EPSS over CVSS: prioritising the CVEs attackers actually exploit

Every vulnerability scanner sorts by CVSS, and every team that has worked a CVSS-sorted queue knows the problem: there are far more "critical" and "high" CVEs than anyone can patch, and the score does not say which of them attackers are actually using.

What CVSS measures, and what it does not

CVSS, maintained by FIRST, describes the technical severity of a vulnerability: how it is reached, what it takes to exploit, and what an attacker gains. It is a good description of how bad a vulnerability could be. It is not a measure of how likely exploitation is, and FIRST's own guidance says the base score alone is not a measure of risk.

What EPSS adds

The Exploit Prediction Scoring System, also published by FIRST, estimates the probability that a CVE will be exploited in the wild in the next 30 days. It is a number between 0 and 1, updated daily, built from observed exploitation activity and the characteristics of each CVE. Two CVEs with the same CVSS score can have very different EPSS scores, and that difference is the point.

What KEV adds

The CISA Known Exploited Vulnerabilities catalogue lists CVEs with evidence of exploitation in the wild. EPSS is a forecast; KEV is a record. A CVE on KEV is not a prediction any more.

How to use the three together

• On KEV: fix first, regardless of CVSS. Exploitation is already happening.
• High EPSS: next. The forecast says attackers are likely to use it soon.
• High CVSS, low EPSS, not on KEV: schedule it, but it should not displace the two groups above.
• Context last, but always: a CVE on an internet-facing workload with a path to sensitive data matters more than the same CVE on an isolated test box. Exploitability and exposure together decide the order.

The caveat

EPSS is a probability across the whole internet, not a statement about your environment. A low score does not make a vulnerability safe to ignore when it sits on your most exposed system, and a high score on an unreachable internal host is less urgent than it looks. Use it to order work, not to close tickets.

How Onam uses it

Onam carries EPSS and KEV on vulnerability findings alongside CVSS. Dependency findings from Code Security get a 0–10 risk score that weighs EPSS and KEV, attack paths through a node with a high-EPSS vulnerability score as more likely, and the FAIR-style loss estimate on each finding uses EPSS as its starting point for how often a loss event is expected. See vulnerability management for the details.