Every vulnerability program ranks with scores, and most of the arguments about prioritization are really arguments about which score to trust. The three that matter today measure different things, and the most common mistake is treating any of them as a measure of risk to you.

CVSS measures severity#

The Common Vulnerability Scoring System, maintained by FIRST, describes how bad a vulnerability could be in the abstract: how it is reached, what privileges it needs, what it does to confidentiality, integrity and availability. Version 4.0, released in November 2023, improved the granularity and separated the base metrics from threat and environmental ones, but the base score, the number everyone quotes, still says nothing about any particular deployment.

That is by design. CVSS was built so that a vendor could describe a bug once for everyone. The failure mode is downstream, when the base score is used as if it were the environmental one.

EPSS predicts exploitation#

The Exploit Prediction Scoring System, also from FIRST, estimates the probability that a given CVE will be exploited in the wild in the next thirty days, using observed exploitation data and features of the vulnerability. It is a genuinely useful signal, because it answers a question CVSS does not: is anyone actually using this? The research behind it is also where a sobering number comes from. Only a small fraction of published CVEs, a few percent, are ever observed being exploited at all.

EPSS is a probability about the world, not about your network. A vulnerability with a 60 percent exploitation probability on a host nobody can reach is still unreachable.

KEV records exploitation#

CISA's Known Exploited Vulnerabilities catalog, launched in November 2021, lists vulnerabilities with confirmed exploitation in the wild. For its first years it came with a flat rule for US federal agencies: everything on the list had to be fixed by a due date. In June 2026 CISA replaced that directive with BOD 26-04, which sets the deadline by risk instead, weighing whether the asset is exposed, whether exploitation is automated and what the impact would be, with the most dangerous cases due in three days and the rest in two weeks or two months. That is the right instinct, and it is the one this article argues for. KEV remains the most conservative of the three signals: it only says yes after the fact. For that reason it is also the most trustworthy input to an urgency rule.

What none of them know#

  • Whether the vulnerable component is reachable from where an attacker is, with the access an attacker has.
  • Whether the exploit works against this deployment, with its configuration, version and compensating controls.
  • What an attacker gets after succeeding: data, credentials, a path to something that matters, or a dead end.

Those three are environmental questions, and no global database can answer them. A critical on an isolated lab host outranks a medium on a public login page that sits two hops from customer data in every score-driven ranking we have seen. The ranking is not wrong about the bugs. It is wrong about you.

Using the three together#

A sensible rule set that we see work in practice:

  • KEV, reachable from the internet: fix now, validate in parallel, no debate.
  • High EPSS, reachable: validate within days; the attempt will usually tell you quickly whether the exploit works here.
  • High CVSS, not reachable or not usable: patch on cadence, do not page anyone.
  • Everything else: patch on cadence and keep discovering, because reachability changes.

Notice that reachability appears in every line. That is the environmental fact the scores cannot supply and the one that most often decides whether a vulnerability matters.

Where validation comes in#

Scores narrow the list. Validation ends the argument. An attempt, within rules you set, to reach the component, confirm the condition and demonstrate the consequence produces something no score can: evidence. SecureX360 carries CVSS, EPSS and KEV alongside every finding and then validates the ones that are reachable, so the ranking engineers see is explained by what was proven, not by what a database thinks of the bug.