The Uncomfortable Truth About CVSS Scores
Roughly 26,000 CVEs were published in 2025. Your scanner probably flagged thousands of them in your environment. And if you sorted that list by CVSS score — which nearly every team does by default — you likely spent the first weeks of 2026 patching Critical-rated vulnerabilities that nobody in the wild was actually exploiting. Meanwhile, a CVSS 5.9 Medium sitting in your container base image got weaponized by a ransomware crew and nobody noticed until it was too late.
That is not a hypothetical. The FIRST Exploit Prediction Scoring System (EPSS) research consistently shows that fewer than 5% of published CVEs are ever exploited in the wild. CVSS tells you how bad a vulnerability could be. EPSS tells you how likely it will be exploited in the next 30 days. Those are radically different questions — and confusing them is costing organizations real money and real incidents.
This guide breaks down both scoring systems, how they complement each other, where each one fails, and how to combine them into a prioritization framework that actually reduces risk rather than just reducing a number on a dashboard.
What Is a CVSS Score, Really?
The Common Vulnerability Scoring System (CVSS) is maintained by FIRST (Forum of Incident Response and Security Teams) and is currently on version 4.0, released in late 2023. A CVSS score is a severity rating — it evaluates the intrinsic characteristics of a vulnerability: attack vector, attack complexity, privileges required, user interaction, and confidentiality, integrity, and availability impact. The Base Score runs from 0.0 to 10.0, with Critical sitting at 9.0 to 10.0.
CVSS v4.0 introduced supplemental metrics and improved granularity over v3.1, particularly around how it handles safety-critical systems and OT/ICS environments. But the fundamental design constraint has not changed: CVSS measures severity in isolation, without any reference to actual threat actor behavior, exploit availability, or deployment context. A CVSS 9.8 on a service that is not internet-exposed, runs behind three layers of controls, and has no known exploit code is not the same operational risk as a CVSS 6.5 on an authentication bypass with public proof-of-concept code that attackers are actively scanning for.
CVSS also carries Temporal and Environmental score modifiers, but in practice, fewer than 15% of organizations consistently apply them. Most teams are working off Base Scores alone — which is essentially triage by potential damage, not actual risk.
What Is EPSS? The Exploit Prediction Scoring System Explained
EPSS — the Exploit Prediction Scoring System — was developed by FIRST and is now on version 3, with ongoing research pushing toward version 4. Its core output is a probability score between 0.0 and 1.0 representing the likelihood that a given CVE will be exploited in the wild within the next 30 days. An EPSS score of 0.94 means the model estimates a 94% probability of exploitation activity in that window. An EPSS score of 0.0012 means 0.12% probability — essentially noise.
The model ingests a wide range of signals: exploit code availability including Exploit-DB, GitHub, Metasploit, and dark web sources, social media discussion volume, proof-of-concept publication timestamps, vendor advisories, CVSS characteristics, CVE age, and historical exploitation patterns across millions of data points. The model is retrained daily, which means scores can shift significantly when a new PoC drops or when a threat actor starts actively scanning for a particular vulnerability.
This is a fundamentally different approach from CVSS. EPSS is empirical and predictive. It asks: based on everything we know right now about exploit ecosystems, what is the probability this CVE gets used against someone today? That is operationally actionable in a way that a static severity rating simply is not.
EPSS lookup is publicly available at epss.cyentia.com, and major vulnerability management platforms have integrated it into their scoring pipelines. If you are running VM Scans through a modern platform, EPSS data should be enriching every CVE in your findings list.
EPSS vs CVSS: A Direct Comparison
The question is not which scoring system is better — it is understanding what each one is actually measuring and using both appropriately.
What CVSS Measures Well
CVSS is excellent at capturing the theoretical damage ceiling of a vulnerability. A CVSS 10.0 unauthenticated RCE over the network with full confidentiality, integrity, and availability impact is objectively more dangerous in an exploited state than a CVSS 3.1 local information disclosure. For compliance frameworks — NVD, PCI DSS, ISO 27001, SOC 2 — CVSS is the lingua franca. Auditors understand it, SLAs are built around it, and patch management policies almost universally reference it. That is not going away.
Where CVSS Falls Short
CVSS cannot tell you whether exploit code exists. It cannot tell you whether threat actors are actively scanning. It does not factor in whether you are actually running the affected component, whether it is exposed to the network, or whether a compensating control already mitigates the impact. A CVSS 9.8 against a library you do not ship is irrelevant. CVSS also does not age — a vulnerability from 2019 with no known exploitation history still shows its original severity score, giving no signal about whether it remains a live threat.
What EPSS Measures Well
EPSS is extraordinarily good at separating the signal from the noise in large CVE backlogs. Research from the FIRST EPSS team shows that by focusing remediation effort on the top 10% of CVEs by EPSS score, you can cover roughly 76% of all vulnerabilities that will actually be exploited — while only patching 10% of your total backlog. That is a massive efficiency gain for any security team operating under resource constraints.
Where EPSS Falls Short
EPSS is a population-level probability, not an individual risk assessment. It does not know your specific environment. A CVE with EPSS 0.9 against a service you have disabled is irrelevant to you, but EPSS has no way to know that. EPSS also lags slightly on zero-days and novel threats where exploitation patterns have not been observed yet. And for CVEs that are highly targeted but narrowly — nation-state attacks against specific sectors, for instance — the model may underestimate risk for high-value targets.
How to Use EPSS and CVSS Together: The Four-Quadrant Model
The right framework is not EPSS or CVSS. It is EPSS and CVSS, filtered through asset context. Map every CVE onto a two-axis grid: CVSS severity on the y-axis versus EPSS score on the x-axis. Four quadrants emerge naturally.
High CVSS plus High EPSS: These are your genuine emergencies. Patch within 24 to 72 hours, no exceptions. These vulnerabilities are both theoretically devastating and actively being exploited. Log4Shell in its early days lived here. So did ProxyLogon.
High CVSS plus Low EPSS: The danger zone for over-investment. These vulnerabilities look terrifying on paper but have not attracted attacker interest yet. They deserve a standard patching cadence of 14 to 30 days, not a 3am all-hands response. Most of your CVSS 9.x backlog probably lives here.
Low CVSS plus High EPSS: The sneaky category. These are moderate-severity vulnerabilities that threat actors are actively weaponizing, probably because they are easy to exploit at scale even if the theoretical impact per victim is limited. Credential stuffing vectors and authentication bypasses often land here. Do not let the CVSS score lull you into deprioritizing them.
Low CVSS plus Low EPSS: Background noise. Schedule these into your regular patch cycle. Do not burn emergency response capacity on them.
Adding Asset Context as the Third Dimension
Even the four-quadrant model is incomplete without asset context. Combine CVSS and EPSS with internet exposure, data sensitivity, compensating controls, and business criticality. A CVSS 7.5 with EPSS 0.85 on an internet-facing authentication service with no WAF should be treated as a Critical-1 incident. The same scores on an internal dev tool with no external exposure can go into the standard queue.
This is exactly the kind of context-aware prioritization that a mature Vulnerability Management program should be automating. If you are manually cross-referencing spreadsheets, you are already losing.
One underutilized pattern is combining EPSS with your Software Bill of Materials. If you are generating SBOMs from your build pipeline — which every serious DevSecOps program should be doing in 2026 — you can continuously monitor EPSS scores for every component in your dependency graph. When EPSS spikes on a library you are shipping, you know about it in hours, not weeks. Tools like Trivy and Grype support SBOM generation natively, and integrating their output with EPSS lookups is straightforward. Teams doing this alongside SAST analysis are catching exploitable vulnerabilities in code before they reach production.
EPSS in Practice: Real-World Integration Points
EPSS data is available via a public API maintained by FIRST. The endpoint is straightforward — query by CVE ID and get back the current probability score plus a percentile rank across all CVEs in the NVD. Most major platforms including Tenable, Qualys, and Rapid7 have integrated EPSS enrichment natively. If you are running infrastructure scanning through VM Scans or container-level analysis via Container Image Scanning, EPSS should be part of the enrichment layer.
For teams building custom pipelines, pulling EPSS data programmatically is low-friction. The FIRST API returns JSON with cve, epss, percentile, and date fields. Wire that into your SIEM or ticketing system and you have the foundation for automated severity escalation rules: if EPSS jumps above 0.5 on any CVE currently in your open findings, auto-escalate to P1 regardless of the CVSS base score.
The EPSS Percentile vs the Raw Score
One nuance that trips up teams new to EPSS: the raw probability score and the percentile are different signals. An EPSS score of 0.15 sounds low in absolute terms. But if that puts the CVE in the 95th percentile of all scored vulnerabilities, it means 95% of CVEs are less likely to be exploited. That is a high-priority finding. Always look at both the raw score and the percentile when making triage decisions.
FIRST publishes daily snapshots of EPSS scores for all CVEs with NVD entries. Historical score tracking is valuable — a CVE that sat at EPSS 0.01 for two years and suddenly jumped to 0.78 last week is telling you something important about current attacker interest. Build score delta monitoring into your vulnerability management workflow.
Building a Vulnerability SLA Framework Around CVSS and EPSS
Compliance frameworks and SLAs still largely run on CVSS. The pragmatic approach: define your SLAs using CVSS tiers as the baseline, then apply EPSS as an override mechanism.
Critical (CVSS 9.0 and above): Patch within 7 days. If EPSS is above 0.5, patch within 24 hours.
High (CVSS 7.0 to 8.9): Patch within 30 days. If EPSS is above 0.5, treat as Critical.
Medium (CVSS 4.0 to 6.9): Patch within 90 days. If EPSS is above 0.7, escalate to High.
Low (CVSS 0.1 to 3.9): Best effort. Monitor EPSS for spikes.
This structure gives you CVSS compliance on paper while actually optimizing remediation effort toward real-world risk. Document the EPSS override logic in your security policy so auditors understand why you are treating a CVSS 6.5 as a P1 when EPSS says it is being actively exploited. Most auditors in 2026 are familiar enough with EPSS to accept this rationale, particularly under frameworks like NIST CSF 2.0 and DORA which emphasize risk-based prioritization over checklist compliance.
Managing this at scale requires a platform that gives you real-time vulnerability context across your full attack surface. The Vulnerability Management solution at SECRAILS integrates CVSS and EPSS enrichment natively, so your teams are working from a risk-prioritized queue rather than a raw severity list. Combine that with Cloud Inventory for asset context and you have the foundation for genuinely risk-driven remediation.
The Limits of Any Scoring System
Be honest: CVSS and EPSS together still do not capture everything. Threat intelligence — specific threat actor TTPs mapped to your sector, active campaign IOCs, MITRE ATT&CK technique overlays — adds another dimension that neither model accounts for. A CVE with EPSS 0.03 that is being leveraged by a threat actor specifically targeting financial services firms is a major risk for a bank and irrelevant noise for a retail company. Context is everything.
The best vulnerability management programs in 2026 are combining CVSS severity, EPSS probability, asset criticality and exposure, and threat intelligence into a composite risk score that is unique to their environment. That is hard to build from scratch, which is why purpose-built platforms exist. Whether you are starting from a spreadsheet or migrating from a legacy scanner, the goal is the same: stop patching by severity theater and start patching by actual exploit probability. Your VM Scans results should already reflect this combined signal — if they do not, it is time to revisit your tooling.