The method
The CVSS (Common Vulnerability Scoring System) score measures a vulnerability’s technical severity from criteria such as attack vector, complexity, required privileges and impact. Version 4.0 adds exploitability and application-context metrics. A high score says nothing about the actual likelihood of exploitation.
EPSS (Exploit Prediction Scoring System) complements CVSS with a probability score that a vulnerability will be exploited within 30 days, computed from observed exploitation data. A vulnerability with a moderate CVSS score but high EPSS can be more urgent than a critical one never exploited in practice.
CISA’s KEV (Known Exploited Vulnerabilities) catalogue lists vulnerabilities with confirmed active exploitation: fixing them becomes an immediate priority, regardless of score.
When to use it
- Ongoing patch management, to decide deployment order.
- Prioritising a large number of vulnerabilities reported by a scanner.
- Justifying to management the remediation deadline given to each severity level.
Watch out for
- CVSS alone is not enough to prioritise: combine it with EPSS and asset context (exposure, business criticality).
- EPSS changes over time: a vulnerability unlikely today can become urgent after exploit code is published.
- A low score does not mean no risk if the vulnerability affects a highly exposed or critical asset.
Steps
- List the vulnerabilities identified in scope (scanner, vendor advisories, penetration tests).
- Record each vulnerability’s CVSS score and adjust it to the real context (exposure, asset criticality).
- Check the EPSS score to estimate short-term exploitation likelihood.
- Check whether the vulnerability is in the KEV catalogue: treat it then as an absolute priority.
- Define remediation deadlines by priority level and track compliance.
Calculators and catalogues
List from the Aurorisk catalogue, links checked on 2026-09-26. Confirmed free access is listed first; unknown information is labelled.
| Tool | Source · licence · access | Scope | Description |
|---|---|---|---|
| CISA — catalogue KEV ↗ | Public bodyFree | United States | Known exploited vulnerabilities. |
| FIRST — calculateur CVSS ↗ | Association or foundationFree | International | CVSS v4.0 score calculator. |
| FIRST — EPSS ↗ | Association or foundationFree | International | Probability that a vulnerability will be exploited. |