CVSS, EPSS and CISA KEV: deciding what to patch first
Run a vulnerability scanner on almost anything and you’ll get hundreds or thousands of findings. Nobody can patch everything at once, so the real skill is deciding what comes first. This is a core idea in CompTIA CySA+, and it’s exactly the problem I hit in my own home lab.
CVSS: how bad could it be?
The Common Vulnerability Scoring System rates a vulnerability’s severity from 0 to 10. The base score looks at things like whether it can be exploited over the network, whether the attacker needs to log in, whether a user has to click something, and what an attacker gains (confidentiality, integrity, availability).
What CVSS doesn’t tell you is whether anyone is actually exploiting it. Lots of findings score 9.8 and never get attacked in the real world.
EPSS: how likely is it to be exploited?
The Exploit Prediction Scoring System, published by FIRST, estimates the probability that a vulnerability will be exploited in the wild in the next 30 days. It’s a number between 0 and 1, updated daily from real-world signals. A “critical” CVSS finding with a tiny EPSS score is often less urgent than a “high” one with a large EPSS score.
CISA KEV: is it already being exploited?
The Known Exploited Vulnerabilities catalog from CISA lists vulnerabilities with reliable evidence of active exploitation. If a finding is on the KEV list, it isn’t a prediction any more. US federal agencies are required to fix KEV entries by set deadlines, and that’s a sensible bar for everyone else too.
Putting them together
| Signal | Question it answers | How I use it |
|---|---|---|
| CISA KEV | Is this being exploited right now? | Fix first, on a deadline |
| EPSS | How likely is exploitation soon? | Rank everything else |
| CVSS | How much damage if exploited? | Break ties, judge impact |
| Asset context | Is it reachable, and does it matter? | Internet-facing and critical systems go up the list |
Context still matters. A vulnerable service that isn’t reachable, or a package that isn’t actually loaded, is lower risk than the same CVE on an internet-facing server.
What this looked like in my lab
When I fixed a vulnerability scan in my Wazuh lab that had been silently not running, it came back with more than 9,000 findings. Most were kernel package noise. Separating that noise from real exposure brought the list down to one item that actually needed action. Now I keep a CVE watch list ranked by KEV and EPSS, so new findings get sorted the same way. That’s the point of prioritization: turning a scary number into a short, defensible to-do list.
Exam tip: CVSS measures severity, EPSS measures likelihood, KEV confirms active exploitation. If a question asks what to remediate first, known exploitation on an exposed, critical asset usually wins.