How to read a CVSS score (and EPSS) without panicking

A scanner drops a “10.0 Critical” on your desk and the Slack thread ignites. Ten minutes later someone pastes an EPSS of 0.01 and argues it can wait until next quarter. Both numbers are useful. Neither is a plan. This is how to read CVSS and EPSS so they drive triage instead of theatre.

What CVSS actually measures

CVSS (opens in a new tab), maintained by FIRST, scores the severity of a vulnerability on a 0.0–10.0 scale. CVSS v4.0 defines four metric groups: Base (intrinsic qualities), Threat (exploit maturity and related factors), Environmental (your deployment), and Supplemental (extra context that does not change the numeric score). Label published scores with the nomenclature FIRST expects — CVSS-B for Base only, CVSS-BT for Base+Threat, CVSS-BE / CVSS-BTE when Environmental is included — so nobody confuses a vendor Base with a fully enriched number. Most scanners still paste a Base (often still calculated as CVSS 3.1); read the vector string either way. For a hands-on look at how those Base numbers show up in practice, see our comparison of free vulnerability scanners (OpenVAS, Nuclei and Trivy).

CVSS 3.1 is still what most inventories display, including the familiar Scope metric. CVSS 4.0 drops Scope and instead separates impact to the vulnerable system from impact to subsequent systems, and it replaces the old Temporal group with Threat. The habit to break is the same under either version: a high Base score means “this flaw is nasty if an attacker can reach the conditions”, not “drop everything regardless of exposure”.

What the labels hide

Network vs adjacent vs local vs physical. A 9.8 that needs local access is a different problem from a 9.8 on an unauthenticated HTTP listener.
Privileges Required and User Interaction. “None / None” is the combination ransomware crews love. “High / Required” often waits behind phishing controls.
Scope (CVSS 3.1) / subsequent system impact (CVSS 4.0). When a flaw in one component lets the attacker affect another, severity jumps. Read the vector string, not only the colour badge.
Vendor vs NVD disagreement. It happens. Prefer the vendor advisory for affected versions, and use NVD as a cross-check, not as scripture.

For a worked example of a true 9.8 with unauthenticated reachability, see our Alert on Oracle EBS CVE-2026-101767. The score matched the story: probes hit a path that needed no login. Contrast that with flaws that score Critical only because a logged-in admin can be tricked — still serious, different queue.

What EPSS adds

EPSS (opens in a new tab) (Exploit Prediction Scoring System), also from FIRST, estimates the probability that a CVE will be exploited in the wild in the next 30 days. It is a probability between 0 and 1, refreshed daily from observations such as published exploits, scanning activity and prior exploitation patterns. A score of 0.80 means the model thinks there is an 80% chance of exploitation activity in the next month, not that 80% of your hosts will be hit.

EPSS also publishes a percentile: where that probability sits among all scored CVEs. Use the probability for absolute likelihood and the percentile for “how hot is this relative to the backlog?”. Scores currently come from EPSS v5 (model v2026.06.15, live since 15 June 2026); the model is refreshed when performance drifts, and every CVE is rescored daily.

EPSS is not a severity score. A low-impact bug can have a high EPSS because it is easy to spray. A devastating bug can have a low EPSS because nobody is weaponising it yet. That is why EPSS and CVSS answer different questions, and why CISA’s KEV catalogue answers a third: exploitation already confirmed. We keep KEV and EPSS on the Alert Tracker for that reason.

A triage order that calms the room

1. Are we running it, and can the attacker reach it? No asset, no ticket. Internet-facing or identity-provider-adjacent jumps the line.
2. Is it on the KEV? Confirmed exploitation beats a pretty CVSS badge. See What a CISA KEV listing means and how to use it and the BOD 26-04 triage notes in BOD 26-04 and the KEV.
3. What does EPSS say about the next 30 days? High EPSS without a KEV entry is a “patch this sprint” signal, especially on exposed services.
4. What does CVSS say about blast radius? Use the vector string to judge ransomware potential, data loss and whether a single click becomes domain admin.
5. Can we patch, or must we fence? If there is no fix, do not stare at the score — follow find-and-fence.

Reading a vector string in thirty seconds

Take CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Attack Vector Network, low complexity, no privileges, no user click, unchanged scope, high impact on confidentiality, integrity and availability. That is the classic remote, unauthenticated, full-impact pattern — queue it with internet exposure and KEV/EPSS. Change UI:N to UI:R and you suddenly depend on phishing or a malicious document; change AV:N to AV:L and you need an existing foothold. Teach on-call staff to parse those four letters before they escalate a colour.

Common panics to retire

“Everything Critical ships today.” That starves the work that actually reduces risk. Cap emergency change capacity and spend it on reachable, exploited, high-impact items.
“Low EPSS means ignore.” EPSS moves. Yesterday’s 0.02 is tomorrow’s KEV. Re-score weekly for your exposed estate.
“The scanner severity is the business severity.” Map to the service owner’s impact: patient care, payments, safety systems. A medium on the backup controller can outrank a critical on a lab laptop.
“CVSS 10.0 means wormable ransomware tomorrow.” Only if Attack Vector is Network, Privileges Required is None, and User Interaction is None — and even then you still need a reachable service.

Write the decision, not the drama: exposed / not exposed, KEV / not KEV, EPSS band, patch or fence, owner, due date. Scores are inputs. Judgement is the job.

Sources

Follow Cyber-Threat.net RSS Feedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)