Explainer
KEV vs EPSS vs CVSS
CVSS says how bad a vulnerability could be, EPSS estimates how likely it is to be exploited in the next 30 days, and CISA's KEV catalog says it has already been exploited. Use KEV first, EPSS to rank what is not yet in KEV, and CVSS to judge impact.
| CVSS | EPSS | CISA KEV | |
|---|---|---|---|
| Answers | How severe could it be? | How likely is exploitation soon? | Has it been exploited? |
| Made by | FIRST standard; scored by the vendor (CNA), NVD or CISA | FIRST, a daily statistical model | CISA (US Cybersecurity and Infrastructure Security Agency) |
| Form | 0 to 10 score and a vector | Probability (0 to 100%) and percentile | Listed or not, with date added and a due date |
| Changes | Rarely | Daily | When new evidence appears; entries are rarely removed |
| Limits | Not about likelihood or your exposure | An estimate, not proof; never certainty | Only exploitation CISA can confirm; not all of it |
Why you need all three: live numbers from KEVWire
- 25% of KEV entries with an EPSS score (434 of 1,760) have EPSS below 10%, although they are known to have been exploited. A low EPSS is not a safety signal.
- 12% of scored KEV entries (217 of 1,760) are rated below CVSS 7. Severity alone would put them at the back of the queue.
A practical order
- Known exploited (KEV) and present in your stack: patch or mitigate first. US federal civilian agencies must meet CISA's due date; treat it as an upper bound.
- Not in KEV, but high EPSS: next. Exploitation is likely soon.
- High CVSS, low EPSS: schedule by impact and exposure.
KEVWire shows all three on every record, with dates and sources: see what is known exploited, this week's additions, or filter to your stack.