CVSS, EPSS and KEV: A Practical Framework for Prioritizing Security Vulnerabilities

Dependency scanners routinely surface hundreds of vulnerabilities, but fewer than 5% of published CVEs are ever exploited in the wild, making raw CVSS scores an unreliable basis for prioritization. CVSS rates theoretical severity on a 0–10 scale but ignores real-world exploitation likelihood, meaning a high score can reflect a risk that attackers never actually pursue. EPSS, a machine-learning model maintained by FIRST, addresses this gap by producing daily probability scores for exploitation within 30 days, with the top 1% of CVEs by EPSS accounting for roughly 75% of observed attacks. CISA's Known Exploited Vulnerabilities catalog goes further, listing CVEs confirmed as actively exploited in real attacks — these entries represent the highest-priority fixes regardless of their CVSS score. Used together, the three systems allow security teams to dramatically shrink fix lists while concentrating effort on vulnerabilities that pose genuine, immediate risk.