CVSS Score vs. Real-World Exploitability: Why a 9.8 Is Not Always Your Biggest Risk

CVSS (Common Vulnerability Scoring System) rates the intrinsic severity of a vulnerability based on its technical characteristics. The base score evaluates six factors: attack vector (how the vulnerability is reached), attack complexity (difficulty of exploitation), privileges required, user interaction required, scope (whether the exploit crosses system boundaries), and the impact on confidentiality, integrity, and availability.

CVSS deliberately ignores three things that matter enormously for practical risk:

Threat context. CVSS base scores do not account for whether a vulnerability is actively being exploited, whether exploit code exists, or whether it has been incorporated into commodity attack tooling like Metasploit. A zero-day under active mass exploitation and a theoretical vulnerability with no known exploitation receive identical base scores if their technical characteristics match.

Environmental context. CVSS base scores do not know whether the vulnerable component is internet-facing or air-gapped, whether you run the vulnerable version, or whether compensating controls are in place. Environmental Score modifiers exist in the framework but are rarely calculated because they require per-asset assessment that most organizations cannot perform at scale.

Exploit availability. A CVSS 9.8 vulnerability may require a highly specific exploit chain that no public tooling implements. Another at CVSS 6.5 may be trivially exploitable with a one-line command any attacker can run. CVSS base scores treat both identically.

This is not a flaw in CVSS, it is an intentional design constraint. CVSS is designed to be a reproducible, vendor-neutral severity score that changes only when the vulnerability's technical properties change. Use the CVSS v4.0 Calculator to understand score composition, then add EPSS and KEV to translate severity into exploitation risk.

EPSS (Exploit Prediction Scoring System) is a machine learning model from FIRST.org that predicts the probability a CVE will be exploited in the next 30 days. It is expressed as a score from 0 to 1: a score of 0.9 means a 90% probability of exploitation attempts in the next 30 days based on current threat data.

EPSS is trained on exploitation telemetry from threat intelligence feeds, honeypot data, and observed exploitation events. It updates daily. A CVE scored low-probability six months ago can jump overnight if exploit code is published or a threat actor begins actively using it in campaigns.

EPSS and CVSS answer different questions. CVSS answers: how severe is this vulnerability if exploited? EPSS answers: how likely is this vulnerability to be exploited in the next 30 days? Both signals are required for a complete prioritization picture.

EPSS data is free via API at api.first.org/data/v1/epss?cve=CVE-YYYY-XXXXX. You can also look up individual scores at first.org/epss. Practical thresholds: scores above 0.1 (10%) warrant attention, above 0.5 indicate active exploitation tooling or ongoing campaigns, above 0.7 indicate mass exploitation in progress.

CISA KEV is not a probability, it is a confirmed fact. A CVE in the KEV catalog has been verified as actively exploited in real attacks. It is the highest-confidence exploitation signal available for free.

KEV entries are 3.9 times more likely to be exploited against a given organization than CVSS-equivalent CVEs not in KEV. If a CVE is in KEV and affects software you run, it belongs at the top of your patch queue regardless of CVSS score.

The combination of EPSS and KEV catches two different exploitation scenarios. KEV catches confirmed exploitation that CISA has verified. EPSS catches rising exploitation probability for CVEs not yet in KEV, particularly useful in the 15-day median window between CVE publication and first active exploitation for vulnerabilities that eventually make it into KEV. An EPSS spike on a recently disclosed CVE is often the earliest signal that KEV addition is imminent.

For a complete KEV-based triage framework including the four-tier priority queue and sprint capacity overflow protocols, see the CISA KEV Triage Guide.

Combine three signals to produce a patch priority tier for each CVE in your scan results:

Signal 1: CISA KEV status. Is this CVE in CISA KEV? If yes and the affected asset exists in your environment, it is automatically Tier 1, patch within 14 days.

Signal 2: EPSS score. If not in KEV, check EPSS. Score above 0.5: Tier 1. Score between 0.1 and 0.5: Tier 2 (patch within 30 days). Score below 0.1: proceed to CVSS evaluation.

Signal 3: CVSS with environmental context. For CVEs with low EPSS and no KEV membership, CVSS becomes relevant as a severity filter. Apply CVSS only after confirming the CVE affects software you actually run. A CVSS 9.8 affecting software not in your environment requires zero action.

Output tiers:

• Tier 1 (14 days): In KEV, or EPSS above 0.5, and asset is in environment
• Tier 2 (30 days): EPSS 0.1 to 0.5, or CVSS 9.0+ on internet-facing assets
• Tier 3 (90 days): EPSS below 0.1, CVSS 7.0 to 8.9, not internet-facing
• Defer: CVE does not affect software in your environment, or CVSS below 7.0 with no exploitation evidence

Example A: CVSS 9.8 with no exploitation vs. CVSS 6.5 in active KEV campaign

A newly disclosed authentication bypass in a web framework scores CVSS 9.8. It was disclosed 3 days ago. EPSS score: 0.04 (4% exploitation probability in 30 days). Not in CISA KEV.

A command injection vulnerability in a widely deployed VPN product scores CVSS 6.5. It was added to CISA KEV last week. EPSS score: 0.71 (71% exploitation probability in 30 days). It is being cited in active ransomware campaign advisories targeting your sector this month.

Sorted by CVSS: the 9.8 patches first. Using the three-signal formula: the 6.5 in KEV with EPSS 0.71 patches first. An attacker is actively exploiting the second vulnerability in real infrastructure right now. The first carries a 4% probability of being weaponized in the next 30 days.

Example B: Log4Shell vs. Zerologon in December 2021

Log4Shell (CVE-2021-44228) disclosed in December 2021: CVSS 10.0, explosive coverage, zero days of active exploitation at initial disclosure.

Zerologon (CVE-2020-1472) in December 2021: CVSS 10.0, already in CISA KEV since September 2020, 15 months of confirmed active exploitation by that point, used by multiple nation-state and ransomware actors.

Both needed immediate attention. But any team that had not patched Zerologon by December 2021 had a 15-month-confirmed actively exploited domain controller vulnerability that KEV membership signaled since day one. Log4Shell was equally severe but emerging. Zerologon was severe and proven.

Use the Patch Priority Tool to score CVEs against all three signals without manual lookup for each entry.