CVSS vs EPSS: severity is not the same as risk

What CVSS measures

The Common Vulnerability Scoring System (CVSS) rates the intrinsic severity of a vulnerability on a 0–10 scale. The base score is built from technical characteristics: how the flaw is reached (attack vector), how hard it is to exploit (complexity), whether privileges or user interaction are needed, and the impact on confidentiality, integrity and availability.

CVSS is valuable for describing how bad a flaw would be if exploited. Its weakness for prioritisation is that it is static and context-free: it does not know whether an exploit exists, whether anyone is using it, or whether the affected system is even reachable in your environment.

What EPSS measures

The Exploit Prediction Scoring System (EPSS), maintained by FIRST, answers a different question: what is the probability that this vulnerability will be exploited in the wild in the next 30 days? It outputs a percentage from 0% to 100% and is recomputed daily from real exploitation data, threat intelligence and vulnerability characteristics.

Because EPSS is probabilistic and current, it is excellent at finding the small number of vulnerabilities that actually warrant urgent action – the needles in the CVSS haystack.

Why the two disagree

Severity and probability are independent. A vulnerability can be:

• High CVSS, low EPSS: severe in theory, but no practical exploitation expected – common for flaws needing rare local conditions.
• Lower CVSS, high EPSS: modest impact, but actively and easily exploited – often more urgent in practice.
• High CVSS and high EPSS: the genuine emergencies.
• Low on both: track and schedule normally.

How to use them together

1. Filter to what is exploited or likely: check the CISA KEV catalog and EPSS first.
2. Weight by exposure: is the affected asset internet-facing or attacker-reachable?
3. Use CVSS to break ties and describe impact, not as the primary sort key.
4. Re-run continuously – EPSS scores change as the threat landscape moves.

This is the core of modern, risk-based vulnerability management: severity × probability × exposure, not severity alone.