CVE, CVSS, EPSS, KEV — the vulnerability alphabet, finally explained

If you are new to security, the vulnerability world looks like alphabet soup. Here is the whole thing in plain English, with the honest version of what each acronym is actually good for.

CVE — the name tag

A CVE (Common Vulnerabilities and Exposures) is just an identifier: CVE-2026-12345. It says this specific bug in this specific product exists and has a number. That’s all. A CVE is not a severity, not a risk score, not a reason to panic. It’s a filing label, so that when your scanner, your vendor and a government advisory all talk about the same hole, they use the same name.

There are over a quarter of a million CVEs. The overwhelming majority will never be exploited by anyone, ever. Which brings us to the problem the next three acronyms try to solve: which ones matter?

CVSS — how bad it could be

CVSS (Common Vulnerability Scoring System) scores a bug from 0 to 10 based on its technical characteristics: can it be reached over the network, does it need credentials, what does an attacker get. A 9.8 means “remotely exploitable, no login needed, full compromise.”

Here’s what trips everyone up: CVSS measures theoretical severity, not real-world likelihood. Thousands of 9.8s have never been exploited in the wild, while attackers happily chain together 6.5s that happen to sit on the right systems. If your patching policy is “fix everything above 7,” you are patching by alphabet, not by risk — and burning your team on bugs nobody is using.

EPSS — how likely it is to be exploited

EPSS (Exploit Prediction Scoring System) is a model that estimates the probability a CVE will be exploited in the next 30 days, based on signals like exploit code availability and chatter. It’s a probability, not a guarantee — but it’s the first score in this list that even tries to answer the question defenders actually have.

A useful habit: a CVE with CVSS 9.8 but EPSS of 0.04% is usually less urgent than a CVSS 7.2 with EPSS of 60%. The second one is being used. The first one is a theory.

KEV — it is being exploited, right now

The CISA KEV catalog (Known Exploited Vulnerabilities) is the short list that matters most: vulnerabilities with confirmed exploitation in the wild, maintained by the US cybersecurity agency. Not “could be exploited” — is being exploited, observed, confirmed.

KEV is small by design — around 1,500 entries against 250,000+ CVEs — and a meaningful slice of it is flagged as used in ransomware operations (362 entries carry CISA’s ransomware flag as of 9 November 2026, by our count of the public catalog). If a KEV entry matches something in your estate, that is a this-week problem, often a today problem. US federal agencies are legally required to fix KEV entries by a deadline; everyone else should steal that discipline for free.

The sane priority order

1. On the KEV list and in your estate → fix now. No meeting required.
2. High EPSS and reachable from the internet → fix this sprint.
3. High CVSS, low EPSS, internal only → schedule it, don’t panic.
4. Everything else → that’s what patch cycles are for.

The dirty secret of vulnerability management is that most of the industry still runs on step 3’s logic for everything. The teams that reorder around exploitation evidence — KEV first, EPSS second, CVSS last — do less work and stop more breaches.

Go deeper

We track exploited vulnerabilities against live ransomware activity in the Ninja Signal graph — see which crews are actually using which CVEs in the ransomware tracker, and get the morning view in Probably Fine Daily. Related reading: how ransomware gangs pick victims and what MITRE ATT&CK is actually for.