The Dirty Secret About CVSS 9.8 Vulnerabilities
Here is a number worth sitting with: roughly 25,000 new CVEs were published in 2025, and the pace has not slowed in 2026. Of those, somewhere between 4,000 and 6,000 carry a CVSS score of 9.0 or higher. Your scanner surfaces all of them. Your team can realistically patch maybe a fraction of them this sprint. So which ones actually get exploited in the wild?
That is the question CVSS was never designed to answer. The Common Vulnerability Scoring System gives you a severity measurement — it tells you how bad things could get if exploitation happens. The Exploit Prediction Scoring System (EPSS) flips the frame entirely and asks: how likely is this to be exploited in the next 30 days? If you are still triaging purely on CVSS scores, you are making prioritization decisions with half the picture.
This post breaks down how both systems work, where each one falls short, and how combining CVSS and EPSS scoring is becoming the standard for teams that actually want to reduce risk rather than just generate longer patch lists.
What Is a CVSS Score, Really?
CVSS v3.1 and the increasingly adopted v4.0 score vulnerabilities across a set of base metrics: attack vector, attack complexity, privileges required, user interaction, scope, and the classic CIA triad impact. The result is a number from 0.0 to 10.0, bucketed into None, Low, Medium, High, and Critical.
CVSS v4.0, released by FIRST in late 2023 and now widely integrated in scanner tooling through 2026, introduced supplemental metric groups including Safety and Automatable, which makes it more expressive. But the fundamental architecture has not changed: CVSS is a static severity rating based on the intrinsic characteristics of a vulnerability. It deliberately excludes threat intelligence and real-world exploitation data from the base score.
That is not a flaw — it is a design choice. CVSS base scores are reproducible and environment-agnostic. A CVE gets the same base score whether it lives in a Fortune 500 production environment or a home lab. That consistency is valuable. The problem starts when organizations use the base score as their sole prioritization signal.
The CVSS Prioritization Trap
If your vulnerability management workflow is patch everything Critical first, then High, then Medium, you are in the majority — and you are probably patching a lot of things that never get exploited while missing some Medium-scored CVEs that threat actors are actively weaponizing right now.
FIRST's own research has shown that fewer than 5% of published CVEs are ever exploited in the wild. A pure CVSS-based queue means your engineers are spending significant cycles on the 95% that attackers largely ignore. That is a resource allocation problem, and in cloud-native environments where vulnerability management needs to span containers, VMs, and application code simultaneously, the cost compounds fast.
The Exploit Prediction Scoring System (EPSS) Explained
EPSS was developed by FIRST's Special Interest Group on Exploit Prediction and is now on its third model iteration, EPSS v3, which uses a gradient-boosted machine learning model trained on a massive corpus of threat intelligence data. The output is a probability score between 0.0 and 1.0 representing the likelihood that a given CVE will be exploited in the wild within the next 30 days.
The model ingests signals from sources including proof-of-concept exploit availability, exploit-db entries, underground forum chatter, vendor advisories, MITRE ATT&CK technique mappings, social media references, and observed exploitation telemetry. An EPSS score of 0.85, for instance, means the model estimates an 85% probability of exploitation activity against that CVE within a month. An EPSS score of 0.003 — which describes the vast majority of CVEs — means exploitation is extremely unlikely in the near term.
EPSS Lookup: Where to Get the Data
The canonical source for EPSS lookup is the FIRST EPSS API at https://api.first.org/data/1.0/epss. You can query by CVE ID and get back the current EPSS score and percentile. The percentile is arguably more useful than the raw score for day-to-day prioritization: a CVE at the 95th percentile is more likely to be exploited than 95% of all scored vulnerabilities.
Most major scanner platforms — Tenable, Qualys, Rapid7, and open-source tools like Trivy — now pull EPSS data and surface it alongside CVSS scores in their dashboards. If your current tooling does not expose EPSS data natively, that is worth flagging as a gap. The VM Scans capability in the SECRAILS platform integrates EPSS scoring directly into its risk-prioritized vulnerability queue so teams are not manually cross-referencing two separate data sources.
EPSS vs CVSS: What Each One Actually Measures
The distinction matters more than most teams realize. CVSS measures severity — the potential impact if a vulnerability is exploited. EPSS measures threat likelihood — the probability that exploitation will actually occur. They are orthogonal dimensions of risk. You need both to make a defensible prioritization decision.
Think of it this way: a CVE with CVSS 9.8 and EPSS 0.002 is theoretically devastating but practically quiet. No known exploit code, no observed threat actor activity, no weaponization in the wild. A CVE with CVSS 6.5 and EPSS 0.94 is medium severity on paper but is being actively exploited right now. Which one should your team patch first this week? The answer depends on your environment and blast radius, but ignoring EPSS in that decision is objectively wrong.
The Four Quadrants of Risk
Security teams that have adopted a combined CVSS and EPSS framework typically work with four priority buckets:
- High CVSS + High EPSS: Patch immediately. No debate. These are CVEs where both the potential damage is severe and exploitation is actively occurring. Log4Shell in its first weeks was a canonical example.
- High CVSS + Low EPSS: Important but not urgent. Schedule remediation, apply compensating controls, and monitor EPSS score trajectory. Many theoretical remote code execution vulnerabilities live here.
- Low CVSS + High EPSS: Deceptive. Do not let the low severity score fool you. If threat actors are actively exploiting this CVE, it needs attention regardless of its CVSS bucket. Information disclosure vulnerabilities that enable lateral movement often fall here.
- Low CVSS + Low EPSS: Deprioritize. Accept risk, document it, and revisit on a scheduled cadence. Most CVEs in your scanner output live here.
This quadrant model is essentially what CISA's Known Exploited Vulnerabilities catalog operationalizes, though KEV uses confirmed exploitation evidence rather than probability estimates. Smart teams use all three signals: CVSS, EPSS, and KEV status.
What Is EPSS in ECHO and Other Platform Contexts?
If you have encountered the phrase EPSS in ECHO, it typically refers to EPSS scoring integrated into specific vendor platforms or ecosystems. ECHO is a shorthand some vendors use for their exposure management or continuous controls monitoring products. The underlying EPSS data is the same FIRST-maintained dataset; the difference is in how the platform surfaces and contextualizes it relative to your specific asset inventory.
The broader pattern here — integrating EPSS into platform-native workflows — is where the industry is moving. Standalone CVSS lookups on the NVD are giving way to context-aware risk scoring that factors in EPSS probability, asset criticality, network exposure, and compensating controls simultaneously. This is the model that mature cloud security platforms are building toward in 2026.
EPSS Score Trajectories: Why You Should Watch, Not Just Check
One underappreciated aspect of EPSS is that scores change over time. A CVE published today with EPSS 0.01 can jump to 0.90 within weeks if a reliable proof-of-concept drops on GitHub or a threat group starts weaponizing it. Static point-in-time lookups miss this dynamic entirely. You need continuous monitoring of EPSS score trajectories for your unpatched CVE inventory, especially for any CVEs sitting in the High CVSS and Low EPSS quadrant.
Some teams set EPSS threshold alerts: if any tracked CVE crosses 0.50 or hits the 90th percentile, it automatically escalates to the immediate patch queue regardless of where it sat in the previous cycle. This is a sensible operational pattern worth configuring in your vulnerability management tooling. SECRAILS' Container Image Scanning and VM scanning capabilities support continuous re-evaluation of vulnerability risk as EPSS data updates, rather than relying on weekly scan snapshots.
EPSS Limitations You Should Know
EPSS is not a silver bullet. A few limitations are worth keeping in mind before building your entire prioritization strategy around it.
Coverage lag on novel CVEs. A freshly published CVE has almost no data signals for the model to work with, so EPSS scores for very new vulnerabilities are often low by default. That is not a reliable indicator of safety — it is a data sparsity problem. Cross-reference with vendor advisories and NVD notes for new CVEs before trusting a low EPSS score.
Environment blindness. Like CVSS, EPSS does not know anything about your specific environment. A CVE with high EPSS might be completely irrelevant if the affected component is not present in your stack, or if network segmentation means the attack surface does not exist. Effective vulnerability management always layers environmental context on top of any scoring system.
Adversarial targeting is not uniform. EPSS models general exploitation probability across the internet. If you are a high-value target in financial services or critical infrastructure, the relevant threat actors may be pursuing CVEs that general-purpose EPSS underweights. Sector-specific threat intelligence should supplement EPSS data in those environments.
Implementing CVSS and EPSS Together in Practice
Here is what a pragmatic implementation looks like for a mid-size engineering organization running a modern security program.
First, instrument your scanner to export both CVSS base scores and EPSS scores with percentile for every CVE in your inventory. Most modern platforms expose this via API. Second, define your triage thresholds: CVSS at or above 9.0 and EPSS at or above 0.50 triggers P1, meaning patch within 48 hours. CVSS at or above 7.0 and EPSS at or above 0.30 triggers P2, meaning patch within 7 days. Adjust thresholds based on your risk appetite and team capacity.
Third, integrate KEV status as a hard override. Any CVE in CISA's KEV catalog that affects your environment is P1 regardless of EPSS score. Fourth, build EPSS trajectory monitoring so score changes trigger automatic re-triage. Fifth, apply environmental weighting: a CVE affecting an internet-facing service gets a higher priority multiplier than the same CVE on an air-gapped system.
Teams running SAST alongside VM scanning can close the loop further — correlating CVEs in third-party dependencies with actual code reachability analysis, so you are not patching libraries whose vulnerable code paths are never called in your application. That reachability context, combined with EPSS probability, gets you closer to true risk than any single-dimension scoring system.
For organizations operating at scale across cloud infrastructure, the CSPM layer adds another dimension: whether a vulnerable asset is publicly exposed, whether it carries overprivileged IAM roles, and whether it sits on a network path that could enable blast radius expansion after initial exploitation.
The 2026 Baseline: What Good Looks Like
By mid-2026, the baseline expectation from mature security organizations has shifted noticeably. Using CVSS alone for vulnerability prioritization is increasingly being called out in security audits as an inadequate methodology, similar to how relying solely on perimeter firewalls for network security looks dated today. The NIST CSF 2.0 Govern function explicitly calls for risk-informed prioritization, which in practice means incorporating exploitation likelihood data like EPSS alongside severity scores.
Regulatory frameworks are catching up too. Organizations operating under NIS2 or DORA in Europe are expected to demonstrate that their vulnerability management processes are risk-based and evidence-driven. Saying we patched the highest CVSS scores first is a thinner justification every audit cycle. EPSS provides documented, model-driven evidence for your prioritization decisions that stands up to scrutiny.
The teams doing this well are not necessarily the ones with the biggest budgets. They are the ones who have connected their scanning output to a coherent risk model, automated the scoring logic, and freed their engineers to focus on the vulnerabilities that actually threaten them rather than working through an undifferentiated queue of thousands of CVEs. SECRAILS is built around exactly that principle: making risk-based prioritization operationally tractable, not just theoretically correct.