Exploitability is how likely and how easy it is for an attacker to use a vulnerability in practice. It differs from severity, which describes the damage. Signals include CISA KEV listing, the EPSS probability, whether a public proof of concept exists, and whether the attack can be automated. It matters because it tells you what to patch first.
Key takeaways
- Severity says how bad. Exploitability says how likely and how easy.
- Direct evidence is KEV: exploited in the wild.
- Predictive evidence is EPSS: probability of exploitation in the next 30 days.
- CISA's SSVC adds Automatable and Technical Impact, now used in BOD 26-04.
What is exploitability?
It is the chance and ease of a real attack. A flaw with a critical score that needs rare conditions may be hard to use. A medium flaw with a public exploit that runs without authentication may be attacked daily.
Why does exploitability matter?
Because the pool of CVEs is large and attacks target a small part of it. CISA's BOD 22-01 FAQ said fewer than 4% of known vulnerabilities have been used in real attacks, and that known exploited ones should be the top remediation priority. Exploitability is how you find that small part.
Which signals measure exploitability?
- KEV listing. CISA describes its catalog as the authoritative source of vulnerabilities exploited in the wild.
- EPSS. A daily 0 to 1 probability of exploitation in the next 30 days, from FIRST.
- Exploitation (SSVC). In CISA Vulnrichment, whether a public proof of concept exists or exploitation is known.
- Automatable. Whether an attacker can generally exploit it at will, without typical defensive barriers.
- Technical impact. Whether exploitation gives total control or partial control.
What does exploitability not tell me?
It does not tell you whether your system is affected. A vulnerable library you never call, or a service not exposed to the internet, changes the picture. Exposure and reachability are the missing half. Vulnerability Exploitability eXchange (VEX) documents exist to record whether a product is actually exploitable.
How do I use it?
Sort findings by KEV first, EPSS second, then check Automatable and exposure. Treat the rest on the normal schedule. See the CVSS vs EPSS vs KEV guide for a full order of questions.
Try it yourself
Pick a CVE from your last scan. Look up its KEV status in the Gold registry, its EPSS score at FIRST, and its SSVC fields in CISA Vulnrichment. Write down whether you would move it up or down.
Click through it at your own pace, or open it full screen.
Frequently asked questions
Is exploitability the same as severity?
No. Severity, such as a CVSS score, describes potential impact. Exploitability describes how likely and easy an attack is.
What is a proof of concept exploit?
It is code or steps showing a vulnerability can be exploited. In CISA Vulnrichment, a public proof of concept sets Exploitation to poc.
What does Automatable mean?
A yes means an attacker could generally exploit the vulnerability at will, without worrying about typical defensive barriers.
Does a low EPSS score mean I can ignore a flaw?
No. EPSS is a probability, not a guarantee. Combine it with KEV status, exposure and your asset value.
Sources
- CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- FIRST EPSS: https://www.first.org/epss/
- CISA Vulnrichment: https://github.com/cisagov/vulnrichment
- CISA SSVC: https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc
- CISA BOD 22-01 (revoked): https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities
- CISA BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- CISA minimum requirements for VEX: https://www.cisa.gov/resources-tools/resources/minimum-requirements-vulnerability-exploitability-exchange-vex
Last reviewed: 19 October 2026.
