CVSS Score vs. CISA KEV: Why a 7.8 Can Be More Dangerous Than a 9.8

CVSS v3.1 scores a vulnerability across three metric groups: Base, Temporal, and Environmental.

The Base Score is what almost everyone uses. It considers attack vector (how the attacker reaches the vulnerability), attack complexity (what conditions must exist), privileges required, user interaction required, scope (whether the impact extends beyond the vulnerable component), and impact severity across confidentiality, integrity, and availability. Base scores range from 0.0 to 10.0.

Here is what CVSS does not measure: whether any attacker has actually used the vulnerability. CVSS is scored against a hypothetical ideal attacker with perfect conditions and no defensive controls. A vulnerability that requires no authentication, attacks a network-exposed service, and achieves full system compromise will score 9.8 regardless of whether it was exploited once or never.

The Temporal Score adjusts for exploit maturity and remediation availability, but this field is populated inconsistently across vulnerability databases. Most scanner outputs use Base Scores only.

The practical result is that CVSS scores compress a complex real-world risk picture into a number that ignores the most important variable: is anyone actually attacking this?

CISA's Known Exploited Vulnerabilities catalog is a curated list of vulnerabilities with confirmed evidence of active exploitation in the wild. CISA does not add CVEs because they are theoretically dangerous. They add CVEs because threat actors, nation-state groups, or ransomware operators are observed using them against real targets.

KEV entries include the CVE ID, the affected vendor and product, a short description, and a required action date for US federal civilian executive branch (FCEB) agencies. Entries are added based on threat intelligence from CISA analysts, FBI reporting, and partner agencies.

The catalog is not comprehensive. Not every exploited vulnerability reaches CISA's radar. But any CVE in the KEV catalog has been confirmed as a weapon in active use. That confirmation has a direct operational implication: if you are running the affected product, you are a potential target right now, not hypothetically.

See What BOD 22-01 Actually Requires for a full explanation of who the mandatory deadlines apply to and what private sector organizations should do with KEV data.

The divergence between CVSS scores and KEV urgency is not a corner case. It happens constantly across major product lines.

PAN-OS CVE-2026-0257 (CVSS 7.8): Authentication bypass in GlobalProtect via forged authentication override cookies. In the KEV catalog with a June 1, 2026 mandatory remediation deadline. Rapid7 confirmed active exploitation with internal network access achieved by attackers starting May 17. The CVSS 7.8 is "High," not "Critical," because the attack requires a local network position. It is actively being exploited by threat actors who have already obtained that position.

Microsoft Defender CVE-2026-41091 (CVSS 7.8): Privilege escalation to SYSTEM. In the KEV catalog. Actively used in post-exploitation chains after initial access. The CVSS score is identical to the PAN-OS example, but this one allows an attacker who already has user-level access to become SYSTEM on any unpatched endpoint.

Langflow CVE-2025-34291 (CVSS 9.4): Unauthenticated remote code execution. In the KEV catalog. Exploited by MuddyWater, an Iran-nexus APT. The CVSS 9.4 correctly reflects severity here, and it is also in KEV, making it a double-confirmed priority.

A hypothetical CVE-2026-99999 (CVSS 9.8): A critical buffer overflow in a third-party library, published to the NVD with no known exploit, no proof-of-concept code, and no threat actor attribution. Not in KEV. Your scanner flags this first. It should be last.

The pattern is consistent: KEV entry overrides CVSS rank for immediate urgency.

Neither signal alone is sufficient. The right approach layers them.

Step 1: Flag all KEV-listed CVEs in your vulnerability scanner. Most enterprise scanners (Tenable, Qualys, Rapid7) can filter by CISA KEV status. Enable this filter and treat any KEV match on an internet-exposed or business-critical asset as P1 regardless of CVSS score.

Step 2: Within KEV matches, use CVSS to rank impact severity. A KEV entry with CVSS 9.4 affecting an internet-accessible server ranks above a KEV entry with CVSS 6.5 affecting an internal workstation with no sensitive data. Both are urgent; CVSS helps prioritize within the urgent tier.

Step 3: Use CVSS alone for non-KEV vulnerabilities. For CVEs not in the KEV catalog, CVSS score combined with asset criticality and network exposure determines remediation scheduling. A CVSS 9.8 on an internet-facing production server with no KEV entry still gets patched quickly, just not ahead of active exploitation.

Step 4: Check KEV additions weekly. CISA adds new entries continuously. A vulnerability not in KEV on Monday may appear by Thursday. Automate KEV monitoring so your patch queue updates when CISA does. See How to Set Up CISA KEV Alerts Without a SIEM for a free implementation under 30 minutes.

This framework handles 95% of real-world patch prioritization decisions:

Tier 1 (Patch within 24-72 hours): KEV entry confirmed + asset is internet-exposed or business-critical. No CVSS threshold required. Examples: PAN-OS CVE-2026-0257, Langflow CVE-2025-34291 on any internet-reachable instance.

Tier 2 (Patch within 7 days): KEV entry confirmed on internal assets, OR CVSS 9.0+ on internet-exposed assets with no KEV entry but active proof-of-concept code published. The PoC moves a non-KEV vulnerability toward active exploitation risk.

Tier 3 (Patch within 30 days): CVSS 7.0-8.9 on internet-exposed assets with no KEV entry and no published exploit code. Standard patch cycle.

Tier 4 (Next maintenance window): CVSS under 7.0 with no KEV entry, affecting internal assets with limited exposure. Document and schedule.

Two questions determine placement: Is it in CISA KEV? Is it on an exposed or critical asset? Everything else is refinement.