How to prioritize patching with KEV, EPSS and CVSS
Reviewed November 11, 2026 · figures computed from 1,780 CISA-listed CVEs in the 0dayNews dataset at build time
Work confirmed exploitation first (CISA KEV), then likelihood of exploitation (EPSS), then severity (CVSS), and let exposure decide ties: an internet-facing system you run beats an internal one with a higher score.
Analysis: a workable order
This is our opinion, not a standard. Adjust it to your environment and your own risk process.
- 1. Is it on KEV, and do you run the product? Confirmed exploitation in the wild is the strongest signal available. Start with internet-facing and remote-access systems, edge devices, and anything that handles authentication.
- 2. Is the EPSS high? For CVEs not on KEV, a high EPSS suggests exploitation is likely soon. Re-check it when the CVE gets news coverage, because it moves.
- 3. What is the CVSS? Use severity to order the remainder, and read the metrics (network vs local, privileges needed, user interaction), not just the number.
- 4. What is the exposure? Reachability, asset value and compensating controls decide ties and sometimes override the order above.
Why not sort by CVSS alone
In our dataset 1,134 of 1,763 CISA-listed CVEs with a score (64%) rate below 9.0, and 220 (12%) rate below 7.0. A policy of "patch Critical first" would not reach those until much later, although attackers are already using them.
Old bugs stay on the list
Of 1,713 CISA-listed CVEs where we have both dates, 789 (46%) were added to KEV more than a year after NVD published them. See zero-day vs n-day. A newly listed entry deserves the same urgency as a fresh one if you have not patched it, however old the CVE is.
Other frameworks
CISA's SSVC (Stakeholder-Specific Vulnerability Categorization) is a decision-tree approach that combines exploitation status, impact and exposure into an action category such as Track, Attend or Act. It formalizes much of the order above.