CVE Prioritizer — CVSS + EPSS + KEV triage
A triage tool that layers CVSS severity scores with EPSS exploit probability and CISA's known-exploited list to rank which vulnerabilities actually need your attention first. The idea is solid: not every critical CVE is equally urgent, and a vulnerability sitting in active exploit kits matters more than a theoretical one. In practice, this means you stop patching by severity alone and start routing your team toward what's actually getting weaponized or has a real chance of being used against you soon. That's a workable filter if the underlying data feeds are current and the weighting doesn't bury the signal.
Read the original on github.com
Try it: five findings, one defensible queue
Exercise added September 20, 2026. Original article published September 11, 2026.
In about 15 minutes, write a next action for five findings. No scanner, credentials or live target is needed. This independently authored exercise is not output from the CVE Prioritizer program.
Every asset and exposure statement is fictional. The CVEs and public scores are real snapshot data. Evidence was collected September 20, 2026 at 17:27 UTC; EPSS is dated September 20. Live values can change.
| Finding | CVE | CVSS v3.1 | EPSS | KEV snapshot | Applicability | Exposure |
|---|---|---|---|---|---|---|
| A | CVE-2021-44228 | 10.0 | 99.999% | Yes | Unconfirmed | Internal; package inventory only |
| B | CVE-2023-23397 | 9.8 | 97.408% | Yes | Confirmed in exercise | Receives external email |
| C | CVE-2023-34362 | 9.8 | 99.934% | Yes | Confirmed in exercise | Public internet |
| D | CVE-2024-3094 | 10.0 | 85.974% | No entry | Unconfirmed | Internal build network |
| E | CVE-2023-44487 | 7.5 | 99.999% | Yes | Confirmed in exercise | Public through a protective edge |
CVSS describes severity under its scoring assumptions. EPSS estimates exploitation in the wild over the next 30 days; it does not predict compromise of this particular asset. KEV records known exploitation, not proof that your asset was compromised. A missing KEV entry is not evidence of safety.
The fictional context
- A — Internal Java service: a scanner matched a library filename. The loaded version and reachable execution path are unknown.
- B — Outlook endpoint: inventory confirms affected software receiving external email. Previous exploitation has not been investigated.
- C — Public file-transfer server: inventory confirms an affected version, public access and sensitive files. No compensating control is recorded.
- D — Linux build worker: the scanner matched xz by name. Distribution version, package provenance and vendor applicability are unknown.
- E — Public HTTP/2 service: a mitigation is recorded but its coverage and configuration have not been tested. Availability is business-critical.
Make your decisions first
- With one responder available, which confirmed exposure would you investigate first? Cite the evidence.
- Which findings need applicability checks, and exactly what would you collect?
- What could move E ahead of B?
- Does D's absence from KEV justify ignoring it?
- Record a next action, owner, review time and uncertainty for all five findings.
Compare the worked answer
Start response planning for C; handle B promptly alongside it where capacity allows. C combines confirmed applicability, public access, known exploitation and sensitive-file impact. Verify the owner, version, vendor remediation and incident evidence. Patching does not prove there was no prior compromise. B also has confirmed applicability and external exposure; lower EPSS is not a reason to leave it unattended.
Test E's mitigation promptly. Verify edge and origin coverage, bypass paths and availability telemetry. If the control is ineffective or the service is failing, E can become the first response priority despite its lower severity score.
Assign A and D explicit applicability investigations. For A, establish component version, loaded/reachable code and vendor applicability. For D, collect distribution/build, exact package provenance/version and vendor advisory. A package-name match cannot settle either finding. Absence from KEV does not make D safe.
Keep a response queue for confirmed exposure and a verification queue for unresolved findings, each with owners and review times. This is one defensible example, not a universal order. Without maintenance windows, incident telemetry and remediation-compatibility evidence, the fixture cannot justify a final patch schedule.
Complete your evidence worksheet
Open the editable, printable worksheet · Download the frozen fixture
Worksheet edits are not saved automatically; print or save them before leaving. The JSON includes source URLs, dates, score vectors and response hashes.
Completion check: all five rows have next steps; A and D stay explicitly uncertain until evidence resolves them; E's mitigation is tested; C's priority cites asset context as well as scores.
Evidence definitions: NVD CVSS metrics, FIRST EPSS, CISA's official KEV data mirror. See the original project credited above for its implementation.