CVE Prioritization for MSPs: NVD vs CISA KEV vs EPSS

CVSS is a severity score. It estimates the worst-case impact and the exploitability characteristics of a vulnerability in isolation. It does not change based on whether anyone is actually exploiting the vulnerability, or whether exploitation is likely to happen.

Across many customers, a large share of published CVEs land in the high or critical band on CVSS. If "critical CVSS" is your trigger, every week produces more high-priority items than any team can action, and the genuinely urgent ones are buried among them. The fix is not to ignore CVSS. It is to add two questions CVSS does not answer: is this being exploited, and how likely is exploitation?

The National Vulnerability Database is the US government feed of CVE records, enriched with CVSS scores, affected-product data, and references. It answers, well: what is this vulnerability, which products and versions does it affect, and how severe is the worst case. It is the canonical source for matching a CVE against software you have detected on a customer asset.

What it does not answer is whether exploitation is happening or probable. An NVD record with a critical score may describe a vulnerability that no one has ever exploited and no one ever will. Treat NVD as your matching layer: it tells you a customer is potentially affected, not the order to fix things in.

The Known Exploited Vulnerabilities catalog, maintained by CISA, is a curated list of CVEs with confirmed, reliable evidence of active exploitation in the wild. It is deliberately small relative to the full CVE universe. Inclusion is a strong signal: attackers are using this now, and the catalog carries remediation guidance and, for US federal agencies, a due date.

What it answers is whether there is confirmed real-world exploitation. A KEV entry moves a CVE to the top of the queue almost regardless of its CVSS score, because the theoretical question is now settled. What it does not tell you is anything about the vulnerabilities that are not on it. Absence from KEV is not evidence of safety; it means exploitation has not been confirmed and catalogued, which is common for newer or less-scrutinised vulnerabilities.

The Exploit Prediction Scoring System, from FIRST, produces a probability that a given CVE will be exploited in the near term, based on observed exploitation data and vulnerability characteristics. It is refreshed daily, so a score can rise or fall as the picture changes.

What it answers is, for the large middle ground of CVEs that are not on KEV, which are most likely to become a problem. It turns "critical CVSS, no known exploitation" into a ranked list. What it does not offer is certainty. EPSS is a forecast: a low score is not a guarantee and a high score is not confirmation. Use it as a threshold and a sort key, and set the threshold to match your team's remediation capacity.

EPSS publishes two numbers per CVE and they are easy to confuse. The probability is a value between 0 and 1: the model's estimate that the CVE will be exploited in the wild in the next 30 days. The percentile is where that probability sits relative to every other scored CVE — a percentile of 0.9 means the CVE scores higher than 90 percent of all CVEs.

Use the probability when you are reasoning about a single CVE ("is a 4 percent chance worth an out-of-hours change?"). Use the percentile when you are setting a queue threshold, because the distribution of raw probabilities is heavily skewed and shifts over time — "everything above the 95th percentile" stays meaningful as scores move, where "everything above 0.05" does not. The common mistake is reading a 0.9 percentile as a 90 percent chance of exploitation; it is not.

"Confirmed exposure" depends on how reliably you have fingerprinted the customer's technology. A low-confidence match should not create a high-severity item on its own.

As a hypothetical, suppose a web-server version running on one customer site matches a CVE. NVD gives you the affected range and a high severity. The CVE is not on KEV, and EPSS puts near-term exploitation low. That combination says: real, worth patching in the next maintenance window, not worth an out-of-hours change. If the same CVE later appears on KEV, it jumps straight to the first tier. This example is illustrative and does not describe a specific CVE.

The output of triage should land in the same place as the rest of a customer's issues, ranked in the same severity language, so your team works one queue instead of a separate CVE spreadsheet.

SecurityScore.me correlates NVD, CISA KEV, and EPSS against technology detected on customer domains and websites and surfaces confirmed exposure as severity-ranked findings. See CVE alerts for MSPs for how that correlation runs, security findings for the shared queue those results land in, and alert management for routing the events that matter to the right people.