Beyond CVSS: prioritizing exposures with EPSS and CISA KEV

If your remediation policy is “patch everything CVSS 7.0 and above,” you have a policy that cannot be executed. There were roughly 46,000–48,000 CVEs published in 2025 — a record — and the pace keeps climbing. You cannot patch your way through that list by severity. You have to prioritize by risk, and that means looking past CVSS.

Why CVSS alone isn’t enough

CVSS measures how bad a vulnerability would be if it were exploited. It says nothing about whether it ever will be. And the data on that is stark: depending on the study, only about 5–6% of all published CVEs are ever observed being exploited in the wild (the Cyentia Institute and FIRST put it near 6% across ~237,000 CVEs; NIST’s own analysis lands around 5%, and notes CISA’s exploited-vuln catalog covers only ~0.5% of all CVEs). A queue sorted purely by CVSS spends most of its effort on vulnerabilities nobody will ever weaponize.

It got harder in 2026. In April, NIST announced it was scaling back NVD enrichment: it now fully enriches only CVEs that are in CISA KEV, in federal-used software, or designated critical software — everything else is marked “Not Scheduled.” The single database everyone leaned on for severity metadata can no longer keep up with CVE volume. Leaning on CVSS-from-NVD alone was always shaky; now it’s untenable.

So you need two more signals: is it being exploited (KEV), and how likely is it to be (EPSS).

KEV: what’s actually being exploited

The CISA Known Exploited Vulnerabilities (KEV) catalog is the authoritative list of CVEs with confirmed in-the-wild exploitation — over 1,700 entries as of 2026, each added with evidence of real attacks. If a vulnerability is in KEV and it’s on your perimeter, it is not a “someday” item. It is being used, right now, by someone.

The federal government treats it that way. The old flat-timeline directive (BOD 22-01) was revoked in June 2026 and replaced by BOD 26-04, “Prioritizing Security Updates Based on Risk,” which moves to a risk-based model where the most dangerous vulnerabilities must be remediated in as little as three days. KEV membership is the clearest “drop everything” signal you have.

EPSS: how likely is exploitation

EPSS — the Exploit Prediction Scoring System, maintained by FIRST — is a machine-learning model that outputs, for each CVE, a probability that it will be exploited in the wild within the next 30 days. The score refreshes daily as new signal arrives, and the current model (EPSS v4, released in 2025) is markedly better than earlier versions at separating the handful of CVEs that will matter from the thousands that won’t.

Where KEV tells you what is being exploited, EPSS tells you what’s about to be — so you can get ahead of the long tail of high-CVSS-but-quiet CVEs instead of treating them all as equally urgent.

Putting it together

The consensus workflow is simple to state:

1. KEV first. Anything in KEV that touches your surface is top priority, regardless of CVSS. It’s confirmed exploited.
2. EPSS for the long tail. Among the remaining high-CVSS CVEs, prioritize the ones with a meaningful EPSS probability (many teams draw the line around the top few percent) and defer the rest. Patching every CVSS-7+ is noise; patching high-CVSS and high-EPSS is signal.
3. CVSS for impact, not order. Use severity to understand how bad something is if exploited — not to decide what to do first.

The result is a queue you can actually clear: a short list of things that are being exploited or likely to be, instead of an infinite list sorted by a number that ignores reality.

How ProbeIQ uses this

Correlation only pays off if it ends in good prioritization. ProbeIQ enriches findings with exploitation signal — EPSS probability and KEV membership — on top of normalized CVSS, so what rises to the top of your change report is what’s actually dangerous on your assets, not whatever happens to score a 9.8. That’s the difference between a tool that finds everything and one that tells you what to do about it.

Want to see risk-based prioritization against your own surface? Book a demo.