EPSS vs CVSS: how to prioritize vulnerability patching

CVSS and EPSS are often mentioned together, which makes it easy to assume they measure the same thing. They do not. CVSS scores how damaging a vulnerability could be if exploited. EPSS estimates how likely it is to be exploited soon. A patch queue that uses only one of them is missing half the picture.

What CVSS measures

CVSS, the Common Vulnerability Scoring System, produces a base score from 0 to 10 and a severity label from low to critical, derived from the attack vector, complexity, and impact on confidentiality, integrity, and availability. It is a good measure of potential impact, and it is stable, but it says nothing about whether the vulnerability is being exploited.

What EPSS measures

EPSS, the Exploit Prediction Scoring System, produces a probability from 0 to 1 that a vulnerability will be exploited in the next 30 days, updated daily from real-world signals. A CVE can carry a modest CVSS score and a high EPSS score, which is exactly the case a CVSS-only queue tends to miss.

Why CVSS alone misfires

• Many vulnerabilities score high on CVSS but are never exploited, so patching strictly by CVSS spends effort where there is no attacker.
• Some lower-scored vulnerabilities are exploited widely, and a CVSS-only queue lets them wait.
• CVSS is static after publication, while exploitation activity changes over time. EPSS moves; CVSS does not.

A simple rule that combines all three

• First, patch anything in the CISA KEV catalog. Confirmed exploitation outranks everything.
• Next, patch high-EPSS items, which are likely to be exploited soon even if not yet confirmed.
• Then, work through remaining high-CVSS issues by impact.
• Use CVSS to break ties and to size the blast radius once urgency is set by KEV and EPSS.

Doing this by hand across many CVEs is tedious. The KBrain CVE brain returns CVSS, CISA KEV status, and EPSS together on every lookup, so an AI assistant or a monitoring agent can apply this rule directly.