Patch smarter, not harder: using KEV and EPSS to prioritize vulnerabilities

2026-09-20 · cyber

Tens of thousands of CVEs are published every year. Nobody can patch everything, so the real skill in vulnerability management is prioritization: fixing first what attackers actually exploit.

Two free tools that help

• CISA KEV catalog. The US Cybersecurity and Infrastructure Security Agency maintains a list of Known Exploited Vulnerabilities. If a CVE is on this list, it has been seen exploited in the wild. That is a strong patch-now signal.
• EPSS scores. The Exploit Prediction Scoring System estimates the probability that a vulnerability will be exploited in the next 30 days, on a scale from 0 to 1. A CVE with an EPSS near 1.0 deserves attention even if no exploit is public yet.

Both are free and public. Together with the CVSS severity score from the NVD, they give a practical triage order: exploited now first, likely-to-be-exploited next, everything else on the normal cycle.

A simple routine

• Once a week, check which newly published CVEs affect software you actually run.
• Cross-reference KEV membership and EPSS scores.
• Patch internet-facing systems with KEV-listed issues immediately.
• Keep the rest on your regular update schedule.

You do not need expensive tooling to do this. Public data plus a spreadsheet beats an ignored scanner dashboard every time.