to 8.9 |
| Critical | 9.0 to 10.0 |
The specification says the Base Score reflects severity according to intrinsic characteristics and does not claim to measure overall risk. It notes that consumers may combine CVSS with factors such as organizational context.
What changed in CVSS v4.0?
FIRST's user guide lists four metric groups: Base, Threat, Environmental and Supplemental. Changes from v3.1 include:
- Scope is removed. It is replaced by impacts on the vulnerable system and on subsequent systems, meaning those whose security policy is violated as a result of the exploit.
- Attack Requirements is new. It captures prerequisite conditions of the vulnerable component, split out of Attack Complexity.
- User Interaction has three values: None, Passive and Active.
- Temporal became Threat. Remediation Level and Report Confidence were retired, and Exploit Code Maturity became Exploit Maturity.
- Supplemental metrics such as Safety, Automatable and Provider Urgency add context but have no impact on the calculated score.
Nomenclature tells you what a score includes: CVSS-B is base only, CVSS-BT adds threat, CVSS-BE adds environmental and CVSS-BTE has all three. When you read "CVSS 9.8" with no label, ask which one it is.
A caution from NIST's NVD notice: in April 2026 NIST found approximately 4,500 CVE records with an incorrect numerical CVSS v4.0 score, most too high, and scheduled a correction. Treat any single published score as an input.
What does EPSS measure?
FIRST describes EPSS as "a data-driven machine-learning model that estimates the probability that a published CVE will be exploited." Scores estimate the chance of exploitation in the wild "in the next 30 days." It publishes a 0 to 1 probability plus ranking percentiles for every CVE each day, free through downloads and an API. Its purpose is to help teams focus limited remediation effort. It describes likelihood across the internet, not whether your own system is exposed.
What does SSVC measure?
SSVC, Stakeholder-Specific Vulnerability Categorization, was developed by Carnegie Mellon's Software Engineering Institute with CISA in 2019. CISA's tree uses five decision points: Exploitation, Automatable, Technical impact, Mission prevalence and Public well-being impact. The outcomes are:
- Track: no action needed now. Fix within standard update timelines.
- Track*: specific characteristics call for closer monitoring. Standard timelines.
- Attend: needs supervisory attention. Remediate sooner than standard timelines.
- Act: needs supervisory and leadership attention. Remediate as soon as possible.
Unlike the other two, SSVC includes your context, such as how central the affected product is to your mission.
How do they fit together?
| System | Question it answers | Includes your context? |
|---|---|---|
| CVSS Base | How severe is the flaw itself? | No |
| CVSS Threat and Environmental | Severity adjusted for exploit maturity and your setting | Partly |
| EPSS | How likely is exploitation soon? | No |
| CISA KEV | Is it confirmed exploited? | No |
| SSVC | What should we do? | Yes |
A common pattern: use KEV as a hard override, EPSS to order the rest, CVSS to describe severity to humans, and SSVC style decisions to set deadlines.
What to do
- Record which CVSS version and label each score comes from.
- Pull EPSS and KEV data into your findings queue daily.
- Make a rule: KEV-listed findings are fixed first, with a deadline you can meet.
- Add Environmental or SSVC style context for systems that matter most.
- Add reachability evidence, so a flaw in code you never call is ranked lower.
- Review the policy each year as the scoring systems change.
Quick check
Is a CVSS 9.8 always more urgent than a 7.5?
No. CVSS describes severity, not likelihood. A 7.5 that is actively exploited can be more urgent than a 9.8 nobody exploits.
Does EPSS replace CVSS?
No. EPSS estimates exploitation probability, while CVSS describes severity. They answer different questions.
Sources
- FIRST: CVSS v3.1 specification
- FIRST: CVSS v4.0 user guide
- FIRST: Exploit Prediction Scoring System
- CISA: SSVC
- NIST NVD program page
Last reviewed: 18 October 2026.
