If you've ever looked at a vulnerability scan report and seen a wall of "CVE-2024-xxxxx, CVSS 9.8 Critical" entries with no idea which one to fix first, this guide is for you. Each of these four systems answers a different question — and it's only when you combine them that you get a sane answer to "what do I patch today."
CVE — what's the vulnerability?
CVE (Common Vulnerabilities and Exposures) is simply a naming and cataloging system. Every publicly disclosed software vulnerability gets a unique ID in the format CVE-YYYY-NNNNN — the year it was assigned, and a sequence number. CVE itself carries no severity information; it's a shared identifier so that a vendor advisory, a scanner report, and a news article can all unambiguously refer to the exact same flaw.
Think of a CVE ID the way you'd think of a case number in a court filing: it tells you which case you're looking at, not how serious it is.
CVSS — how severe is it, in theory?
CVSS (Common Vulnerability Scoring System) assigns a 0.0–10.0 severity score based on the vulnerability's technical characteristics: how it's exploited (network vs. local access), how complex the attack is, what privileges are needed, and what impact a successful exploit has on confidentiality, integrity and availability.
| Score | Rating |
|---|---|
| 9.0 – 10.0 | Critical |
| 7.0 – 8.9 | High |
| 4.0 – 6.9 | Medium |
| 0.1 – 3.9 | Low |
CVSS is useful and widely adopted, but it has one crucial limitation that catches a lot of people out: it measures theoretical severity, not real-world likelihood. A CVSS 9.8 vulnerability in a piece of software almost nobody runs, with no public exploit code, is a very different practical risk from a CVSS 7.5 vulnerability that's being actively, automatically exploited across the internet right now. Relying on CVSS alone to prioritize a long patch list routinely leads teams to fix the "scariest-sounding" bug while an actively-exploited, lower-scored one sits untouched.
EPSS — how likely is it to be exploited?
EPSS (Exploit Prediction Scoring System), maintained by FIRST.org, takes a different approach entirely: it's a data-driven model that estimates the probability a vulnerability will be exploited in the wild in the next 30 days, expressed as a percentage (e.g. 2.3%, or 97.1%). It's built from real observed data — exploit code availability, scanning/attack activity, references in exploit databases, social media chatter, and more — and it's recalculated daily as new evidence comes in.
The practical value of EPSS is that it routinely disagrees with CVSS in informative ways. It's common to see a CVSS 9.8 vulnerability with an EPSS score under 1% (severe in theory, essentially ignored by attackers in practice) sitting next to a CVSS 7.1 vulnerability with an EPSS score above 90% (attackers are actively going after it right now). If you can only patch a handful of things this week, EPSS is often the better signal for which handful.
KEV — is it already being exploited?
KEV (Known Exploited Vulnerabilities) is a catalog maintained by CISA (the U.S. Cybersecurity and Infrastructure Security Agency) that lists vulnerabilities with confirmed evidence of active exploitation — not a prediction, but a documented fact. If a CVE is on the KEV list, real attackers have used it against real targets. U.S. federal agencies are actually required to patch KEV-listed vulnerabilities within a set deadline, which tells you how seriously the list is treated operationally.
A KEV listing should generally jump to the top of any patch queue, regardless of its CVSS score. "Currently being exploited" is about as concrete a risk signal as vulnerability data gets.
Using all four together to prioritize
Put side by side, the four systems answer different, complementary questions:
| System | Question it answers | Nature of the data |
|---|---|---|
| CVE | Which specific flaw is this? | Identifier / catalog |
| CVSS | How bad would it be if exploited? | Theoretical severity score |
| EPSS | How likely is exploitation in the next 30 days? | Predictive, data-driven probability |
| KEV | Is it being exploited right now? | Confirmed, observed fact |
A practical prioritization rule of thumb that combines all three risk signals:
- On the KEV list? Patch it now, regardless of anything else.
- High EPSS (roughly >10%)? Treat it as urgent — it's actively trending toward exploitation.
- High CVSS but low EPSS and not on KEV? Still worth fixing, but it can usually wait for your normal patch cycle rather than an emergency change.
- Everything else follows your regular patch cadence, roughly ordered by CVSS.
Putting this into practice
The hard part in practice isn't understanding these four systems — it's knowing which CVEs even apply to your network in the first place. That requires knowing exactly what software and versions are actually running on every device you own, which is precisely what a network scanner like LANsentry is built to surface: it identifies services and versions during a port scan, checks them against vulnerability data, and shows CVSS severity alongside each finding so you can see at a glance what needs attention first.
For the underlying question of what's even reachable on your network in the first place — which is what turns a "vulnerability that exists somewhere" into "a vulnerability that's actually your problem" — see our guide on finding and closing open ports.
Find out what's actually exploitable on your network
LANsentry scans every device, identifies running services and versions, and surfaces known vulnerabilities with severity ratings — so you know what to fix first.