Your scanner found 4,000 criticals. You have one patch window. CVSS says they are all on fire; attackers are only exploiting a handful. Qualys TRU counted 48,172 new vulnerabilities disclosed in 2025, of which just 357 — 0.74% — were remotely exploitable, weaponized, and had a working proof of concept. Vulnerability prioritization is the discipline of finding those 357 before the attackers do.
This article gives you a practical framework built on three signals — CVSS for severity, EPSS for prediction, and CISA KEV for confirmation — plus the asset context that turns scores into decisions. It is written for the vulnerability management lead who has to defend the patch queue to engineering, to leadership, and to the auditor, with data instead of vibes.
#Quick Answer: How should I prioritize vulnerabilities: CVSS, EPSS, or CISA KEV?
Use all three, because each answers a different question. CVSS measures worst-case severity; EPSS estimates the probability of exploitation in the next 30 days; CISA KEV confirms active exploitation in the wild right now. A practical rule: patch KEV-listed vulnerabilities on your assets first, then high-EPSS internet-facing flaws, then use CVSS and reachability analysis to order the rest. No single score is sufficient on its own.
#The Math Problem: Too Many CVEs, Too Few Patch Windows
The scale of the problem is what makes prioritization non-optional. With 48,172 new vulnerabilities disclosed in 2025 and only a few hundred showing real weaponization, a queue ordered by CVSS severity alone spends the overwhelming majority of its effort on flaws attackers will never touch. Research on exploitation data consistently finds that only a low-single-digit percentage of published CVEs are ever exploited at all.
Meanwhile the window between disclosure and exploitation has collapsed. Mandiant's M-Trends 2026 data, cited via Qualys TRU, puts mean time-to-exploit in 2025 at negative seven days — exploitation observed before public disclosure, on average — compared to negative one day in 2024. Rapid7 found the median time from CVE publication to CISA KEV listing fell to 5.0 days in 2025, down from 8.5 days in 2024. Attackers are not waiting for your monthly patch cycle.
And the consequences of getting the queue wrong are growing. Verizon's 2026 Data Breach Investigations Report found breaches initiated via vulnerability exploitation rose to 31%, up from 20% a year earlier. The prioritization framework below is designed for exactly this environment: more CVEs than ever, shrinking exploitation windows, and exploitation as an initial access vector climbing fast.
#CVSS: Severity Is Not Risk
The Common Vulnerability Scoring System measures how bad a flaw could be in the worst reasonable case — not how likely it is to be exploited against you. That distinction is the source of nearly every prioritization failure I have seen. A CVSS 9.8 that nobody exploits will outrank a CVSS 7.5 that ransomware gangs use daily, and the patch queue will dutifully burn engineering hours on the former.
CVSS 4.0, released in late 2023, actually tried to fix this. It split the score into layers: a Base score for the flaw itself, a Threat layer that lowers the score when no exploit is known, and an Environmental layer where you describe your own system — plus attack requirements and supplemental fields like whether exploitation can be automated. Used fully, CVSS 4.0 can express risk properly.
The catch, as practitioners keep documenting, is that almost everyone still publishes and consumes only the Base score — which by definition ignores both real-world threat and your environment. CISA's Vulnerability Review makes the agency's position blunt: CVSS scores reflect "theoretical severity, not real-world impact" and can mislead teams. Treat CVSS as what it is: a severity input to a prioritization decision, never the decision itself. When API flaws like BOLA and mass assignment land in your queue, their CVSS tells you the worst case; the rest of this framework tells you whether attackers care.
#EPSS: The Only Prediction in the Trio
The Exploit Prediction Scoring System, maintained by FIRST, takes a fundamentally different approach from CVSS. It is a machine-learning model trained on actual exploitation evidence — threat intelligence feeds, honeypot data, proof-of-concept activity, and more — and it produces a daily probability score between 0 and 1: the likelihood that a given CVE will see exploitation activity in the next 30 days. The current generation is EPSS v4, with model version 2025.03.14.
The numbers are striking. In any 30-day window, only about 2–3% of published CVEs show exploitation activity — that is the baseline your intuition should calibrate against. Conversely, the top 1% of CVEs by EPSS account for roughly 75% of observed exploitation attempts. Filtering to CVEs with EPSS above 0.10 shrinks a fix list dramatically while still covering the overwhelming majority of real attacks. EPSS is refreshed daily, so a CVE that was low-priority last month can jump to high-priority overnight when attackers start weaponizing it.
Two subtleties matter in practice. First, read the percentile alongside the score. A 95th percentile means the CVE scores higher than 95% of all other CVEs — it does not mean a 95% chance of exploitation, a misreading FIRST.org explicitly warns against. FIRST's guidance combines both: roughly, score ≥0.43 with percentile ≥82% is critical (patch in 24–48 hours), ≥0.10/≥60% is high (7 days), ≥0.01/≥40% is medium (30 days), and below that is monitor. Second, understand the limits. EPSS is a probability across the whole internet, not a statement about your network, and it lags brand-new CVEs. CrowdStrike's EPSS analysis found that only 19.9% of vulnerabilities that eventually entered CISA KEV had an EPSS score above 0.5 before confirmation — and just 8.3% were above 0.9. Prediction narrows the field enormously, but it does not catch everything. That is what the next signal is for.
#CISA KEV: Confirmed Exploitation, Binding Deadlines
The CISA Known Exploited Vulnerabilities catalog is the most reliable signal in the trio, because it is not a prediction — it is a fact. CISA maintains a manually curated list of vulnerabilities with reliable evidence of active exploitation in the wild and a clear remediation action. If a CVE is in the KEV catalog, attackers have working exploits and are using them. The catalog stood at roughly 1,739 entries as of October 2026, covering on the order of half a percent of all published CVEs — short by design, since it lists only confirmed cases.
KEV findings are your highest priority, regardless of CVSS. For U.S. federal agencies the catalog is legally binding under CISA's Binding Operational Directive, with remediation deadlines typically measured in weeks — and while private organizations are not legally bound, treating KEV deadlines as your SLA is the simplest defensible policy you can adopt. The catalog's velocity tells you why: a median of 5.0 days from CVE publication to KEV listing in 2025 means confirmation arrives fast, and the patch has to follow faster.
The catalog's limitation is structural: it is reactive. It responds after confirmation, not before, which leaves an exposure window measured in days or weeks — the exact window that actors like Salt Typhoon exploit systematically. CISA's own case studies show the Chinese state-sponsored group exploiting widely known, unpatched CVEs since at least 2021 to infiltrate telecommunications, transportation, and military infrastructure. The agency's lesson is blunt: "If you're not patching KEVs, you're not protected." Use KEV as the floor of your program, not the ceiling.
#The Practical Framework: A Four-Layer Triage Queue
Here is the framework I recommend, in the order work should actually happen.
Layer one: KEV-listed vulnerabilities present on your assets. Patch immediately, on KEV-equivalent timelines. No debate, no severity re-scoring — confirmed exploitation beats every model. This layer should be automated: ingest the KEV feed, match against your asset inventory daily, and open tickets with the deadline attached.
Layer two: high EPSS plus exposure. CVEs with EPSS above roughly 0.10 (or 60th percentile and up, using both per FIRST.org guidance) on internet-facing or otherwise exposed assets get a 7-day SLA. This is where prediction earns its keep — it catches the weaponization wave before CISA confirms it. Cross-reference with exploit automation signals: flaws with public proof-of-concept code or exploit modules deserve an urgency bump, since automation is what turns a vulnerability into a campaign.
Layer three: reachability analysis. For everything else, ask whether a verifiable execution path exists between untrusted input and the vulnerable function or dependency inside your application. A critical CVSS in a dependency your code never invokes through attacker-reachable paths is a different risk than the same score in your authentication flow. Reachability is what makes prioritization reflect your real risk rather than the internet's average risk, and it is the layer where application security teams contribute most.
Layer four: CVSS-ordered baseline within exposure tiers. What remains gets ordered by severity, tempered by asset criticality and exposure — internet-facing first, then internal, then isolated. CISA's Vulnerability Review converges on the same four variables for prioritization: asset exposure, KEV status, exploit automation, and technical impact.
Two operational notes. First, the framework needs your asset inventory to function — "only your own asset list tells you whether it can happen to you," and stale inventories are where KEV matches go to die. CISA found 26% of scanned critical infrastructure entities exposed vulnerable network services, 51% ran unsupported software, and 91% relied on deprecated TLS left unsecured for a median of 459 days. Those are not exotic failures; they are inventory and hygiene failures. Second, align the framework with your zero-trust architecture: exposure tiers should reflect actual network segmentation, not assumed segmentation. And when AI-generated code enters the codebase, the OWASP Top 10 for LLM security belongs in the same review as the CVE queue — new flaw classes need the same triage discipline.
#Frequently Asked Questions
What is a good EPSS threshold for prioritization?
There is no universal threshold, but FIRST.org's guidance is the defensible starting point: treat score ≥0.43 (percentile ≥82%) as critical with a 24–48 hour SLA, ≥0.10 (≥60th percentile) as high with a 7-day SLA, and ≥0.01 (≥40th percentile) as medium with a 30-day SLA. Always use score and percentile together — a low score with a high percentile can still indicate high relative risk. Tune the cutoffs against your own patch capacity and measure whether the thresholds predict your actual incidents.
Is CISA KEV mandatory for private companies?
The binding deadlines apply to U.S. federal agencies under CISA's Binding Operational Directive, not to private companies. In practice, though, KEV is the closest thing the industry has to a consensus "patch now" list, and many cyber insurance policies, customer contracts, and audit frameworks expect KEV-listed flaws to be remediated promptly. Adopting KEV timelines as your internal SLA is the simplest policy to defend to a board or an auditor.
Why not just patch everything with CVSS 9.0 and above?
Because severity is not risk, and the math punishes the approach. Only a low-single-digit percentage of CVEs are ever exploited, while the top 1% by EPSS accounts for roughly 75% of exploitation attempts — and that top 1% is not the same set as "CVSS 9.0+." A CVSS-only queue burns engineering goodwill on theoretical severity while the exploited 7.5s sit unpatched. Use CVSS as a severity input inside an exposure- and threat-informed framework, not as the framework.
How often should EPSS scores be refreshed in our process?
Daily. EPSS is recomputed every day as new exploitation evidence arrives, and a CVE's score can jump overnight when weaponization begins. Your vulnerability management platform or ticketing integration should pull fresh EPSS scores at least daily and re-tier the queue automatically — a monthly refresh will miss the exact escalation windows the model is designed to catch.
#Sources and Further Reading
- FIRST.org, Exploit Prediction Scoring System (EPSS) — the open model estimating 30-day exploitation probability; score-and-percentile decision guidance.
- CISA, Known Exploited Vulnerabilities (KEV) catalog — manually curated, evidence-backed list of actively exploited CVEs with federal remediation deadlines.
- CVSS vs CISA KEV: Vulnerability Prioritization 2026 — shattered.io — 2025–2026 benchmarks: 48,172 disclosures, −7 day mean time-to-exploit, 5.0-day median to KEV listing, 1,739 catalog entries.
- CISA Vulnerability Review — SecurityOnline — "theoretical severity, not real-world impact"; Salt Typhoon case study; unsupported software and deprecated TLS findings.
- Vulnerability Prioritization Beyond CVSS: EPSS, KEV, and Reachability — OX Security — the three-signal model plus reachability analysis.
- Vulnerability Prioritization in 2026: CVSS, EPSS and KEV — InternetPros — what CVSS 4.0 changed and why most teams still consume only the Base score.