CVE, CVSS, KEV and EPSS are often mentioned in the same breath, but each measures something different. Using them interchangeably leads to wrong prioritisation — exactly the problem this article aims to prevent.
CVE — which vulnerability is it?
A CVE (Common Vulnerabilities and Exposures) is a unique identification number for a specific, publicly
documented vulnerability, for example CVE-2026-40000. A CVE number says nothing on its own about the severity or
whether it is actually being exploited — it is purely an identifier, comparable to a case number.
CVSS — how technically severe is the vulnerability?
The Common Vulnerability Scoring System (CVSS) score (0–10) expresses the technical severity of a vulnerability, based on factors such as the attack vector, the privileges required, user interaction and the impact on confidentiality, integrity and availability. A high CVSS score (for example 9.8) means that exploitation is potentially very serious — not that exploitation is actually taking place.
KEV — is this actually being exploited?
CISA's Known Exploited Vulnerabilities (KEV) catalogue contains only vulnerabilities for which it has been established that they are actually being exploited in the wild. This is a fundamentally different signal from CVSS: a vulnerability with a moderate CVSS score but a KEV entry often deserves higher priority than a vulnerability with a high CVSS score without evidence of exploitation.
EPSS — how likely is exploitation soon?
The Exploit Prediction Scoring System (EPSS) predicts, based on a statistical model, how likely it is that a vulnerability will be exploited in the near future. Where KEV looks back ("has this already been exploited?"), EPSS looks ahead ("how likely is exploitation soon?"). EPSS scores are not a guarantee, but a probability estimate that can help with prioritisation when there is no KEV entry.
How these four complement each other
| Question | Source |
|---|---|
| Which vulnerability is this exactly? | CVE |
| How severe is exploitation technically? | CVSS |
| Has this already been demonstrably exploited? | KEV |
| How likely is exploitation soon? | EPSS |
A responsible prioritisation process combines these signals: start with KEV entries (proven exploitation), add a high CVSS score in combination with internet exposure, and use EPSS as an extra signal for vulnerabilities that are not yet in the KEV catalogue but do have an increased likelihood of exploitation.
Common mistake
Prioritising solely on CVSS score and ignoring KEV entries. A vulnerability with CVSS 7.5 that is already being actively exploited (KEV) generally deserves attention sooner than a vulnerability with CVSS 9.8 for which no exploitation is known.