Guide

EPSS vs CVSS vs KEV: which score answers which question

CVSS rates how bad a flaw could be, EPSS how likely exploitation is, KEV whether it is already used. How the three differ and how to combine them.

Published 2026-11-11Updated 2026-11-117 min read

Most vulnerability backlogs are sorted by one number, and that number is usually CVSS. It is the wrong tool for that job on its own. CVSS, EPSS and the CISA KEV catalog answer three different questions, and prioritisation gets much better once each is used for the question it was built for.

CVSS: how bad could this be if someone exploits it?
EPSS: how likely is it that exploitation activity is seen in the next 30 days?
KEV: has exploitation in the wild already been confirmed?

The three side by side

CVSS, EPSS and KEV compared
	CVSS	EPSS	CISA KEV
Question	Severity if exploited	Probability of exploitation activity in 30 days	Confirmed exploitation in the wild
Maintained by	FIRST (specification); scores from NVD, CNAs and vendors	FIRST EPSS SIG	CISA
Output	0.0 to 10.0 plus a vector	Probability 0 to 1 plus a percentile	Listed or not, with date added and due date
Changes	Rarely after publication	Daily, for every published CVE	When new evidence appears
Inputs	Technical properties of the flaw	Vulnerability data plus observed exploitation activity from sensors	Evidence of attacks reviewed by CISA
Blind spot	Says nothing about attacker interest	No context about your assets; no fixed threshold	Lags behind first exploitation; not complete

CVSS: severity, not urgency

The Common Vulnerability Scoring System describes the technical characteristics of a flaw: attack vector, complexity, privileges, user interaction and impact. The base score is the same for every organisation and rarely changes after publication. Version 4.0 was published by FIRST in November 2023; many sources still publish 3.1 scores, and the two are not directly comparable.

Two practical problems follow. First, the same CVE can carry different numbers depending on source and version. The BeyondTrust Remote Support flaw in our CVE-2026-102764 dossier is CVSS 4.0 9.3 from the vendor and CVSS 3.1 9.8 at NVD. Second, a high score does not mean the impact you care about. The exploited Cisco ASA flaw in CVE-2026-76418 scores 8.6 and the NetScaler flaw in CVE-2026-88779 8.7, yet both are denial of service only. Read the vector, not just the number.

EPSS: likelihood, recalculated daily

The Exploit Prediction Scoring System produces a daily estimate of the probability that exploitation activity against a CVE will be observed in the next 30 days. It combines vulnerability information (for example CVSS data, public exploit code, Metasploit modules and KEV status) with exploitation activity reported by data partners from honeypots, IDS/IPS sensors and host-based detection.

Each CVE gets two numbers. The score is the probability itself. The percentile shows how that score ranks against all other CVEs scored that day. A score of 0.05 sounds low but can sit in the top 10 percent, because most CVEs score close to zero.

No official threshold

FIRST has never published a universal EPSS cut-off. Whether you act at 0.1, 0.5 or the 95th percentile is a decision about your own risk tolerance and capacity. And observed exploitation activity means attempts, not necessarily successful compromise.

How EPSS and KEV line up in practice

We compared current EPSS scores for all 1,773 KEV entries in our database (EPSS data of 9 November 2026). Almost all confirmed exploited CVEs rank high, but their absolute probabilities vary widely.

EPSS scores of CVEs listed in KEV

EPSS 0.5 or higher910 CVEs
EPSS 0.1 to below 0.5425 CVEs
EPSS 0.01 to below 0.1382 CVEs
EPSS below 0.0156 CVEs

1,521 of 1,773 KEV entries (86 percent) sit at or above the 90th EPSS percentile.
Only 910 (51 percent) have an EPSS score of 0.5 or higher. A rule of "patch at EPSS 0.5" would miss every second confirmed exploited vulnerability.
438 (25 percent) score below 0.1, and 56 below 0.01. Plausible reasons are thin sensor coverage for older or niche products, and flaws used in targeted operations that rarely reach honeypots.

There is also some circularity: KEV listing is one of the inputs to EPSS, so the score of a CVE tends to rise once CISA lists it. EPSS is most valuable for the CVEs that are not in KEV yet, where it is the only early signal of attacker interest.

KEV: the confirmed list

KEV is binary and evidence-based: a CVE is listed once CISA has reliable evidence of exploitation, a CVE ID and a remediation. It is the strongest single prioritisation signal available, but it lags behind first exploitation and is not complete. Our guide CISA KEV explained covers the fields and due dates in detail.

Combining them: a simple decision ladder

None of the three knows anything about your environment. The most important extra input is exposure: is the vulnerable asset reachable from the internet? With that, a workable order looks like this:

Example prioritisation ladder (adapt the thresholds to your capacity)
Priority	Condition	Target
1	In KEV and internet-exposed	Fix or isolate within days; check for prior compromise
2	In KEV, internal only	Fix within the next patch cycle at the latest
3	High EPSS percentile (e.g. 95th or above) and internet-exposed	Treat like KEV until proven otherwise
4	High CVSS with full system impact, exposed, no exploitation signal	Regular patch cycle, watch EPSS and KEV daily
5	Everything else	Next scheduled upgrade

This is close to how CISA's BOD 26-04 now sets federal deadlines: it asks whether an asset is internet-exposed, whether exploitation is confirmed, whether it can be automated and whether it gives full control, and shortens the deadline as more answers are yes. The same decision points appear in CISA's Stakeholder-Specific Vulnerability Categorization (SSVC).

Common mistakes

Sorting the whole backlog by CVSS. It puts unexploited theoretical criticals ahead of exploited medium-severity flaws.
Using a fixed EPSS threshold as the only gate. Half of KEV would fall below 0.5.
Ignoring CVE age. Old CVEs still enter KEV, see Why decade-old CVEs still land in KEV.
Comparing CVSS 3.1 and 4.0 scores as if they were the same scale.
Treating a patch as the end of the story for KEV entries on exposed systems. If the system was reachable during the exploitation window, check for compromise.

Every CVE page on this site shows KEV status, EPSS score and percentile, and the NVD CVSS score side by side. Try it with the CVE search.