Each signal answers a different question. KEV says a flaw is exploited in the wild. EPSS estimates the chance of exploitation in the next 30 days. CVSS rates intrinsic severity. Reachability says whether your code can reach the flaw. A sensible order checks KEV first, then reachability and exposure, then EPSS and CVSS to break ties.
What each one measures
CVSS. A severity score from 0 to 10 for the Base group, with temporal and environmental metrics available to adjust it. The CVSS user guide says it measures severity and should not be used alone to assess risk.
EPSS. A model, maintained by a FIRST special interest group, that estimates the likelihood a published CVE will be exploited in the wild within the next 30 days. Scores are probabilities from 0 to 1 with percentiles, published daily.
KEV. CISA's catalog of vulnerabilities that have been exploited in the wild. CISA says organizations should use it as an input to their prioritization framework.
Reachability. A property of your code, not of the CVE. It asks whether a call path to the vulnerable function exists.
What each one cannot say
| Signal | Blind to |
|---|---|
| CVSS | Your code, exposure, active attacks |
| EPSS | Your code, your exposure |
| KEV | Your code; only covers known exploited items |
| Reachability | Attacker interest, exposure, runtime calls |
Only reachability looks at your application. Only KEV and EPSS look at attacker behavior. Only CVSS describes how bad the flaw is in itself.
A simple order
- KEV match and present in your environment. Act first. Exploitation is happening.
- Reachable and exposed. A call path exists on an externally reachable component.
- High EPSS. Likely to be attacked soon even if not yet listed.
- CVSS severity. Use it to break ties and set remediation windows.
- Unreachable. Lower priority with a reason and a review date.
A KEV item that is unreachable in your code deserves one more look rather than a dismissal. Check dynamic features and whether another product you run carries the same package.
Do not hide the inputs
Whatever order you pick, show the reasons next to the rank. Engineers fix faster when they can see why a ticket is first. Auditors also ask.
A worked ranking
Consider four findings. A has a KEV entry and a reachable path on a public service. B is reachable on an internal tool with a high EPSS score. C is unreachable with a critical CVSS score. D is reachable with a medium score on a batch job. The order is A, then B, then D, with C scheduled and reviewed. This is one team's reasoning, not a rule. Your exposure and contracts may reorder it, and that is fine as long as the reasons are written down.
Quick check
Should EPSS replace CVSS?
They measure different things. EPSS is about likelihood of exploitation, CVSS about severity. Many teams use both.
Is a KEV entry always urgent?
It is a strong signal that exploitation is real. Confirm the product is present and exposed, then act on CISA's guidance for that entry.
Safeguard reports reachability next to severity so the signals sit on one finding. The free scan shows an example.
Sources
Last reviewed: 19 October 2026.
