Why CVSS Alone Is Not Enough to Prioritize Vulnerabilities

A typical mid-size Nessus scan flags hundreds of findings as CVSS Critical (9.0+). Teams can't patch all of them in a sprint. CVSS alone gives no way to pick the first ten — and that's before you consider two structural problems with CVSS as a prioritization signal.

CVSS scores severity if exploited — not whether anyone is

CVSS measures the technical severity of a vulnerability assuming exploitation occurs. It says nothing about whether anyone is actually exploiting it.

Consider this real scenario from 2024:

Both score Critical by CVSS. One is being actively weaponized in ransomware campaigns. The other has existed for three years with zero confirmed exploitation. Treating them identically — as CVSS demands — is operationally wrong.

CVSS scores don't move

A CVSS score is assigned at publication and rarely changes. The world does.

A vulnerability that was theoretical in January can become a weaponized exploit kit component in March. CVSS captures the severity of the bug at a point in time. It does not capture:

• Whether a public exploit exists
• Whether the exploit is being used in active campaigns
• Whether the target software is commonly deployed in environments like yours
• Whether it's already been incorporated into commodity attack tooling

These are the signals that actually determine how urgently you need to act.

What to use instead: CISA KEV + EPSS

Two public, free datasets close this gap significantly.

CISA KEV (Known Exploited Vulnerabilities)

The CISA KEV catalog tracks CVEs with confirmed active exploitation in the wild. It's maintained by the Cybersecurity and Infrastructure Security Agency and updated as exploitation is observed.

Key properties:

• Binary signal (either on the list or not)
• Updated as exploitation is confirmed — not lagging
• CISA requires US federal agencies to remediate KEV entries within defined deadlines
• As of 2025, contains over 1,200 entries

If a CVE is in KEV, it is being exploited right now. That is the strongest possible remediation signal.

FIRST EPSS (Exploit Prediction Scoring System)

EPSS is a daily-updated score from 0.0 to 1.0 representing the probability that a given CVE will be exploited in the next 30 days, based on real-world threat intelligence.

Key properties:

• Continuous signal (not binary like KEV)
• Updated daily using data from multiple threat intel sources
• High EPSS doesn't require confirmed exploitation — it predicts based on exploit availability, public disclosure, affected software popularity, and observed attack patterns
• Roughly 5% of published CVEs ever get exploited; EPSS helps you find them before they do

A CVE with EPSS 0.92 should be treated with significantly more urgency than one with EPSS 0.004, regardless of their CVSS scores.

A practical composite model

Using all three signals together produces a score that reflects actual remediation urgency:

Composite Score = (KEV match × 40) + (EPSS × 35) + (CVSS/10 × 15) + (severity × 10)

Rules:

• Any KEV entry: minimum score of 75, regardless of other factors
• CVSS contributes but doesn't dominate
• EPSS scales continuously — a 0.97 EPSS contributes 34 points, a 0.02 contributes 0.7

Real examples

Log4Shell (CVE-2021-44228)

• KEV: Yes → 40 + minimum floor 75
• EPSS: 0.975 → 34.1
• CVSS: 10.0 → 15
• Composite: 100 — top of every list

SSH Weak Cipher (typical finding)

• KEV: No → 0
• EPSS: 0.004 → 0.14
• CVSS: 4.3 → 6.45
• Severity: Low → 2.5
• Composite: 9.1 — low priority, fix in next quarter

Recent Apache RCE (CVSS 9.1, not yet KEV, EPSS 0.48)

• KEV: No → 0
• EPSS: 0.48 → 16.8
• CVSS: 9.1 → 13.65
• Severity: Critical → 10
• Composite: 40.4 — medium-high, fix within 2 weeks

This ordering reflects actual risk far better than sorting by CVSS.

Operationalizing it

The three-signal model is only useful if you can run it against your actual vulnerability data. VulnPilot implements this scoring model on top of Nessus CSV exports:

pip install vulnpilot
 
# Download CISA KEV and EPSS feeds (run once, then weekly)
vulnpilot update-feeds
 
# Score your Nessus export
vulnpilot analyze nessus_export.csv

Output:

SCORE  PLUGIN  CVE              EPSS   KEV  SEVERITY    FINDING
100.0  19506   CVE-2021-44228   0.975  ✓    CRITICAL    Apache Log4j RCE
 87.4  117886  CVE-2023-44487   0.821  ✓    HIGH        HTTP/2 Rapid Reset
 40.4  121412  CVE-2024-1234    0.480  ✗    CRITICAL    Apache RCE
 28.1  118291  CVE-2024-5678    0.312  ✗    HIGH        OpenSSL Memory Leak
 11.5  100442  CVE-2019-8765    0.006  ✗    MEDIUM      SSH Weak Cipher
  9.1  112847  (no CVE)         0.000  ✗    LOW         TLS 1.0 Supported

The 500-finding scan becomes a 10-finding sprint plan.

The bottom line

CVSS is severity context. It is not a prioritization ranking.

For prioritization, you need exploitation intelligence:

• CISA KEV — is this being actively exploited right now?
• EPSS — is this likely to be exploited in the next 30 days?

Both are free. Both are public. Both are updated continuously. If your vulnerability management process doesn't incorporate at least one of them, you are sorting your remediation queue by the wrong column.