Which CVE to patch first: prioritize with EPSS, KEV and context

Any vulnerability scanner throws hundreds or thousands of CVEs at you. Patching them all "now" is impossible, and patching by CVSS order —what almost everyone does— is a poor use of time: you end up chasing a theoretical 9.8 that nobody exploits while a 7.5 that is being exploited in the wild stays open.

The right question isn't "which is more severe?" but "which am I most likely to get exploited on?". To answer it, you combine three signals.

1. CVSS: severity, not priority

CVSS measures the potential worst-case impact, and it is static: it doesn't change whether or not a working exploit exists. It's useful as one dimension, but ordering patching by CVSS alone treats a CVE with mass exploitation the same as one that has never been exploited. You need signals of real exploitability.

2. EPSS: probability it gets exploited

EPSS (Exploit Prediction Scoring System, by FIRST.org) gives, for each CVE, the probability it will be exploited in the next 30 days (0 to 1), based on real-world activity data. A CVE with CVSS 9.8 but EPSS 0.02 is far less urgent than one with CVSS 7.5 and EPSS 0.85.

• High EPSS (e.g. > 0.5) = being exploited or about to be → top of the queue.
• Low EPSS with high CVSS = watch it, but don't break operations over it tonight.

3. KEV: what is already being exploited

CISA's KEV (Known Exploited Vulnerabilities) catalog lists CVEs with confirmed real-world exploitation. Simple rule: if a CVE is in KEV, it goes first, almost regardless of its CVSS or EPSS. It's the strongest evidence the risk is current, not hypothetical.

4. Context: does it affect you?

The three signals above are global; the fourth is yours. A critical, actively-exploited CVE in software you don't run, or on an internal asset with no exposure, is not your emergency. Prioritize by:

• Do you use it? Cross the CVE against your real inventory (installed versions).
• Is it exposed? An Internet-facing service weighs far more than one reachable only from the internal network.
• Asset criticality: the public portal isn't the same as a lab machine.

The practical order

A sensible patching queue, most to least urgent:

1. In KEV and exposed → today. Confirmed exploitation + reachable.
2. High EPSS and exposed → this week. High chance of imminent exploitation.
3. KEV/high EPSS but internal → next window. Real risk, smaller reach.
4. High CVSS, low EPSS, not in KEV → planned. Severe in theory, no exploitation pressure.
5. The rest → normal maintenance.

The idea is simple: severity × probability × exposure, not severity alone.

Recap

• CVSS = how much damage it could do (static).
• EPSS = probability it gets exploited soon.
• KEV = already being exploited → top priority.
• Context = whether you run it and it's exposed.

Patching with these four signals, not just CVSS, is the difference between putting out the fires that matter and burning hours on the ones that don't.

Sergio Belmonte Morales
Cybersecurity Analyst · SOC · Sentinel/KQL specialist