The scariest vulnerability score may not tell you what to patch first

A vulnerability can receive a high Common Vulnerability Scoring System (CVSS) score because its technical characteristics permit serious impact under defined assumptions. That number does not say that attackers are currently exploiting it, or that the affected component is reachable in a particular deployment. CVSS v4 separates Base metrics, which describe intrinsic characteristics, from Threat and Environmental metrics that consumers can adjust for current evidence and local conditions. A published Base score is therefore a starting description, not a complete organizational priority. Its numeric scale does not tell you how soon an attacker will act.

The Exploit Prediction Scoring System (EPSS) asks a different question: how likely a publicly disclosed CVE is to be exploited in the wild during the next 30 days. Its probability updates daily. It does not estimate the harm to your organization, whether the vulnerable product is installed, or whether a control blocks the attack. A low EPSS value is not a declaration that a vulnerability is safe.

Imagine two unpatched services. One has a critical CVSS Base score but is isolated from untrusted networks; another has a lower score but is internet-facing and has a high EPSS probability. The second may deserve earlier investigation, but that conclusion depends on asset importance, reachable attack paths, mitigations and the actual vulnerability. Scores do not make that decision for you.

A useful triage record keeps the score and vector together, notes the EPSS date, and adds deployment context: affected version, exposure, business role and evidence of exploitation. CVSS v4’s Threat metrics can capture exploit maturity, while Environmental metrics let an assessor reflect local impact or mitigations. EPSS contributes a calibrated population-level probability. Neither replaces an inventory or incident response. Treat the pair as inputs to a documented queue, then update the queue when the software, threat evidence or environment changes.