How to prioritize vulnerabilities with CISA KEV, EPSS and CVSS

Sort a vulnerability backlog by CVSS and the top of the list fills with criticals, most of which will never be exploited. FIRST, which maintains CVSS, says a base score measures severity and should not be used alone to assess risk. Its EPSS team goes further: high CVSS scores are only slightly better than random at predicting exploitation. Meanwhile a bug rated high, not critical, can be the one attackers are using this week.

Three free signals fix most of that. CISA's Known Exploited Vulnerabilities (KEV) catalog records which bugs have been exploited. FIRST's Exploit Prediction Scoring System (EPSS) estimates which are likely to see exploitation in the next 30 days. CVSS, completed with your own threat and environmental data, describes how bad exploitation would be. CISA now builds federal patch deadlines from the same ingredients: BOD 26-04, issued on 10 June 2026, replaced BOD 22-01 and sets timelines from exposure, KEV status, automation and impact.

What each signal measures

KEV is a list of facts, not a score. CISA adds a vulnerability only when it has a CVE ID, reliable evidence of active exploitation in the wild, and a clear remediation action such as a vendor update. Attempted exploitation counts, including a hit on a honeypot; scanning, research and proof-of-concept code do not. On 28 October 2026 the catalog, version 2026.10.27, held 1,760 entries. CISA publishes it as JSON and CSV feeds, and each entry carries a dueDate, a forensicTriage flag tied to BOD 26-04 and a knownRansomwareCampaignUse field. That field reads Known when CISA has confirmed use in a ransomware campaign, true of 361 entries; Unknown means only that CISA lacks confirmation.

EPSS is a forecast. Each day it gives every published CVE a probability between 0 and 1 that FIRST's data partners will observe exploitation activity in the next 30 days, plus a percentile that ranks it against every other scored CVE. Most scores sit near zero because most CVEs are never exploited. FIRST puts the 30-day base rate at roughly 2 to 3 percent, so a score of 0.10 already lands around the 95th percentile. The current model, v2026.06.15, has published since 15 June 2026. Confirmed exploitation trains the model but does not feed the daily score.

CVSS v4.0 has four metric groups. Base captures the bug's intrinsic, reasonable worst-case characteristics; Threat adjusts for exploit maturity; Environmental adjusts for your asset's importance and controls; Supplemental adds context without changing the score. Vendors and NVD usually publish only Base, which FIRST labels CVSS-B. An unset Exploit Maturity is scored as Attacked, so a published base score already assumes the worst, and only your own threat data can lower it.

SSVC is a decision tree, not a number. CISA's version weighs five decision points (exploitation status, technical impact, automatable, mission prevalence and public well-being impact) and returns one of four actions: Track, Track*, Attend or Act. CISA publishes its exploitation, automatable and technical impact answers in CVE records through its Vulnrichment program. BOD 26-04's timeline table, which CISA says SSVC informed, uses four inputs: public exposure, KEV status, automatable and technical impact.

A practical triage order

Work from evidence to estimate. BOD 26-04 binds only federal civilian agencies, but its windows are a useful yardstick, so each step quotes them.

1. In KEV and exposed: fix now. A KEV listing means someone already has a working exploit. Patch, then check whether the system was compromised before you did. BOD 26-04 gives three days to most of these, with a forensic triage when the bug gives total control.
2. In KEV, internal only: fix within two weeks. BOD 26-04 allows 14 days, unless the exploit can be automated and gives total control, which keeps the three-day clock and the triage.
3. High EPSS or automatable, on exposed assets: next. Pick an EPSS threshold your team can sustain. BOD 26-04 gives three days to an exposed, automatable, total-control bug even outside KEV, and 14 days to exposed bugs with only one of those two properties.
4. Everything else: let CVSS and your environment schedule it. Fill in the environmental metrics, or at least asset criticality, and fold the rest into normal patch cycles. BOD 26-04 allows 60 days, or the next system upgrade for internal bugs that are neither in KEV nor automatable.

Rerun the order daily: a CVE jumps a tier when it lands in KEV or its EPSS score climbs. BOD 26-04's clocks move the same way, shortening when a CVE joins KEV and lengthening when an asset comes off the internet.

Exposure is the multiplier in every step. BOD 26-04 calls an asset publicly exposed when unauthenticated or untrusted parties can reach it over a public network such as the internet, wherever it sits. Start with edge devices, VPN gateways, public web servers and the management interfaces of firewalls and appliances. EPSS cannot see your network; FIRST says to check presence, reachability and consequence before acting on a score.

Common mistakes

• Treating CVSS base as risk. A base score describes the bug, not your exposure. A 9.8 on an isolated test box can matter less than a 7.2 on your firewall.
• Multiplying EPSS by CVSS. FIRST says the product has no interpretable meaning, because EPSS is a calibrated probability and CVSS an ordinal ranking. Use them as separate gates.
• Ignoring KEV entries for old CVEs. On 8 October CISA added five CVEs dated 2015 to 2023, including 2015 bugs in ProFTPD and ISC BIND (our October roundup lists them). CISA says an old entry need not mean current exploitation, but it does not assume legacy systems are patched either. Both 2015 bugs scored above 0.99 on EPSS on 27 October.
• Trusting "no public exploit". KEV does not require public proof-of-concept code. A bug can be exploited with nothing on GitHub and a low EPSS, as PAN-OS shows below.
• Reading EPSS like a grade. A 50 percent threshold sounds cautious, but with a 2 to 3 percent base rate it ignores almost everything. FIRST notes that EPSS around the 90th percentile selects about as many CVEs as a CVSS Critical filter.

Automate it

Both sources are public and need no key. Download the KEV catalog once and query it locally:

curl -sSf -o kev.json \
  https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
 
# Catalog version and size
jq '{catalogVersion, count}' kev.json
 
# Listed CVEs from your list, with due date and ransomware use
jq -r --arg ids "CVE-2026-0322,CVE-2026-111497,CVE-2026-109618" '
  ($ids | split(",")) as $want
  | .vulnerabilities[]
  | select(.cveID | IN($want[]))
  | [.cveID, .dateAdded, .dueDate, .knownRansomwareCampaignUse] | @tsv' kev.json

The EPSS API takes comma-separated CVE IDs, up to 2,000 characters per request, and returns 100 rows unless you set limit. FIRST built it for lookups and points bulk users to the daily CSV. A CVE with no score is simply missing from the response, so compare the total field with the number of IDs you sent.

curl -sSf "https://api.first.org/data/v1/epss?cve=CVE-2026-0322,CVE-2026-111497,CVE-2026-109618" \
  | jq -r '.data[] | [.cve, .epss, .percentile, .date] | @tsv'
 
# How one score moved over the last 30 days
curl -sSf "https://api.first.org/data/v1/epss?cve=CVE-2026-111497&scope=time-series" \
  | jq -r '.data[0]["time-series"][] | [.date, .epss] | @tsv'

ids="CVE-2026-0322,CVE-2026-111497,CVE-2026-109618"
curl -sSf "https://api.first.org/data/v1/epss?cve=$ids" -o epss.json
jq -r --slurpfile kev kev.json '
  ($kev[0].vulnerabilities | map({(.cveID): .dueDate}) | add) as $due
  | .data[] | [.cve, .epss, .percentile, ($due[.cve] // "not in KEV")] | @tsv' epss.json

Worked example

Three bugs from our October briefings, with EPSS scores dated 27 October 2026 and read from the API on 28 October:

php2shell is the easy case, with every signal in agreement. Its EPSS score rose from 0.053 on 22 October to 0.9998 on 25 October, a day before CISA listed both CVEs. Unauthenticated code execution on internet-facing web servers puts it at step 1.

Node2Shell was our example of critical but not exploited until 27 October. Its EPSS score was 0.005 on 23 October, 0.33 on 25 October and 0.555 on the day CISA added it to KEV. CISA's Vulnrichment data now records exploitation as active, not automatable, with total technical impact. BOD 26-04's table gives those values three days and a forensic triage on a publicly exposed asset; the catalog's 14-day date matches an asset that is not exposed. If an internet-facing service of yours decompresses Brotli from untrusted clients, work to the shorter clock.

PAN-OS CVE-2026-0322 is the case a CVSS- or EPSS-sorted queue gets wrong. It is high rather than critical, needs valid high-privilege credentials, and NVD scores it 7.2 in CVSS 3.1. Every daily EPSS score since 15 October has stayed below 0.02. Yet Palo Alto reports very limited exploitation, and CISA listed it on 14 October with a three-day deadline and a forensic triage. A firewall's management interface is exactly the exposure step 1 is about.

Sorted by CVSS alone, PAN-OS comes last of the three. Sorted by KEV status and exposure, it joins php2shell at the top.

Beyond the score

Prioritization orders the work; it does not prove the work was done. A version string can report a fix while a container still runs the old image or a service never restarted, and for KEV entries flagged for forensic triage, patching leaves open whether someone got in first. Close each item with evidence by rerunning the check that found it against the live system. How a retest verifies a fix explains how Rokkhe does that for findings it has reproduced.