CVSS rates how severe a vulnerability is, EPSS estimates the probability it will be exploited in the next 30 days, and the CISA KEV catalog lists vulnerabilities already exploited in the wild. Use KEV first, EPSS second and CVSS to break ties, then add context such as whether the asset is exposed to the internet.
Key takeaways
- CVSS measures severity. Its own guide says a base score should not be used alone to assess risk.
- EPSS is a daily probability from 0 to 1 that a CVE is exploited within 30 days.
- KEV is a yes or no fact: exploited in the wild. CISA says to use it as an input to prioritization.
- In June 2026 CISA replaced BOD 22-01 with BOD 26-04, which sets deadlines from exposure, KEV status, automatability and technical impact.
What does CVSS tell me?
CVSS tells you how bad a vulnerability could be, not how likely it is to be attacked. FIRST says CVSS produces "a numerical score reflecting its severity" and that CVSS is currently at version 4.0. Scores map to low, medium, high and critical labels.
CVSS v4.0 has Base, Threat, Environmental and Supplemental metric groups. Supplemental metrics do not change the score. A score named CVSS-B uses base metrics only. FIRST says that score "should not be used alone to assess risk".
What does EPSS tell me?
EPSS tells you how likely exploitation is soon. FIRST describes it as a machine learning model that "estimates the probability that a published CVE will be exploited in the wild in the next 30 days". It publishes a 0 to 1 score and a percentile every day for every CVE, free through CSV and API.
EPSS says nothing about impact. A likely exploit against a low value test box may still not matter.
What does KEV tell me?
KEV tells you exploitation has already been seen. CISA calls the catalog "the authoritative source of vulnerabilities that have been exploited in the wild" and advises organizations to use it "as an input to their vulnerability management prioritization framework". Each entry carries a date added and a due date.
KEV is short and reactive. A CVE can be dangerous and not yet listed.
How do I combine CVSS, EPSS and KEV?
Ask the questions in this order.
- Is it in KEV? If yes, fix on the fastest track.
- Is EPSS high compared with your other findings? Sort by it next.
- Is CVSS high? Use it to break ties, not to lead.
- Is the asset internet facing, and is the vulnerable code reachable?
You pick the cutoffs. We found no source that defines a universal EPSS threshold, so set yours by testing against your own backlog.
What does CISA do now?
CISA no longer uses severity alone for its own agencies. BOD 26-04, issued on 10 June 2026, supersedes BOD 22-01 and BOD 19-02. It uses four factors: asset exposure, KEV status, exploit automation and technical impact. The last two follow CISA's Vulnrichment SSVC definitions. Deadlines run in calendar days and shorten when a CVE is added to KEV.
CISA's SSVC outcomes are Track, Track star, Attend and Act, from no action to as soon as possible.
Comparison
| Signal | Question it answers | Range | Updated | Weakness |
|---|---|---|---|---|
| CVSS | How severe could it be? | 0 to 10, low to critical | When scored or re-scored | Not a measure of risk alone |
| EPSS | How likely is exploitation in 30 days? | 0 to 1 plus percentile | Daily | Ignores impact and your environment |
| KEV | Has it been exploited? | Listed or not | As CISA adds entries | Only confirmed cases |
| SSVC | What action is needed? | Track to Act | Per decision | Needs asset context inputs |
Try it yourself
Take ten findings from your scanner. Add each CVE's KEV status and EPSS score, then re-sort. Note how many of the top ten changed. The Gold registry lists CVEs with CISA KEV status, and the free scan at gold.safeguard.sh/scan checks up to 100 dependencies in your browser.
Click through it at your own pace, or open it full screen.
Frequently asked questions
Is EPSS better than CVSS?
They answer different questions. CVSS rates severity and EPSS rates likelihood, so use both.
Is a KEV listing always the top priority?
CISA says known exploited vulnerabilities should be a top remediation priority, but check whether you run the affected software and whether it is exposed.
How often does EPSS change?
Daily. FIRST publishes new scores every day.
What is the difference between severity and risk?
Severity is a property of the flaw. Risk adds likelihood, exposure and the value of what is affected.
Sources
- FIRST CVSS: https://www.first.org/cvss/
- FIRST CVSS v4.0 user guide: https://www.first.org/cvss/v4-0/user-guide
- FIRST EPSS: https://www.first.org/epss/
- CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- CISA BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- CISA BOD 22-01 (revoked): https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities
- CISA SSVC: https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc
- CISA Vulnrichment: https://github.com/cisagov/vulnrichment
Last reviewed: 19 October 2026.
