CVE, CVSS and EPSS: naming and scoring vulnerabilities
In short: A CVE ID gives each public vulnerability a unique name. CVSS scores how severe it could be, EPSS estimates how likely it is to be exploited soon, and the CISA KEV catalogue lists flaws known to be exploited. Used together they help you decide what to fix first.
CVE: a common name
Common Vulnerabilities and Exposures (CVE) is a programme that gives each publicly disclosed vulnerability a unique identifier, such as CVE-2026-12345 (year, then a sequence number). The programme is overseen by MITRE with funding from the US government, and IDs are assigned by many CVE Numbering Authorities (CNAs), including major software vendors. A shared ID means a vendor advisory, a scanner finding and a news article can all be matched to the same flaw.
A CVE record describes the flaw and affected products. Extra analysis, such as scores and product lists, is added by databases like the US National Vulnerability Database (NVD) and by the CNA itself.
CVSS: how severe could it be?
The Common Vulnerability Scoring System (CVSS), maintained by FIRST, scores severity from 0.0 to 10.0. Version 4.0, published in 2023, has four metric groups:
- Base: properties of the flaw itself, such as attack vector (network, adjacent, local, physical), attack complexity, privileges required, user interaction, and the impact on confidentiality, integrity and availability.
- Threat: whether exploit code exists and is being used.
- Environmental: adjustments for your own environment, such as how important the affected system is.
- Supplemental: extra context that does not change the score, such as whether the attack can be automated.
Scores come with a vector string showing every metric. This example describes a network-reachable flaw needing no privileges or user action, with high impact:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NMany published scores are base-only. A base score measures potential severity, not the risk to you. Version 3.1 scores are still widely seen, so be ready to read both.
EPSS and KEV: is it being exploited?
Only a small share of published vulnerabilities are ever exploited in the wild. The Exploit Prediction Scoring System (EPSS), also from FIRST, uses data about real-world activity to estimate the probability that a CVE will be exploited in the next 30 days, giving a value from 0 to 1 and a percentile. It is updated daily.
The Known Exploited Vulnerabilities (KEV) catalogue, published by the US Cybersecurity and Infrastructure Security Agency (CISA), lists vulnerabilities with reliable evidence of active exploitation. US federal agencies must fix them by set due dates, and many organisations elsewhere treat KEV entries as top priority.
Putting the sources together
Each source answers a different question, so use them together rather than relying on one number.
| Source | Question it answers | Limitation |
|---|---|---|
| CVE | Which flaw is this? | No priority on its own |
| CVSS | How bad could it be? | Base score ignores exploitation and your context |
| EPSS | How likely is exploitation soon? | A probability, not a certainty; ignores your assets |
| KEV | Is it being exploited now? | Only covers confirmed cases |
Tip: a practical rule of thumb: anything on KEV and exposed to the internet goes to the top of the list, followed by high-EPSS, high-CVSS flaws on important systems. See prioritising vulnerabilities.
Practice
What does a CVSS base score tell you, and what does it not?
A CVE has a CVSS score of 9.8 but an EPSS probability of 0.002. Another has CVSS 7.5 and is listed in KEV. Which do you fix first, all else equal?
What is a CNA?
Key takeaways
- A CVE ID uniquely names a publicly known vulnerability.
- CVSS (now v4.0) scores potential severity from 0 to 10 using a vector string.
- EPSS estimates the probability of exploitation in the next 30 days.
- CISA KEV lists vulnerabilities known to be actively exploited.
- Combine all four with your own asset context to prioritise.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.