Vulnerability intelligence
Not every CVE deserves a fire drill – learn which ones actually get exploited
Over 40,000 CVEs were published in 2024, but only a small fraction are ever used in an attack. The difference is in the chain of signals attached to each one. Learn to read it – and triage like an attacker.
- Built on CVSS, EPSS & CISA KEV
- Vendor-neutral
- Updated 2026
What is a CVE
A CVE names the flaw. It doesn’t tell you what to do about it.
CVE is just an identifier. The decision – patch tonight, or next quarter – comes from the signals layered on top of it.
A CVE (Common Vulnerabilities and Exposures) is a unique public identifier for one specific security flaw – for example CVE-2024-3400. It is a name and a description, nothing more. It says a weakness exists; it does not say how dangerous it is to you.
To turn a CVE into a decision you add three signals. CVSS rates how severe the flaw is in the abstract. EPSS estimates how likely it is to be exploited in the next 30 days. The CISA KEV catalog records whether it is already being exploited in the wild.
Read together, these four – CVE, CVSS, EPSS, KEV – are the chain that separates the handful of vulnerabilities attackers will actually use from the tens of thousands that they won’t.
The four signals
Read the chain, not just the score
Each signal answers a different question. Only together do they tell you what to do.
- CVE
The identifier
A unique ID (CVE-YYYY-NNNN) for one specific flaw, assigned by a CVE Numbering Authority. It’s the shared name everyone – vendors, scanners, feeds – uses to refer to the same vulnerability.
- CVSS
The severity
A 0–10 score describing how bad the flaw is if exploited (attack vector, complexity, impact). Useful, but static and context-free – and most CVEs land in the "High/Critical" band, so it can’t be your only filter.
- EPSS
The probability
The Exploit Prediction Scoring System gives each CVE a 0–100% probability of being exploited in the next 30 days, updated daily from real-world data. It’s how you find the needles in the CVSS haystack.
- KEV
The proof
CISA’s Known Exploited Vulnerabilities catalog lists CVEs confirmed to be exploited in the wild. If a CVE is in KEV, the debate is over – it is being used against real targets right now.
Prioritise like an attacker
From 40,000 CVEs to a short list
Attackers don’t sort by CVSS – they use what works and what’s reachable. Mirror that, and four tiers fall out.
- Act now
Known-exploited & exposed
Confirmed in use against real targets, on an asset an attacker can reach. This is your fire.
Signal: In CISA KEV, or high EPSS on an internet-facing asset
- This week
Likely & reachable
Not confirmed exploited yet, but a strong probability and a path to the asset. Patch before it flips.
Signal: High EPSS or critical CVSS on an exposed asset
- Planned
Severe but cold
High CVSS but low exploit probability and no exposure. Schedule it into normal patch cycles.
Signal: High CVSS, low EPSS, asset not exposed
- Monitor
Low signal
Low probability and not reachable. Track it – EPSS can rise overnight when an exploit drops.
Signal: Low EPSS, not exposed – re-check as the score moves
Free tool
Should you drop everything for this CVE?
Toggle what you know about a vulnerability. The verdict follows the same logic a good triage process would – exploited and exposed outranks a high score alone.
Priority verdict
Act now – tonight if you can
This is exploited or highly likely to be, and it’s reachable. It belongs at the top of the queue ahead of higher-CVSS items that aren’t being used. If no fix exists yet, mitigate or isolate the asset.
Fix this week
A real probability of exploitation on an asset that can be reached. Not a 2 a.m. page, but don’t let it sit in the backlog – schedule remediation inside the week.
Plan it into a normal cycle
Severe on paper, but the exploit probability or the exposure isn’t there yet. Handle it through routine patching – and keep an eye on its EPSS score in case that changes.
Monitor for now
Low probability and not reachable. Track it rather than spend a maintenance window on it – but re-triage the moment EPSS rises or the asset becomes exposed.
A teaching aid, not a scoring engine — real triage also weighs asset value, compensating controls and business context.
The numbers
Why prioritisation is the whole game
The volume is impossible to patch in full; the exploited slice is small and knowable.
Each figure links to its primary source. Numbers are approximate and updated as new reports are published.
For security teams
You can’t patch 40,000 CVEs. You can patch the ones that matter.
Turning the chain into a repeatable, continuous process is where prioritisation stops being a spreadsheet and starts being defence.
CISA’s Binding Operational Directive 22-01 requires U.S. federal agencies to remediate KEV-listed vulnerabilities within a set deadline – a standard now widely adopted as the baseline for "what must be fixed first".
-
Enrich, don’t just scan
A scanner gives you CVEs and CVSS. Layering EPSS and KEV on top turns a 10,000-line report into a short, ranked action list.
-
Exposure changes everything
The same CVE is urgent on an internet-facing box and routine on an isolated one. Prioritisation has to know your attack surface.
-
Continuous, not quarterly
EPSS updates daily and KEV grows weekly. A CVE that was "monitor" on Monday can be "act now" by Friday when an exploit lands.
-
Testing proves reachability
A penetration test shows which "critical" CVEs are actually exploitable in your environment – and which are shielded by controls.
Guides
Go deeper
Plain-English explainers on each signal in the chain and how to act on it.
-
CVSS vs EPSS: severity is not the same as risk
CVSS tells you how bad a flaw could be. EPSS tells you how likely it is to be exploited. Using them together is the whole point.
Read guide -
The CISA KEV catalog: the vulnerabilities already being exploited
KEV is CISA’s list of CVEs confirmed to be exploited in the wild. If a CVE is on it, the debate about whether to patch is over.
Read guide -
How to prioritise vulnerabilities: a practical playbook
You can’t patch everything. Here’s a repeatable way to decide what to fix first, using exploitation, exposure and severity.
Read guide
Frequently asked questions
Short, clear answers
What is a CVE?
A CVE (Common Vulnerabilities and Exposures) is a unique public identifier for one specific security flaw, in the form CVE-YYYY-NNNN. It names and describes the vulnerability so everyone refers to the same thing, but it does not rank or score it.
What is the difference between CVSS and EPSS?
CVSS scores how severe a vulnerability is (0–10) based on its technical characteristics. EPSS estimates how likely it is to be exploited in the next 30 days (0–100%). Severity is not the same as probability – a Critical CVSS flaw can have a very low EPSS, and vice versa. Read the full comparison →
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities catalog is a list, maintained by the U.S. Cybersecurity and Infrastructure Security Agency, of CVEs confirmed to be exploited in real-world attacks. If a CVE is in KEV, it should be treated as an urgent, patch-first item. More on KEV →
How should I prioritise which vulnerabilities to patch first?
Start with what is exploited and reachable: anything in CISA KEV, or with a high EPSS score, on an internet-facing or attacker-reachable asset. Then work down through high-probability and high-severity items. CVSS alone is a poor sorting key because most CVEs are rated High or Critical. See the prioritisation playbook →
What does the EPSS score actually mean?
An EPSS score is the estimated probability that a vulnerability will be exploited in the wild within the next 30 days, from 0% to 100%. It is produced daily by FIRST from real exploitation and threat data, so it changes over time as the situation evolves.
Is a high CVSS score enough to justify emergency patching?
Usually not on its own. Because a large share of all CVEs score 7.0 or higher, CVSS can’t tell the urgent few from the many. Combine it with EPSS (probability) and KEV (confirmed exploitation) plus whether the asset is exposed before declaring an emergency.
Where do CVE, CVSS, EPSS and KEV data come from?
CVE IDs come from CVE Numbering Authorities (coordinated by MITRE/CVE.org). CVSS scores are published in the NVD and by vendors. EPSS is produced by FIRST. KEV is maintained by CISA. cvechain explains how they fit together and links to each primary source.
How can a team keep this up to date automatically?
Manual triage doesn’t scale when EPSS changes daily and KEV grows weekly. Teams typically feed CVE, EPSS and KEV data into their vulnerability workflow, weighted by exposure. Continuous services such as OffSeq Threat Radar automate the monitoring and enrichment.