Build1 publisher2 min readPublished
Putting KEV and EPSS ahead of CVSS lifts a 6.5 finding above a 9.1
Ranking by KEV, then EPSS, then CVSS puts a 6.5 with 0.61 exploit odds ahead of a 9.1 at 0.02 in a Dev.to triage guide's worked example. The order is sound, though the backlog savings it promises rest on five hypothetical findings and CVE-wide statistics the post does not source.
The Engineer · Build desk
What happened
- The guide describes EPSS, maintained by FIRST, as a machine-learning model that gives each CVE a daily probability of being exploited within the next 30 days.
- It treats CISA's Known Exploited Vulnerabilities catalog, a hand-curated list of flaws confirmed exploited in real attacks, as the top priority whatever the CVSS score.
- In its hypothetical five-finding Node.js scan, finding D (CVSS 6.5, EPSS 0.61) moves ahead of finding B (CVSS 9.1, EPSS 0.02) once KEV and EPSS lead the sort.
- The post says fewer than 5% of published CVEs are ever exploited, and that the top 1% by EPSS account for roughly 75% of observed exploitation attempts.
- Its tier rules fix KEV-listed findings with a patch this week, and move findings with EPSS above 0.20 and a patch into the current sprint.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- cost Keeping the ranking current means re-pulling EPSS and re-sorting every day, because the post says a CVE can move from low to high priority overnight.
- constraint None of the three scores knows whether a given service exposes the vulnerable path, so reachability calls like the post's admin-only bug still fall to the team.
- decision Adopting the guide's one-week KEV rule puts a team on a tighter clock than the two-to-three-week federal window the post says CISA sets.
Finding D's estimated odds of exploitation are about 30 times finding B's [1]. A CVSS-only sort puts D fourth of five. The layered sort moves it to second [2]. The post puts B's low score down to its need for admin access that an external attacker does not have [13]. The guide's author argues that CVSS is not wrong. Used alone, it tells a team how bad a flaw could be, and not whether to fix it today [15].
The order of the fields is the design decision, and the author got it right. KEV membership is a yes-or-no field, and it sorts first [11]. The post notes that KEV entries often score near 1.0 on EPSS, but not always. An industrial control system bug can be KEV-listed with a low EPSS because few systems run the affected product [9]. Sort on EPSS alone and that confirmed exploit ranks below findings that are only forecast [9]. CVSS sorts last and breaks ties between findings the first two fields cannot separate [11].
The 5% and 75% figures are claims about every published CVE [2][4]. The post does not say which EPSS data or time window produced them. For them to hold for one service, its scanner findings would have to look like a random draw from all published CVEs. If they did, the 200-finding backlog the post opens with would hold fewer than 10 findings that ever see exploitation [18][3]. The one worked case has five findings, and the post introduces them with "suppose" [10].
The post also suggests filtering to EPSS above 0.10 [5]. Its sprint rule starts at 0.20 [16]. A Critical finding at 0.15 clears the filter and misses the sprint rule. It also sits above the 0.05 line the post uses for scheduling Criticals [4].
Finding E is lowest on every axis and has no fix. It gets the treatment the post says busy developers already give most findings, now with a name: accept and monitor [18][14]. For a team working a dependency backlog, I think the field order is right. Under the guide's rules, two of the five example findings get this-week or this-sprint work. The other three go to normal scheduling, a routine dependency bump, or monitoring [5].
What to watch
- Publication of the dataset and time window behind the post's claim that the top 1% of CVEs by EPSS draw about 75% of exploitation attempts.
- A run of the KEV-EPSS-CVSS sort on a real scanner backlog of about 200 findings, counting how many land in the this-week and this-sprint tiers.