- Product track
- Cyber Threat Intelligence
How does vulnerability prioritization work?
No team can patch everything at once, so each flaw gets scored on several signals.
- Severity: CVSS rates how serious a flaw is. FIRST publishes the standard, and version 4.0 is the latest.
- Likelihood: EPSS estimates the probability that a CVE will be exploited in the wild in the next 30 days, as a score from 0 to 1.
- Known exploitation: CISA's KEV catalog lists vulnerabilities that are already exploited in the wild, and CISA advises using it as an input to prioritization.
- Exposure: can attackers reach the system from the internet?
- Business value: what does the system do, and what breaks if it stops?
Some teams combine the signals in a decision tree. CISA's SSVC method gives four outcomes: Track, Track*, Attend and Act.
Why does vulnerability prioritization matter?
The Verizon 2025 Data Breach Investigations Report found that exploited vulnerabilities were the first step in 20% of breaches, up 34%. Only about 54% of edge device and VPN flaws were fully fixed, and the median time to fix them was 32 days. A recent case is a CVSS 9.8 file path flaw in Quest Foglight for Databases, where no login is needed and the vendor fix is a new release, so the work is mostly upgrading.
A CVE is the same in Paris, Tokyo and Chicago. What changes is your exposure, your assets and your deadlines. Good prioritization puts the few flaws that attackers use today at the top of a long list.
How do the common scores compare?
| Signal | What it tells you | Question it answers |
|---|---|---|
| CVSS | How severe the flaw could be. | Is this flaw serious? |
| EPSS | How likely exploitation is in 30 days. | Will attackers probably use it? |
| KEV catalog | That exploitation has been seen. | Are attackers using it now? |
| SSVC | A decision: Track, Attend or Act. | What should we do about it? |
For daily context on exploited flaws, see our vulnerability intelligence platform.
What does a worked example look like?
Take two flaws. Flaw A has a CVSS score of 9.8, but it sits on an internal test system, has no known exploitation and a low EPSS score. Flaw B scores 7.5, is on the KEV list and affects an internet-facing VPN gateway. Flaw B goes first, even though its score is lower.
What mistakes are common?
- Patching by CVSS score alone.
- Ignoring which systems are exposed to the internet.
- Treating the KEV list as complete.
- Setting no deadline for the top group.
Also Called
- vulnerability triage
- risk-based vulnerability management
Frequently Asked Questions
Why is CVSS not enough on its own?
CVSS rates severity. It does not say whether anyone is exploiting the flaw or whether the affected system is exposed.
What is the difference between CVSS and EPSS?
CVSS scores how bad a flaw could be. EPSS estimates how likely it is to be exploited in the next 30 days.
Does the KEV catalog cover every exploited flaw?
No. It lists vulnerabilities that CISA has confirmed as exploited and that meet its criteria, so other exploited flaws may be missing.
What should be fixed first?
Start with flaws on the KEV list or with a high EPSS score that sit on internet-facing systems, then work down by business value.
