Blog
CVSS, EPSS and CISA KEV: which vulnerability do you patch first?
A CVSS score of 9.8 sounds like “now”. But when dozens of vulnerabilities rated 9 or higher appear every week, you need an order. CVSS, EPSS and CISA’s KEV catalog answer three different questions.
Updated · Stackwatch team
Three scores, three questions
| Question | Range | Published by | |
|---|---|---|---|
| CVSS | How severe would exploitation be? | 0 to 10 | FIRST (standard), scores from the vendor or NVD |
| EPSS | How likely is exploitation in the next 30 days? | 0 to 1, plus a percentile | FIRST, updated daily |
| CISA KEV | Is the vulnerability known to be exploited? | yes or no | CISA (US agency) |
CVSS: severity
The Common Vulnerability Scoring System rates how serious a vulnerability is technically: attack over the network, no login, code execution? Then it ends up near the top. But CVSS says nothing about whether the vulnerability is being attacked right now or whether it affects your system.
EPSS: likelihood
FIRST’s Exploit Prediction Scoring System estimates how likely a vulnerability is to be exploited in the next 30 days. An EPSS of 0.12 means roughly 12 percent. That sounds low but is high compared to most CVEs, which is why it comes with a percentile.
CISA KEV: evidence
The Known Exploited Vulnerabilities Catalog of the US agency CISA lists vulnerabilities with evidence of exploitation. Since June 2026, KEV status has been one of the criteria under directive BOD 26-04 by which US federal civilian agencies must prioritize security updates. For everyone else it is a strong signal. It is deliberately conservative: a vulnerability only gets in once the evidence is sufficient.
The PHP2Shell example
For PHP2Shell, the three values looked like this on 23 October 2026:
| CVE-2026-109618 | CVE-2026-109619 | |
|---|---|---|
| CVSS 4.0 | 9.2 | 9.2 |
| EPSS | 0.116 (96th percentile) | 0.060 (93rd percentile) |
| CISA KEV | not listed | not listed |
At the same time, Amazon and Cloudflare had already observed attack attempts and attack traffic. This shows the limits: KEV lags behind because it needs evidence, and EPSS is an estimate. If you only wait for KEV, you react too late in fast-moving waves.
An order that works in practice
- Does it hit my stack? Without a match, every score is irrelevant. This is the first and most important filter.
- In KEV or reports of active attacks? Act immediately, even outside working hours.
- CVSS 9 or higher and reachable from the internet? Within hours to a few days.
- High EPSS (for example above the 90th percentile)? Move it up.
- Everything else: in your regular update cycle.
You set the thresholds yourself and write them into your policy. That is exactly what auditors ask about under NIS2 and ISO 27001.
How Stackwatch handles this
Stackwatch matches new vulnerabilities deterministically against the versions in your stack, without guessing. Only what affects you gets rated. CISA KEV is one of the sources, so confirmed exploitation is visible in the alert. How the matching works is described in how it works.
Sources
Frequently asked questions
What is the difference between CVSS, EPSS and CISA KEV?
CVSS rates the technical severity of a vulnerability (0 to 10). EPSS estimates how likely it is to be exploited in the next 30 days (0 to 1). The CISA KEV catalog lists vulnerabilities with proven exploitation.
Is a high CVSS score enough to patch a vulnerability first?
Not on its own. CVSS says nothing about whether the vulnerability is being attacked right now or whether it affects your system. The first filter is therefore whether the vulnerability hits your stack.
What does an EPSS score of 0.12 mean?
About a 12 percent probability that the vulnerability is exploited in the next 30 days. That sounds low, but it is high compared with most CVEs, which is why a percentile is given alongside it.
Why is waiting for a KEV entry not enough?
KEV needs proof and is deliberately conservative, so it lags behind. For PHP2Shell, neither CVE was in KEV on 23 October 2026, although Amazon and Cloudflare had already observed attack attempts and attack traffic.
In what order should I prioritize new vulnerabilities?
First check whether the vulnerability affects your stack. Act immediately on KEV or reports of active attacks, within hours to a few days on CVSS 9 or higher if reachable from the internet, move up a high EPSS, and handle everything else in the normal update rhythm. You set the thresholds yourself and write them into your policy.
Can a tool automatically check whether a vulnerability affects my stack?
Yes. Stackwatch matches new vulnerabilities deterministically against the versions in your stack and shows confirmed exploitation from CISA KEV in the alert.