CVE, CVSS, EPSS, KEV: The Vulnerability Alphabet, Finally Explained

8/20/2026

Every vulnerability headline you've ever skimmed ("critical 9.8 flaw under active exploitation") is built from four acronyms doing four different jobs. Most people, including plenty who work in tech, quietly blur them into one vague notion of "badness." That blur is worth fixing, because the four together answer the only question that matters: should I care, today? Here's the whole alphabet, one honest definition at a time.

CVE: the name tag

A CVE (Common Vulnerabilities and Exposures) identifier is just that: an identifier. CVE-2026-45659 is a name for one specific flaw, issued so that everyone (vendors, scanners, researchers, journalists) is provably talking about the same bug. The number after the year is a serial, not a score. A CVE tells you a vulnerability exists and has a name. It says nothing about how bad it is.

It's worth knowing the scale of the firehose: tens of thousands of new CVEs are published every year, a rate that makes "patch everything" arithmetic-impossible for most teams, which is exactly why the other three acronyms exist. The catalog lives in the US NVD (National Vulnerability Database), which is where the enrichment (descriptions, scores, affected products) gets attached to each name.

CVSS: how bad it could be

CVSS (Common Vulnerability Scoring System) is the 0-to-10 severity score in every headline. It's computed from the flaw's intrinsic characteristics: can it be reached over the network? Does it need authentication? User interaction? What's the worst-case damage to confidentiality, integrity, availability? Maximum badness across every answer gets you toward the famous 9.8s and 10.0s.

Here's the misunderstanding that ruins patch programs: CVSS measures potential, not probability. It describes the blast radius if someone exploits the flaw. It carries no information about whether anyone ever will. Roughly 5% of CVEs are ever exploited in the wild; the other 95% include a great many terrifying-looking 9.x scores that no attacker ever bothered weaponising. Sorting your patch queue purely by CVSS means treating all of them as equally urgent. Which brings us to EPSS.

EPSS: how likely it actually is

EPSS (Exploit Prediction Scoring System, from the nonprofit FIRST.org) is the newest and least-known of the four, and arguably the most decision-useful. It's a machine-learning model trained on real exploitation telemetry that assigns every CVE a probability of being exploited in the next 30 days, refreshed daily. Not severity: likelihood.

The two scores routinely disagree, and the disagreements are the entire point. A CVSS 9.8 with an EPSS of 0.04% is a monster nobody is hunting with. A CVSS 7.2 with an EPSS of 89% is a mediocre-looking bug that attack crews are actively using right now. If you only have one change window this week, the second one is your emergency. EPSS is free, no key required, one API call.

KEV: it's already happening

KEV is CISA's Known Exploited Vulnerabilities catalog: the shortlist (about 1,600 entries, against a quarter-million total CVEs) of flaws with confirmed exploitation in the wild. No prediction, no modelling: someone verified attackers using it. Each entry comes with a required remediation action and a due date that US federal agencies are legally bound to meet.

If you remember one thing from this post: KEV is the drop-everything list. When a CVE lands there, the debate about severity scores is over: reality has voted. For everyone outside the US government, the catalog is a free gift: a national cyber agency running a service titled, in effect, these ones, now.

The four together

So the alphabet, in one line each: CVE names it. CVSS says how bad it could be. EPSS says how likely it is. KEV says it's happening. Name, potential, probability, fact.

Stack them and you get a triage logic strong enough to run a real program on: KEV first, then high-probability, then high-severity, then everything else on the maintenance train. I've written up the exact formula I use as its own post, and the Security Feeds page on this site computes it live: every risk badge you see there is just these four signals combined, deterministically, in public.

The next time a headline screams about a 9.8, you now know the three questions it didn't answer, and where to look them up in under a minute.