KEV · method
CVSS, EPSS and KEV answer three different questions.
One describes the flaw. One predicts whether it will be used. One records that it was. None of them knows what you run.
The three questions
| Question it answers | Published by | What it cannot tell you | |
|---|---|---|---|
| CVSS | How bad is this flaw, if someone uses it? | FIRST maintains the standard. Vendors and NVD assign scores. | Whether anyone is using it. Whether you are exposed. |
| EPSS | How likely is exploitation activity in the next 30 days? | FIRST. Updated daily. | Impact. Your exposure. It is a prediction, not an observation. |
| KEV | Has CISA seen reliable evidence that it is being used? | CISA | Anything CISA has not seen or cannot act on. Your exposure. |
CVSS is a description
The CVSS base score is built from properties of the flaw: attack vector, complexity, privileges required, user interaction, impact. Version 4.0 was published by FIRST in November 2023 and adds threat and environmental metric groups that most feeds still leave empty.
Two things go wrong in practice. First, the base score gets read as risk. A 9.8 on a product you do not run is zero work. A 6.5 on your VPN that is in KEV is today's work. Second, scores for the same CVE differ by source. The vendor scores it, NVD may score it again, and the two can disagree. If your tooling picks one silently, know which one.
EPSS is a forecast
The Exploit Prediction Scoring System estimates the probability that exploitation activity for a CVE will be observed in the next 30 days. FIRST publishes a score and a percentile for every published CVE, every day, with a free API. It is useful for the long tail: the thousands of CVEs that are not in KEV, where you need a reason to look at one before another.
It is still a model. A high score means the signals look like CVEs that got used. It does not mean someone used this one, and a low score is not a promise.
KEV is a record
CISA adds a CVE when three things are true: it has a CVE ID, there is reliable evidence of active exploitation, and there is clear remediation guidance, usually a vendor update. That last condition matters. A bug that is being used but has no fix yet can be missing from the catalog.
The due dates bind US federal civilian agencies. Since 10 June 2026 the governing directive is BOD 26-04, Prioritizing Security Updates Based on Risk, which carried forward the catalog criteria first set under BOD 22-01 in 2021. For everyone else the dates are a sort key. CISA's 3 November alert describes BOD 26-04 as telling agencies to prioritise KEV entries on exposed assets where exploitation gives total control.
Combining them without pretending
- Start from your inventory. Every score is about a product, and a product you do not run is not your row.
- In KEV and exposed: now. Use the triage flag to decide whether the change includes a compromise check.
- Not in KEV, high EPSS, exposed: this patch cycle, ahead of the rest.
- Everything else: CVSS as a tiebreaker, adjusted by what the asset holds and who can reach it.
Why the working set has no score column
We did not read a CVSS vector or an EPSS value for each of the 38 rows, so we do not print one. A number we copied from somewhere without checking would look precise and be worth less than the class line.