Security Guides
Deciding What to Patch First — CVSS, EPSS and KEV, and What Each Is For
Ten CVEs land at once — which one first? CVSS, EPSS and KEV measure different things, so any one of them alone loses cases. Using our own tracking data for all 1,695 KEV-listed CVEs, this shows that CVSS-only misses 64% and EPSS-only misses 24%, then gives the ordering, the deadlines, and how to check a CVE yourself.
Who this is for: anyone whose scanner or Dependabot drops ten findings at once and cannot decide where to start. This is about what the indicators actually mean and how to turn them into an order and a deadline.
What each indicator answers
| Indicator | The question it answers | Source | Nature |
|---|---|---|---|
| CVSS | How badly does it hurt if exploited? | FIRST (computed from metrics) | Severity — contains no notion of likelihood |
| EPSS | How likely is exploitation in 30 days? | FIRST (machine-learned prediction) | Probability 0–1 — a forecast, not a fact |
| KEV | Has it actually been exploited? | CISA (catalogue of confirmed cases) | Fact — but only covers what was observed |
The common misreading: CVSS is not risk
CVSS answers "how heavy is the hit" and nothing about whether the hit is likely. A CVSS 9.8 can be entirely unreachable in your deployment because it sits behind authentication you require. A CVSS 6.x that is internet-facing and being exploited is, for you, the top of the list. CVSS is weight; priority is weight × likelihood × your exposure.
The data: counting all 1,695 KEV entries
We machine-monitor the CISA KEV catalogue and attach CVSS and EPSS to every entry. Here is the whole set counted (1,695 entries, as of 3 September 2026).
Running on CVSS alone
- Only patch 9.0+ → you skip 64% of what is actually exploited
- Nothing under 7.0 is urgent → 195 entries left open while under attack
- The score knows nothing about your deployment, so unreachable 9.8s eat your time
What stacking all three buys
- KEV listing = argued over by nobody — it is observation, not prediction
- High EPSS = getting ahead of the next KEV entry
- High CVSS = sizing the damage if it does land
- Your own exposure then sets the deadline
Use EPSS in one direction only
405 entries (24%) are confirmed exploited yet score below EPSS 0.1. EPSS models broad, opportunistic exploitation, so targeted usage and freshly disclosed issues score low. Treat it as "high means hurry" and never as "low means safe".
Patch only CVSS 9.0 and above
skips 1,087 of 1,695 (64%) confirmed-exploited entries
Defer because EPSS is low
405 entries (24%) are exploited yet score below 0.1
KEV → high EPSS → high CVSS → your exposure
fact → forecast → blast size → reachability
How to order the work
Check KEV listing first
Observed exploitation outranks any score. If it is in KEV, it is top of the list even at CVSS 6. You can check a specific CVE in the CVE lookup, which shows CVSS, EPSS and KEV status (with the remediation due date) on one screen.
If not in KEV, get ahead of the high-EPSS ones
A high EPSS (0.5 and up as a rough line) marks the candidates that have not been added to KEV yet. In our tracked set, 877 entries (52%) sit at 0.5 or above. Clearing those early is the difference between leading and reacting.
Multiply by reachability in your environment
The same CVE ranks differently depending on whether it is internet-facing, behind authentication, or in a feature you do not even use. A vulnerability in an unused feature usually warrants an update, not an incident. Anything reachable without authentication goes to the front regardless of score.
Put a number on the deadline
CISA attaches a due date to each KEV entry. Across the whole catalogue 21 days dominates (1,025 entries), but for the 210 added during 2026 the most common window is three days (91) — a clear tightening. That deadline is written for US federal agencies, but it is a usable external baseline. Ours: KEV and unauthenticated-reachable = same day; KEV = within 3 days; EPSS ≥ 0.5 = within 2 weeks; everything else = next scheduled update.
Verify the fix with a machine
Judgement is rarely what breaks — follow-through is. Run osv-scanner or pnpm audit on a schedule so "we patched that" is checked against the real dependency tree. The full loop is in the practice of vulnerability response.
SSVC — from sorting by score to deciding by tree
CISA also publishes a decision-tree alternative to ranking by score: SSVC (Stakeholder-Specific Vulnerability Categorization). You answer a handful of questions — is it being exploited, is it exposed, can the attack be automated, how bad is the business impact — and land in Track / Track* / Attend / Act. The procedure above is essentially a compact version of that. If you need to write the policy down for an organisation, borrowing SSVC's vocabulary saves a lot of arguing.
This site's view: the real blocker is not the indicators
When a team cannot decide what to patch first, the cause is more often not knowing what they actually run than not understanding the scores. KEV and EPSS are unusable if you cannot answer "do we use that product?". That is why we put asset inventory ahead of CVE triage (→ the asset inventory checklist). With an inventory in place, everything in this article takes minutes.
Checking things yourself
- One CVE: CVE lookup — CVSS, EPSS, KEV listing and the remediation due date together
- Your dependencies: osv-scanner / how to use it
- New critical CVEs: the vulnerability alert feed (prioritised by combining KEV, CVSS and EPSS)
Sources
- CISA — Known Exploited Vulnerabilities Catalog (counts taken from catalogue version 2026.09.02)
- FIRST — EPSS and CVSS
- CISA — Stakeholder-Specific Vulnerability Categorization (SSVC)
- Statistics computed from this site's own KEV tracking data (1,695 entries; EPSS snapshot of 2026-09-03)
Read next
- Terms: what CVSS is / what a CVE is
- Practice: the practice of vulnerability response / getting started with osv-scanner
- Foundation: the asset inventory checklist — priorities are undecidable without knowing what you run
- Tooling: osv-scanner in practice (ignores, offline mode, tool comparison)
FAQ
QWhat is the difference between CVSS, EPSS and KEV?
They answer different questions. CVSS is severity — how much it hurts if it lands. EPSS is a prediction — how likely exploitation is in the next 30 days. KEV is a fact — this has been observed exploited in the wild. Something can be severe and never targeted, or middling in score and actively attacked right now.
QCan I just patch the highest CVSS scores first?
That loses cases. Across all 1,695 CVEs in the KEV catalogue we track, only 608 (36%) score CVSS 9.0 or above. Roughly two thirds of actively exploited vulnerabilities sit below 9.0, and 195 of them (11.5%) sit below 7.0 — so a 'nothing under 7 is urgent' policy leaves holes open that are being attacked today.
QIs a low EPSS score safe?
No. In the same set, 405 entries (24%) have an EPSS below 0.1 despite being confirmed as exploited. EPSS predicts broad, opportunistic exploitation, so targeted use and freshly published issues score low. Use EPSS in one direction only: high means hurry. Low is not evidence of safety.
QHow fast should I patch?
Borrow an external baseline. CISA attaches a remediation due date to every KEV entry, and for the 210 added during 2026 the most common window is three days (91 of them) — noticeably shorter than the 21- and 14-day windows that dominate the older catalogue. That deadline is written for US federal agencies, so weigh it against your own exposure: internet-reachable and unauthenticated beats every score.