CVSS vs EPSS Scoring: A Practical Guide to Vulnerability Prioritization
- Jul 10
- 8 min read
Updated: Jul 26
Introduction
Vulnerability scanners routinely report thousands of findings. Sorting by CVSS alone leaves teams patching "Critical" issues that may never see exploitation while under-prioritizing medium-severity bugs that attackers actively weaponize. CVSS (Common Vulnerability Scoring System) answers how bad a flaw is technically; EPSS (Exploit Prediction Scoring System) estimates how likely exploitation is in the near term.
This guide explains how each framework works, where they disagree, and how to combine CVSS, EPSS, and the CISA Known Exploited Vulnerabilities (KEV) catalog into a triage workflow your SOC and patch teams can run weekly.
The remediation mountain problem
After a full-network scan, you may inherit a backlog where every finding labeled High or Critical competes for the same maintenance window. CVSS gives a shared language for severity, but severity alone does not equal operational risk: exploit availability, exposure, asset criticality, and compensating controls all matter.
Standardized scores reduce arguments in ticket queues. The goal is not to patch everything, but to patch what moves risk the fastest.
What Is a CVSS Score?
The Common Vulnerability Scoring System (CVSS) is a standardized framework used for assessing the severity of security vulnerabilities in software and hardware. It provides a numerical score ranging from 0 to 10, which reflects the potential impact of a vulnerability on an organization’s information systems. The CVSS score is crucial for prioritizing remediation efforts and managing risk effectively.
It answers the question: if this vulnerability is successfully exploited, how damaging could it be to us?
CVSS is maintained by FIRST organization and widely embedded in NVD records, almost all vendor advisories, and standard scanner exports. Version 3.x and 4.x express impact through metric groups:
Metric group | What it captures |
Base | Intrinsic properties: attack vector, complexity, privileges required, user interaction, confidentiality/integrity/availability impact |
Temporal | Factors that change over time (e.g., exploit code maturity, remediation level) when publishers supply them |
Environmental | Deployment-specific modifiers (confidentiality requirements, modified attack vector) |
Components of CVSS
CVSS scores are derived from three main metric groups:
Base Metrics: These metrics represent the intrinsic characteristics of a vulnerability that are constant over time and across environments. They include:
Attack Vector (AV): How the vulnerability can be exploited (e.g., local, adjacent network, network).
Attack Complexity (AC): The conditions beyond the attacker's control that must exist for an exploit to succeed (e.g., low, high).
Privileges Required (PR): The level of access the attacker needs to exploit the vulnerability (e.g., none, low, high).
User Interaction (UI): Whether exploitation requires user interaction (e.g., none, required).
Scope (S): Whether the vulnerability affects only the vulnerable component or if it can affect other components (e.g., unchanged, changed).
Impacts: The potential impact on these three security objectives (e.g., none, low, high).
Confidentiality (C)
Integrity (I)
Availability (A)
Temporal Metrics: These metrics measure the characteristics of a vulnerability that may change over time. They include:
Exploit Code Maturity (E): The current state of exploit techniques (e.g., not defined, proof-of-concept, functional).
Remediation Level (RL): The availability of fixes (e.g., official fix, temporary fix).
Report Confidence (RC): The degree of confidence in the existence of the vulnerability (e.g., unknown, reasonable, confirmed).
Environmental Metrics: These metrics allow organizations to customize the CVSS score based on their specific environment and the importance of affected systems. They include:
Modified Base Metrics: Adjustments to the base metrics to reflect the environment's context.
Security Requirements: The importance of confidentiality, integrity, and availability for the organization.
Mapping CVSS Scores to Severity
The final CVSS score is calculated using a formula that combines these metrics. The scores are typically categorized as follows:
Score Range | Severity Level |
0.0 - 3.9 | Low severity |
4.0 - 6.9 | Medium severity |
7.0 - 8.9 | High severity |
9.0 - 10.0 | Critical severity |
Understanding the CVSS score helps organizations prioritize vulnerabilities based on their potential impact, enabling more effective risk management and resource allocation for remediation efforts.
Reading a CVSS vector (example)
Consider the critical CVE-2025-55182 (React Server Components RCE, dubbed as "React2Shell"), which shipped with a CVSS 3.1 Base score of 10.0 (Critical). A simplified reading of why the base score maxes out:
Attribute | Description |
Attack Vector (AV) | Network: Reachable remotely via crafted HTTP requests targeting Server Function endpoints. |
Attack Complexity (AC) | Low: Reliable exploitation paths exist due to the unsafe deserialization of payloads. |
Privileges Required (PR) | None: It is a pre-authentication vulnerability, meaning unauthenticated exploitation is possible in common configurations. |
User Interaction (UI) | None: No direct user interaction is needed to trigger the malicious deserialization process. |
Scope (S) | Changed: The attacker can achieve remote code execution on the underlying server environment, completely escaping the boundaries of the impacted React component. |
Impact (C,I,A) | High across confidentiality, integrity, and availability in the affected Node.js/server environments due to full system compromise. |
CVSS is essential for comparing technical impact across CVEs. It does not inherently tell you whether anyone is exploiting the bug today—though in the case of CVE-2025-55182, it was rapidly added to CISA's Known Exploited Vulnerabilities (KEV) catalog due to active exploitation in the wild by threat groups.
CVSS is essential for comparing technical impact across CVEs. It does not tell you whether anyone is exploiting the bug today.
What is EPSS Score ?
The EPSS (Exploit Prediction Scoring System) Score is a metric designed to assess the likelihood that a given vulnerability will be exploited in the wild. It provides organizations with a quantifiable way to prioritize vulnerabilities based on their potential risk.
EPSS is a data-driven model also hosted by FIRST. It essentially gives us:
EPSS score: A probability (0 - 1) score indicating whether the vulnerability will be observed exploited in the wild within the next 30 days.
Percentile: How this CVE ranks relative to all scored CVEs (e.g., 98th percentile means only 2% score higher).
Models incorporate exploit telemetry, CVE metadata (age, vendor, CWE), and public exploit signals. Scores update daily, so always pull current values before executive reporting.
Key Components of EPSS Score:
Data-Driven: The score is derived from real-world data, analyzing historical exploit trends and patterns.
Dynamic: It updates regularly to reflect the evolving threat landscape and emerging exploit techniques.
Scoring Range: The score typically ranges from 0 to 1, where a higher score indicates a greater likelihood of exploitation.
Benefits of Using EPSS Score:
Prioritization: Helps security teams focus on vulnerabilities that pose the greatest risk to their systems.
Resource Allocation: Enables efficient use of resources by addressing high-risk vulnerabilities first.
Informed Decision-Making: Provides a data-backed approach to vulnerability management and remediation strategies.
Research presented at Black Hat 2019 and subsequent FIRST publications note that only a small fraction of published CVEs are ever exploited in the wild; exact percentages vary by dataset and time window. That gap is why probability layers matter on top of severity.
Checking EPSS in practice
Use the FIRST EPSS data and API or vendor integrations (Tenable, Rapid7, Wiz, etc.) that embed EPSS next to CVSS in export files. A minimal triage habit:
For each Critical/High CVE in this week's scan export:
1. Record CVSS Base from NVD/advisory
2. Record current EPSS score + percentile
3. Check CISA KEV listing (yes/no)
4. Assign patch window per decision table below
EPSS is probabilistic, not prophetic. Treat it as a prioritization signal, not a substitute for asset context or threat intel on your industry.
Reading an EPSS Score (example)
Now, let's look at the Exploit Prediction Scoring System (EPSS) for the exact same vulnerability, CVE-2025-55182 (React2Shell). While CVSS measures the theoretical technical severity based on static attributes, EPSS uses threat intelligence and machine learning to measure the probability of real-world exploitation.
Here is a simplified reading of its live EPSS metrics:
Metric | Analysis |
EPSS Score (Probability) | 0.9956 (99.56%): This represents the probability that the vulnerability will be exploited in the wild within the next 30 days. An EPSS score this close to 100% is exceptionally rare and indicates massive, active, and ongoing exploitation campaigns. |
Percentile | 0.999 (99.9th Percentile): This means the threat level for CVE-2025-55182 is scored higher than 99.9% of all other known vulnerabilities. It sits in the absolute top tier of imminent, critical threats. |
Unlike CVSS, EPSS is a dynamic score driven by live data (such as exploit code publication, honeypot activity, and active scanning). Because CVE-2025-55182 is a pre-authentication vulnerability, trivial to exploit over the network, and actively leveraged by threat groups, the EPSS model assigns it an almost guaranteed probability of exploitation.
This highlights the core difference between the two systems: CVSS told us the bug has the technical potential to severely compromise a system, but EPSS tells us that threat actors are highly likely to be exploiting it right now.
Where CVSS and EPSS diverge (case studies)
The table below uses illustrative combinations seen in industry write-ups. EPSS values change daily; verify live scores at FIRST before SLA commitments.
Real World Importance | CVE | CVSS (Base) | EPSS (illustrative) | Expected Verdict |
|---|---|---|---|---|
Drop-everything | CVE-2021-44228 (Log4Shell) | 10.0 Critical | Very high (~0.9+) | Emergency change: maximum severity and near-certain exploitation pressure |
Hidden threat | CVE-2020-13956 (Apache HttpClient) | 5.3 Medium | Elevated vs peers | Prioritize over many High CVSS / low EPSS items |
Deferrable critical | CVE-2019-17531 (jackson-databind) | 9.8 Critical | Very low | Schedule in normal cycle; monitor EPSS and KEV for movement |
The middle row is the lesson most programs miss: medium CVSS + high EPSS often beats high CVSS + low EPSS when maintenance time is scarce.
CVSS vs EPSS Comparison
Aspect | CVSS | EPSS |
|---|---|---|
Primary purpose | Technical severity if exploited | Predicted exploitation probability (30-day) |
Score range | 0.0 - 10.0 | 0 - 1 (probability) |
Update cadence | Base static; temporal/environmental when supplied | Daily model refresh |
Methodology | Expert-defined metric framework | Machine learning on telemetry + metadata |
Best for | Impact comparison, compliance reporting | Queue ordering, SOC triage |
Limitation | No live threat signal | Probabilistic; needs asset/context overlay |
Adding CISA KEV as the exploitation ground truth
The CISA KEV catalog lists vulnerabilities with confirmed active exploitation and federal remediation deadlines. For many enterprises, KEV membership is a binary override: if listed, escalate regardless of internal CVSS debates.
Sample SOC triage rule
Remediate in an accelerated window when any of the following is true:
CVSS Base - 7.0 and internet-facing asset affected
EPSS - organizational threshold (many teams start at 0.10-0.20 for standard IT; stricter for crown jewels)
CVE appears on CISA KEV
Threat intel confirms active campaigns targeting your stack
Scenario | CVSS | EPSS | CISA KEV | Typical action |
|---|---|---|---|---|
A | High | High | Yes | Critical: emergency or 24-72h window |
B | Low/Medium | High | Yes | High: confirmed exploitation trumps CVSS label |
C | High | Low | No | Scheduled maintenance; re-check EPSS weekly |
D | Low | Low | No | Backlog / risk acceptance with compensating controls |
Document thresholds in your vulnerability management standard so auditors and patch owners share the same definitions.
A workflow for Vulnerability Managers
Ingest scanner + agent findings; normalize on CVE ID.
Enrich with NVD CVSS, current EPSS, and KEV status.
Filter by asset exposure (internet, admin tier, data classification).
Sort by KEV first, then EPSS percentile, then CVSS Base.
Assign owners and SLAs; track exceptions with expiry dates.
Re-score open items weekly; EPSS movement triggers reprioritization.
Pair this process with hands-on skills from our web application penetration testing methodology and Nmap host discovery posts when validating whether exposed services actually match scanner assumptions.
Common Mistakes We Observe
Patching by CVSS alone on internet-facing estates with large backlogs.
Ignoring EPSS movement on tickets open for months.
Treating EPSS as zero-risk when score is low but KEV adds the CVE later.
Skipping environmental context: a CVSS 9 on an isolated lab VM differs from the same CVE on a payment gateway.
Conclusion
CVSS tells you how painful a succesful exploit could be. While, EPSS tells you how likely the exploitation is. Furthermore, CISA KEV tells you when exploitation is already confirmed. Together, they turn an impossible "fix everything" mandate (say from an automated scan report) into a risk-based queue aligned with real-world threat pressure, development capacity and risk appetite.
Remember to revisit these thresholds set at least quarterly, align with incident response playbooks, and train your analysts to cite all three signals in escalation tickets as available.
References
Register for instructor-led online courses today! https://www.darkrelay.com/courses
Check out our self-paced learning paths! https://www.darkrelay.com/learning-paths
Explore our bundled Pricing & Plans for cost-effective options! Buy a course subscription to learn more—hands-on labs and expert-led training included. https://www.darkrelay.com/plans-pricing
Contact us for custom pentesting needs at: info@darkrelay.com or WhatsApp.
Comments