CVSS, EPSS and KEV explained

Most vulnerability management tools show three ratings for each CVE. They measure different things, and it helps to know which is which when deciding what to patch first.

CVSS

The Common Vulnerability Scoring System gives a severity score from 0 to 10, based on how the vulnerability can be reached and what an attacker could do with it. NVD publishes CVSS scores for most CVEs. The score describes the potential impact. It says nothing about whether the vulnerability is being used in attacks.

EPSS

The Exploit Prediction Scoring System is maintained by FIRST. It gives each CVE a probability, between 0 and 1, that it will be exploited in the next 30 days, and it is recalculated daily. Most CVEs score very low, so EPSS is useful for narrowing a long list down to the small number attackers are likely to use.

KEV

CISA's Known Exploited Vulnerabilities catalogue lists CVEs with evidence of exploitation in the wild. US federal agencies have to fix listed vulnerabilities by set deadlines, and many other organisations use the catalogue to set their own priorities.

Using them together

A common approach is to fix anything in KEV first, then anything with a high EPSS score, then work through the remaining high CVSS scores. A vulnerability with a CVSS score of 9.8, a very low EPSS score and no KEV entry can reasonably wait behind a 7.5 that is in KEV. Your own exposure still matters: a flaw in software you do not run can be ignored whatever its ratings.

The three ratings are published separately by NVD, FIRST and CISA. CVE Triage combines them in a single response.