Most organizations have more vulnerabilities to fix than time to fix them. Three public signals can help decide what comes first, but each answers a different question.
CVSS: how bad could it be?
The Common Vulnerability Scoring System, maintained by FIRST, describes the technical severity of a vulnerability on a scale from 0 to 10. The base score assumes the worst reasonable case and knows nothing about your network or whether anyone is attacking the flaw.
| Score | Severity |
|---|---|
| 0.0 | None |
| 0.1 to 3.9 | Low |
| 4.0 to 6.9 | Medium |
| 7.0 to 8.9 | High |
| 9.0 to 10.0 | Critical |
Different CVSS versions can give the same flaw different scores, so always note the version when you compare numbers.
EPSS: how likely is exploitation soon?
The Exploit Prediction Scoring System, also from FIRST, estimates the probability that a vulnerability will be exploited in the next 30 days. It changes as new evidence arrives. BDVDB shows the score with a plain label:
| EPSS score | Label on BDVDB |
|---|---|
| Below 1% | Very Low |
| 1% to below 10% | Low |
| 10% to below 50% | Moderate |
| 50% to below 90% | High |
| 90% and above | Very High |
These labels are BDVDB’s own convenience. They are not part of the EPSS standard.
KEV: is it already being exploited?
The Known Exploited Vulnerabilities catalog, published by CISA, lists vulnerabilities with reliable evidence of active exploitation. Being listed is a strong signal. Not being listed tells you very little, because the catalog is selective.
Using them together
A reasonable starting order is:
- Anything listed in KEV that you run, starting with systems exposed to the internet.
- Vulnerabilities with a high EPSS score and a High or Critical CVSS score.
- Remaining Critical and High vulnerabilities, based on how exposed the system is.
- Everything else, during normal maintenance.
Your own context always matters. A Medium issue on your public login page can matter more than a Critical issue on an isolated test machine.