CVSS-based prioritization is mostly security theater. Here's…

I spent some time digging into the gap between CVSS scores and actual exploitation, and wrote up what I found plus the prioritization framework I landed on.

TL;DR:

CVSS measures severity ("how bad if exploited"), not likelihood ("will anyone exploit this"). Prioritization depends on the second question.
CISA KEV — the catalog of vulns confirmed exploited in the wild — is a tiny fraction of all published CVEs. Sorting by CVSS alone means most of your remediation effort goes to vulns that will never be attacked.
Roughly 20% of KEV entries have been used by ransomware groups, and they span the full CVSS range. A "patch Critical only" policy misses real threats sitting at 7.x.
Free signals that work better together: KEV (confirmed exploitation), EPSS (predicted exploitation), plus your own context — asset criticality, compensating controls, exposure.

The framework: score each vuln across 5 dimensions, bucket into 4 tiers (P0 = KEV + critical asset + exposed → drop everything; P3 = low likelihood + strong controls → monitor, don't panic).

Full write-up with the tier definitions and a Monday-morning implementation plan:

https://jhapravin.substack.com/p/cvss-isnt-lying-youre-asking-it-the?r=3anp7w&utm_campaign=post&utm_medium=web&showWelcomeOnShare=true

Curious how others here handle prioritization — anyone moved fully to EPSS/KEV-driven queues? What broke when you tried?

Impact

The impact is on vulnerability management processes rather than a direct technical vulnerability. Relying solely on CVSS scores for prioritization may lead to inefficient allocation of remediation resources, potentially leaving exploitable vulnerabilities unaddressed. The proposed framework can improve risk management by aligning patching efforts with actual exploitation risk, reducing the chance of overlooking significant threats.

Defensive guidance

This is an advisory on vulnerability prioritization methodology rather than a vulnerability with a patch. Organizations should consider integrating multiple signals—such as KEV, EPSS, asset criticality, compensating controls, and exposure—into their vulnerability management workflows to better prioritize remediation. No direct patch or fix is applicable.

Summary

The post critiques CVSS-based prioritization as largely ineffective for predicting exploitation risk, noting that only a small fraction of CVEs in the CISA KEV catalog have confirmed exploitation in the wild. It highlights that ransomware groups exploit vulnerabilities across the CVSS spectrum, including those with scores below critical. The author proposes a prioritization framework scoring vulnerabilities across five dimensions—KEV status, EPSS prediction, asset criticality, compensating controls, and exposure—categorizing them into four tiers to guide remediation efforts more accurately. This approach aims to optimize patching by focusing on vulnerabilities with higher exploitation likelihood rather than severity alone.

CVSS-based prioritization is mostly security theater. Here's a 5-signal framework that actually maps to exploitation.

Discussion

Links cited in the discussion

Impact

Defensive guidance

Summary

References

Community reviews

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 29 Sep 2026, 18:21 UTC

Technical details

References

Community reviews

Related threats