Rank fixes by two questions before looking at any score: is the flaw known to be exploited, and can an attacker reach the system? Exploited and exposed goes first, exposed second, internal third. Severity scores then break ties inside each group instead of setting the order.
Why scores alone mislead
FIRST, the organization behind CVSS, states that the Base score reflects only intrinsic qualities of a vulnerability, independent of threat or your environment, and says CVSS-B "should not be used alone to assess risk". A 9.8 in a tool nobody can reach may matter less than a 6.5 in your login service. The score is useful, but it answers a different question than "what should I fix today".
A four-bucket ranking
| Bucket | Test | Typical timing |
|---|---|---|
| 1 | On the CISA exploited list and the system is reachable from the internet | This week, immediately if possible |
| 2 | Reachable from the internet, not known exploited | Within your normal window |
| 3 | Known exploited but internal only | Soon, because internal access is easier after a phishing event |
| 4 | Internal and not exploited | Routine calendar |
The timing column is a suggestion. Choose numbers you can keep.
How to answer the two questions
Exploited? CISA calls its Known Exploited Vulnerabilities catalog the authoritative source of vulnerabilities exploited in the wild and tells organizations to use it as an input to prioritization. It is available as CSV and JSON. EPSS, from FIRST, estimates the probability of exploitation in the next 30 days, from 0 to 1, and is updated daily. Treat EPSS as another input about likelihood, not a verdict.
Exposed? Use your inventory column. If you do not have one, start with the DNS records and your cloud load balancers.
Do not multiply scores
The EPSS FAQ is blunt that multiplying EPSS by a CVSS score does not compute probability times severity and is never a good idea. Keep them separate and use judgement.
A worked example
You have three findings. A web framework flaw with a modest score but on the exploited list, in your public site. A critical score in a build tool that runs only on your laptop. A high score in an internal admin script. Order: framework, admin script, build tool. The first is exploited and exposed. The second is internal but real. The third is local and unreachable.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Should I ignore anything that is not on the exploited list?
No. Many serious flaws are exploited before they are listed, and listing takes time. Use the list to move items up, not to dismiss the rest.
Does internal mean safe?
No. Phishing and stolen credentials put attackers inside. Internal items rank lower, not at zero.
Safeguard exploitability checks and reachability analysis support this ranking, and a free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
