High score.
What happens next?
A scanner's red label can make every finding feel urgent. Your job is to establish what the finding means for your environment and get it to the right owner. A number alone cannot answer that question.
Four names, four different jobs
| Term | What it tells you | What it does not prove |
|---|---|---|
| CVE | An identifier for a publicly disclosed vulnerability | That your deployment is affected |
| CVSS | A severity assessment with a score and vector describing its assumptions | The likelihood your asset will be attacked |
| EPSS | An estimate of exploitation probability over the next 30 days | That your own system is compromised |
| CISA KEV | Catalog inclusion indicates known exploitation | That an absent CVE is safe |
FIRST's CVSS documentation explains severity scoring. When a scanner provides a score, retain its version and vector in your source evidence. This worksheet does not calculate or import CVSS scores. It joins CVE identifiers with separate public exploitation context.
FIRST's EPSS FAQ directly addresses critical CVSS findings with low EPSS. The signals measure different things. A low probability estimate does not cancel a serious impact, and a high estimate does not establish that the package is deployed in your environment.
Read the actual snapshot
CVE-2023-1177
KEV 2026.10.30: not listed. Catalog released 2026-10-30T17:02:45.3665Z. Retrieved 2026-11-01T01:26:08.063Z.
FIRST model v2026.06.15, score date 2026-10-31T12:00:27Z: 69.68% probability and 99.37 percentile. Retrieved 2026-11-01T01:26:08.514Z.
These are dated values, not a live feed. Check the worksheet's freshness notice before using them.
EPSS percentile is relative rank, not exploitation probability. For example, a hypothetical 99th-percentile score is above approximately 99 percent of the comparison population; it does not mean a 99 percent chance of exploitation. Keep the probability and percentile labels attached when sharing them.
A sensible first review
- Confirm the identifier and source. Keep a reference to the scanner finding and its observation date.
- Check the asset. Ask what version runs, which feature is enabled and who can reach it.
- Read current public context. A KEV match deserves prompt applicability review, regardless of an EPSS threshold.
- Follow your team's process. Assign the owner and next action; use established escalation and change rules.
These are review steps, not a universal patching SLA. Business impact, service criticality and organizational obligations still matter. If you cannot establish those facts, record the gap and escalate the question.
Missing is not zero
The snapshot retains EPSS scores for every CVE in its KEV catalog plus the verified MLflow example, CVE-2023-1177. A covered CVE can still lack a score in FIRST's feed. CVEs outside this coverage also show unavailable. A missing score, an unavailable source and a zero score are different states. A failed refresh retains the previous verified snapshot with its original retrieval time.
The site flags data older than 72 hours as stale. That threshold is a product freshness warning, not an industry standard. KEV release date, retrieval time, EPSS score date and your target patch date describe different events. CISA due dates remain catalog information, not automatically your organization's deadline.
CISA's official KEV mirror supplies the catalog, and FIRST supplies EPSS. There is no invented combined risk score.