Beyond CVSS: Why EPSS + KEV Change How You Prioritize CVEs

Your vulnerability scanner just produced a report with 847 findings. 23 are CRITICAL. Your team can realistically patch 5 packages this sprint. Which ones do you fix first?

If your answer is “the ones with CVSS 10.0”, you are probably fixing the wrong things.

The CVSS Prioritization Trap

CVSS (Common Vulnerability Scoring System) measures theoretical severity — how bad could it be if exploited, under the worst-case conditions. It does not measure:

• Whether a public exploit actually exists
• Whether the vulnerability is being actively exploited right now
• Whether your specific configuration is vulnerable
• Whether fixing it would actually reduce your risk

A CVSS 10.0 in a library that requires local authenticated access, running on a service exposed only to your internal network, with no public exploit after 3 years — is probably less urgent than a CVSS 7.2 with a weaponized exploit kit, actively targeted by ransomware groups, in your internet-facing API server.

EPSS: Exploit Probability at 30 Days

The EPSS (Exploit Prediction Scoring System), maintained by FIRST.org, uses machine learning trained on real-world exploit activity to produce a probability score between 0 and 1: the likelihood that a CVE will be exploited in the wild in the next 30 days.

The data is updated daily and is freely available. Key findings from the EPSS research:

• Only ~2-7% of published CVEs are ever exploited in the wild
• CVSS scores have no meaningful correlation with exploitation probability
• EPSS identifies the top-exploited CVEs with ~4x better precision than CVSS

In practice: a CVE with CVSS 9.8 and EPSS 0.003 (0.3% exploitation probability) is far less urgent than a CVE with CVSS 6.5 and EPSS 0.92 (92% exploitation probability).

CISA KEV: Ground Truth for Active Exploitation

The CISA Known Exploited Vulnerabilities (KEV) catalog is a curated list of CVEs that CISA has confirmed are actively exploited in the wild. It is updated multiple times per week and represents the highest-confidence signal available for prioritization.

CISA’s Binding Operational Directive 22-01 requires US federal agencies to remediate KEV entries within 2 weeks (critical) or 6 months (non-critical). Even if BOD 22-01 doesn’t apply to you, KEV is the best public source for “fix this now” decisions.

How RepoD Combines These Signals

When RepoD scans a package with Grype, it enriches each detected CVE with both EPSS and KEV data:

{
  "cve": "CVE-2024-6387",
  "severity": "CRITICAL",
  "cvss": 8.1,
  "epss": 0.9732,
  "epss_percentile": 99.8,
  "kev": true,
  "kev_date_added": "2024-07-01",
  "package": "openssh-server",
  "version": "9.3p1-1"
}

CVE-2024-6387 (regreSSHion) is a good example: CVSS 8.1 (high, not critical), but EPSS 0.97 (top 0.2% of all CVEs by exploitation probability) and KEV-flagged. A pure CVSS-based policy would have deprioritized it; enriched scoring puts it at the front of the queue.

A Practical Prioritization Matrix

Combining CVSS, EPSS, and KEV gives you a 3-axis risk signal. A simple policy that maps well to real-world risk:

Condition	Action	Rationale
KEV = true	Immediate, same sprint	Confirmed active exploitation
EPSS ≥ 0.70	High priority, this sprint	70%+ exploitation probability
CVSS ≥ 9.0 AND EPSS ≥ 0.30	High priority	High severity + meaningful probability
CVSS ≥ 7.0 AND EPSS ≥ 0.10	Normal priority, next sprint
CVSS < 7.0 AND EPSS < 0.05 AND KEV = false	Scheduled	Theoretical risk only

This matrix reduces a 847-finding report to roughly:

• 3 immediate (KEV + high EPSS)
• 12 high priority
• ~80 normal priority
• ~750 scheduled/informational

That’s a workload your team can actually execute.

Caching for Air-Gapped Environments

A common objection to EPSS and KEV enrichment is that they require outbound internet access. RepoD addresses this with a 24-hour disk cache:

• EPSS scores are fetched in bulk from first.org/epss (a single CSV download, not per-CVE queries)
• The KEV catalog is fetched from CISA’s JSON feed
• Both are cached to /repos/security/ on disk

After the initial fetch, RepoD works fully air-gapped for 24 hours. If the fetch fails, it continues using the cached data. For permanently air-gapped environments, you can pre-populate the cache files and disable the fetch with "sync": { "enabled": false } in settings.json.

Building a CVE SLA Policy

NIS2, ISO 27001:2022, and most cyber insurance policies now require documented CVE remediation SLAs. RepoD’s SLA checker (running daily at 08:00) alerts when CVEs in the "review" state exceed the configured deadline:

{
  "cve_policy": {
    "sla_days": {
      "critical": 3,
      "high": 14,
      "medium": 90
    }
  }
}

When a CVE decision is overdue, it appears in the dashboard Security section with a red badge and triggers an alert to the configured notification channel. The decision log — who approved or rejected each CVE, when, and why — is preserved in the immutable audit trail for regulatory evidence.

Takeaway

CVSS gives you a severity estimate. EPSS + KEV give you an exploitation probability. The combination tells you what to fix first in a way you can defend to your CISO, your auditor, and your board.

For packages flowing through your infrastructure, the right place to apply this analysis is before distribution — not after an incident.

---

Explore RepoD’s CVE enrichment in the Security page or request a demo.