CVSS assigns severity scores to vulnerabilities based on theoretical impact. EPSS predicts which vulnerabilities adversaries will actually exploit within 30 days. Security teams managing 41,000+ annual CVEs with 56% scored High or Critical face a prioritization crisis where traditional scoring fails operational reality.

 

 

Reading time 10 minutes

 

Executive Summary

 

Organizations patch vulnerabilities based on CVSS severity ratings, yet only 2.3% of high-CVSS vulnerabilities experience exploitation attempts in production environments.

 

CVSS measures theoretical impact. EPSS predicts real-world exploitation probability.

 

Security teams remediate 5-20% of vulnerabilities monthly while facing 61% of 41,000+ annual CVEs labeled High or Critical. This creates critical overload scenarios where everything appears urgent, rendering traditional prioritization ineffective.

 

The operational risk: teams waste 85% of remediation effort patching vulnerabilities adversaries ignore while missing the 2-7% that threat actors actively exploit.

 

 

Threat Overview: The CVSS Prioritization Failure Pattern

 

CVSS (Common Vulnerability Scoring System) provides static severity scores assigned within two weeks of CVE publication. Scores range from 0-10 based on exploitability metrics, impact calculations, and environmental factors.

 

The system never revisits scores following initial assessment.

 

A CVE assigned CVSS 6.0 (Medium) remains 6.0 regardless of whether threat actors develop weaponized exploits, publish proof-of-concept code, or launch mass exploitation campaigns. The score reflects theoretical maximum impact under ideal conditions, not operational threat landscape activity.

 

In 2024, organizations faced 41,000+ new CVEs with 56% scored High (7.0-8.9) or Critical (9.0-10.0). Compliance frameworks including PCI DSS and FedRAMP mandate 30-day remediation windows for High findings.

 

Teams default to sorting by CVSS score and working top-down.

 

This approach ignores whether vulnerabilities are reachable, exploitable, or positioned near sensitive data. Research demonstrates nearly equal numbers of vulnerabilities with available exploit code exist in the CVSS 4-6 range as those scoring 7+.

 

Teams using CVSS 7+ thresholds systematically ignore critical exploitation risks.

 

 

EPSS: Exploitation Prediction Intelligence

 

EPSS (Exploit Prediction Scoring System) provides 0-1 probability scores representing likelihood of CVE exploitation within 30 days. The model analyzes 1,100+ variables containing distinct vulnerability risk attributes including:

 

→ Published exploit code availability

→ Threat actor targeting patterns

→ Vulnerability age and disclosure timeline

→ Product deployment prevalence

→ Attack surface accessibility

→ Historical exploitation data

 

EPSS scores update daily for every CVE. Data remains freely accessible via CSV and API for integration into SOC workflows, vulnerability management platforms, and security dashboards.

 

The model achieves ROC AUC of 0.838 in predicting exploitation events while remaining simple enough to implement without specialized machine learning infrastructure.

 

Operational efficiency gains: EPSS reduces remediation effort by 85% compared to patching all CVSS 10 vulnerabilities while maintaining equivalent coverage of exploited vulnerabilities. Reductions range from 29% to 85% across different CVSS thresholds.

 

 

Attack Chain Analysis: How Scoring Failures Enable Breaches

 

Case Study: Jaguar Land Rover September 2025 Breach

 

The JLR cyberattack represents the most damaging cyberattack in British history with £1.9 billion total economic impact. Production ceased for five weeks starting September 1, 2025, with costs estimated at £50 million weekly.

 

Initial Access: Targeted vishing campaign where attackers posing as internal staff tricked employees into disclosing credentials.

 

Execution: Adversaries exploited zero-day vulnerability in third-party remote-access tool, enabling lateral movement across IT and OT systems.

 

Persistence: Attackers likely retained network access from March 2025 HELLCAT ransomware compromises, positioning for strike during "New Plate Day" — one of the busiest automotive sales periods.

 

Impact: Inadequate system segmentation allowed attackers to impact manufacturing, supply chain databases, and dealer networks simultaneously. Suppliers across Europe scaled back production. Independent garages lost parts database access. Global dealers experienced total system crashes.

 

Despite £800 million investment in digital transformation and cybersecurity enhancement contracts with Tata Consultancy Services in 2023, the attack revealed fundamental prioritization failures.

 

The vulnerability management gap: Organizations prioritized CVSS-based patching schedules while missing identity exposure risks, third-party access control weaknesses, and network segmentation failures that enabled multi-system compromise.

 

Case Study: MOVEit Mass Exploitation May 2023

 

Beginning May 27, 2023, CL0P Ransomware Gang exploited CVE-2023-34362, a zero-day SQL injection vulnerability in MOVEit Transfer. By end of 2023, Clop compromised 2,700+ organizations and exposed 93+ million personal records.

 

Initial Access: SQL injection in MOVEit Transfer web application allowed unauthenticated remote code execution.

 

Execution: Adversaries deployed web shells for persistent access, credential harvesting, and data exfiltration.

 

Lateral Movement: Over 80% of victim organizations had no direct relationship with Progress Software yet were compromised through third-party vendor dependencies.

 

Impact: Major organizations including BBC, British Airways, Aer Lingus, Nova Scotia government, Zellis, and University of Rochester experienced data exfiltration. High-profile government, finance, media, aviation, and healthcare sectors faced exposure.

 

CISA added CVE-2023-34362 to the Known Exploited Vulnerabilities Catalog on June 2, 2023, based on evidence of active exploitation. More than 2,500 MOVEit servers remained exposed to the Internet over ports 80 and 443, with 73% located in the United States.

 

The prioritization failure: Despite lower initial EPSS scores, threat intelligence sources provided evidence of active zero-day exploitation. Organizations relying solely on CVSS severity ratings and standard patch cycles missed the exploitation window entirely.

 

 

Operational Impact for SOC Teams

 

Detection Challenges in CVSS-Based Prioritization

 

Security teams face systematic detection failures when vulnerability prioritization relies exclusively on CVSS scoring:

 

Resource allocation mismatch: Teams spend remediation effort on 56% of CVE database (High/Critical CVSS scores) while only 2-7% of vulnerabilities experience exploitation attempts. This creates 85% wasted effort patching theoretical risks.

 

Exploitation timing blindness: CVSS scores remain static from initial publication. Teams lack visibility into emerging exploitation trends, weaponized exploit availability, or threat actor targeting shifts.

 

Environmental context gaps: CVSS provides severity ratings without accounting for asset criticality, network exposure, or data sensitivity. A CVSS 9.0 vulnerability in an isolated development environment receives identical prioritization as the same CVE in production database servers.

 

Third-party visibility failures: MOVEit exploitation demonstrated 80% of victim organizations had no direct vendor relationship. CVSS-based patching schedules miss supply chain exposure risks where vendors introduce vulnerabilities into enterprise environments.

 

Why Existing Controls Fail

 

Traditional vulnerability management controls fail operational reality:

 

Patch velocity constraints: Organizations remediate 5-20% of vulnerabilities monthly. When 61% of annual CVEs score High or Critical, teams cannot achieve compliance-mandated 30-day remediation windows.

 

Critical overload scenarios: When 56% of vulnerabilities appear critical, security teams lose ability to distinguish genuine operational risks from theoretical severity ratings. Everything becomes urgent, so nothing receives appropriate prioritization.

 

Compliance-driven prioritization: Frameworks mandate CVSS-based remediation timelines without accounting for exploitation probability. Teams patch to satisfy audit requirements rather than reduce operational threat exposure.

 

Risk Exposure Scenarios

 

Organizations face specific risk exposure patterns under CVSS-only prioritization:

 

Scenario 1 - Medium CVSS, High EPSS: CVE-2023-48795 carries CVSS 5.9 (Medium) but EPSS score in 90th percentile. Teams deprioritize based on severity rating while adversaries actively develop exploits.

 

Scenario 2 - High CVSS, Low EPSS: CVE-2024-0646 in Linux kernel scores CVSS 7.0 (High) but EPSS 0.04%. Exploitation requires local access and specialized conditions. Teams waste remediation resources on unattractive attack vectors.

 

Scenario 3 - KEV Catalog Gaps: Zero-day vulnerabilities enter exploitation before EPSS models detect patterns or CISA adds entries to Known Exploited Vulnerabilities catalog. Organizations relying on reactive lists miss initial exploitation windows.

 

Visibility Gaps

 

Standard EDR will not detect CVSS prioritization failures because:

 

→ Endpoint detection focuses on execution behaviors, not vulnerability management decisions

→ EDR lacks visibility into patch deployment prioritization logic

→ Exploitation of unpatched vulnerabilities appears as legitimate application behavior until post-compromise activity begins

→ Third-party software vulnerabilities operate outside EDR monitoring scope

→ Network-based exploitation bypasses endpoint controls entirely

 

Organizations require vulnerability intelligence platforms that correlate CVSS severity, EPSS exploitation probability, asset criticality, network exposure, and threat intelligence feeds.

 

Without integrated intelligence, teams cannot distinguish between theoretical severity and operational risk.

 

 

Indicators & Warning Signs

 

Security teams should monitor for vulnerability prioritization failures:

 

Behavioral Anomalies:

 

→ Patch deployment focused exclusively on CVSS High/Critical ratings

→ Remediation backlogs exceeding 60+ days for Medium-scored vulnerabilities

→ Vulnerability scanning without EPSS score integration

→ Patch cycles driven by compliance timelines rather than exploitation intelligence

→ No correlation between vulnerability management and threat intelligence feeds

 

Identity Inconsistencies:

 

→ Third-party vendor access without vulnerability disclosure requirements

→ Remote access tools deployed without exploitation probability assessment

→ Privileged accounts accessing systems with unpatched Medium-CVSS vulnerabilities

→ Service accounts with elevated permissions on systems outside patch schedules

 

Infrastructure Indicators:

 

→ Internet-exposed systems running software with EPSS scores >0.5

→ Critical business applications on platforms with known exploit code availability

→ Network segmentation failures allowing lateral movement from vulnerable systems

→ Asset inventory gaps preventing vulnerability-to-system correlation

 

Log Patterns:

 

→ Vulnerability scan results sorted exclusively by CVSS score

→ Patch deployment logs showing High/Critical-only remediation

→ No EPSS score queries in vulnerability management platform logs

→ Absence of threat intelligence correlation in remediation workflows

 

Process Red Flags:

 

→ Vulnerability management policies referencing only CVSS thresholds

→ SLA definitions based on severity scores without exploitation probability

→ Patch approval processes lacking threat intelligence review

→ Risk acceptance decisions made on CVSS ratings alone

 

 

Defensive Recommendations

 

Monitoring Strategies

 

Implement dual-scoring vulnerability prioritization:

 

Integrate EPSS scores alongside CVSS ratings in vulnerability management platforms. Set organizational thresholds based on risk appetite — many teams prioritize vulnerabilities with EPSS >0.5 or >0.75 depending on resource constraints.

 

Access EPSS data via FIRST.org API for daily score updates. Ingest scores into SIEM platforms for correlation with asset criticality, network exposure, and threat intelligence feeds.

 

Establish exploitation probability monitoring:

 

Track EPSS score changes over time for deployed software. Rising scores indicate emerging exploitation trends requiring immediate attention regardless of CVSS severity.

 

Monitor for vulnerabilities where EPSS percentile exceeds 75th while CVSS remains Medium. These represent high-probability exploitation risks that traditional prioritization misses.

 

Detection Use Cases

 

Use Case 1 - High EPSS, Internet Exposure:

 

Alert on any system with Internet-facing services running vulnerabilities with EPSS >0.5. Correlate with asset criticality and data classification for risk-based remediation prioritization.

 

Use Case 2 - EPSS Score Velocity:

 

Detect vulnerabilities where EPSS score increases >20 percentile points within 7 days. Rapid score changes indicate emerging exploitation activity requiring immediate assessment.

 

Use Case 3 - Third-Party Software Exposure:

 

Identify vendor-supplied software with EPSS >0.3 deployed in production environments. Prioritize vendor communications and emergency patching procedures.

 

Use Case 4 - KEV Catalog Correlation:

 

Cross-reference vulnerability scans against CISA Known Exploited Vulnerabilities catalog. Any KEV presence requires immediate remediation regardless of CVSS or EPSS scores.

 

Identity Verification Improvements

 

Strengthen identity controls to reduce exploitation impact:

 

→ Implement conditional access policies restricting privileged account usage to patched systems

→ Require MFA for all remote access tools, particularly third-party vendor connections

→ Deploy privileged access management solutions with session recording for systems with EPSS >0.5 vulnerabilities

→ Establish vendor access approval workflows including vulnerability disclosure requirements

→ Monitor service account activity on systems outside standard patch cycles

 

Endpoint Controls

 

Deploy compensating controls for high-EPSS vulnerabilities pending remediation:

 

→ Enable application control policies blocking execution from common exploit delivery paths

→ Implement network microsegmentation isolating vulnerable systems from critical assets

→ Deploy virtual patching through web application firewalls for Internet-facing vulnerabilities

→ Enable enhanced logging and behavioral monitoring on systems with EPSS >0.7

→ Establish automated isolation procedures for systems showing exploitation indicators

 

Process Changes

 

Restructure vulnerability management workflows:

 

Abandon CVSS-only prioritization. Implement risk-based scoring combining CVSS severity, EPSS exploitation probability, asset criticality, network exposure, and data sensitivity.

 

Establish tiered remediation SLAs:

 

→ Tier 1: EPSS >0.75 + Critical Assets = 7-day remediation

→ Tier 2: EPSS >0.5 + High CVSS = 14-day remediation

→ Tier 3: EPSS >0.3 OR High CVSS = 30-day remediation

→ Tier 4: All others = 90-day remediation or risk acceptance

 

Integrate threat intelligence feeds into patch approval processes. Correlate CVE identifiers with adversary targeting intelligence, exploit kit incorporation, and ransomware campaign patterns.

 

Require EPSS score review in risk acceptance decisions. Document exploitation probability alongside business justification for deferred patching.

 

 

Industry / Strategic Context

 

Broader Trend Implications

 

The vulnerability landscape continues acceleration. Organizations faced 41,000+ CVEs in 2024. Projections indicate 50,000+ CVEs in 2026.

 

This growth rate makes CVSS-only prioritization mathematically impossible. Teams remediating 5-20% of vulnerabilities monthly cannot address 61% of annual CVEs scored High or Critical within compliance-mandated timeframes.

 

Organizations must adopt intelligence-led prioritization or accept systematic exposure to exploited vulnerabilities.

 

AI and Automation Implications

 

EPSS represents machine learning application to vulnerability intelligence. The model analyzes 1,100+ variables including exploit code availability, threat actor patterns, and historical exploitation data.

 

Future iterations will incorporate:

 

→ Real-time dark web monitoring for exploit sales and development discussions

→ Adversary infrastructure correlation linking CVEs to active campaign infrastructure

→ Geopolitical event correlation predicting nation-state targeting shifts

→ Supply chain dependency mapping for transitive vulnerability exposure

 

Organizations investing in vulnerability intelligence platforms with API-driven EPSS integration position themselves for automated, intelligence-led remediation workflows.

 

Compliance Framework Evolution

 

Regulatory frameworks continue mandating CVSS-based remediation timelines. PCI DSS requires 30-day patching for High vulnerabilities. FedRAMP mandates 30-day remediation for High findings.

 

These requirements create compliance-driven prioritization disconnected from operational threat reality. Organizations patch to satisfy audit requirements rather than reduce exploitation risk.

 

Industry movement toward risk-based compliance approaches will require frameworks to incorporate exploitation probability alongside theoretical severity. Early adopters implementing EPSS-enhanced prioritization demonstrate both improved security posture and more efficient resource allocation.

 

Strategic Context & Further Reading

 

🔗 How Security Teams Should Operationalise the CISA KEV Catalog in 2026 

Why read this: CISA and NCSC are now advising a change is priority in terms of how to triage and score vulnerabilities, moving away from pure CVSS scoring to risk based scoring based on actively exploited, reachability and exploitation likelihood.

 

🔗 Vulnerability Management Reality: Operational Risk & Exposure-Based Prioritization
Why read this: Understand why traditional vulnerability management models fail at scale and how exposure-based prioritization changes remediation strategy for organizations facing 50,000+ annual CVEs.

 

🔗 Why Most Patch Programs Fail: The Operational Reality
Why read this: Explore the systematic failures in compliance-driven patching and learn how to build intelligence-led remediation workflows that address real-world exploitation patterns.

 

🔗 JLR September 2025 Breach: Operational Failure Analysis
Why read this: Examine how identity exposure, third-party access controls, and KEV prioritization gaps combined to enable the most damaging cyberattack in British history despite £800M cybersecurity investment.

 

🔗 MOVEit Mass Exploitation: KEV Prioritization and Asset Visibility Failures
Why read this: Learn how 2,700+ organizations experienced compromise through third-party vendor dependencies and why CVSS-based prioritization missed zero-day exploitation windows entirely.

 

🔗 50,000+ CVEs in 2026: Vulnerability Management Strategy for Scale
Why read this: Prepare for accelerating CVE publication rates and understand how to build sustainable vulnerability management programs when traditional approaches become mathematically impossible.

 

 

Hackerstorm Analysis

 

What organizations systematically underestimate about vulnerability scoring:

 

Security teams treat CVSS as risk measurement when it functions as impact estimation. The distinction matters operationally.

 

CVSS answers: "If this vulnerability were exploited under ideal conditions, what would the maximum impact be?"

 

EPSS answers: "What is the probability adversaries will exploit this vulnerability within 30 days?"

 

Organizations conflate these questions, building remediation programs around theoretical maximum impact while ignoring exploitation probability. This creates systematic exposure to the 2-7% of vulnerabilities that threat actors actually weaponize.

 

The long-term implication: As CVE publication rates approach 50,000+ annually, the gap between remediation capacity (5-20% monthly) and CVSS High/Critical volume (61% of CVEs) becomes unbridgeable.

 

Teams face a choice: continue compliance-driven prioritization and accept systematic exposure, or adopt intelligence-led approaches that align remediation effort with operational threat reality.

 

Where this evolution leads:

 

Vulnerability management transforms from patch deployment to continuous risk assessment. Organizations will operate vulnerability intelligence platforms that correlate:

 

→ CVSS theoretical impact

→ EPSS exploitation probability

→ Asset criticality and business context

→ Network exposure and attack surface

→ Threat intelligence on adversary targeting

→ Compensating control effectiveness

 

The JLR and MOVEit breaches demonstrate what happens when prioritization disconnects from operational reality. JLR invested £800M in cybersecurity yet failed to address identity exposure and third-party access risks. MOVEit exploitation compromised 2,700+ organizations through vendor dependencies that CVSS-based prioritization never assessed.

 

The operational truth: You cannot patch your way to security when facing 50,000+ annual vulnerabilities and 5-20% monthly remediation capacity. You can only prioritize your way to acceptable risk.

 

EPSS provides the exploitation probability intelligence that makes prioritization operationally effective.

 

 

 

---

About This Report

 

Attribution Note

This analysis is based on publicly available reporting and security research summaries. Some technical details may change as additional information becomes available. 

 

Author Information

Timur Mehmet | Founder & Lead Editor

Timur is a veteran Information Security professional with a career spanning over three decades. Since the 1990s, he has led security initiatives across high-stakes sectors, including Finance, Telecommunications, Media, and Energy. Professional qualifications over the years have included CISSP, ISO27000 Auditor, ITIL and technologies such as Networking, Operating Systems, PKI, Firewalls. For more information including independent citations and credentials, visit our About page.

Contact: This email address is being protected from spambots. You need JavaScript enabled to view it.

 

Editorial Standards

This article adheres to Hackerstorm.com's commitment to accuracy, independence, and transparency:

• Fact-Checking: All statistics and claims are verified against primary sources and authoritative reports
• Source Transparency: Original research sources and citations are provided in the References section below
• No Conflicts of Interest: This analysis is independent and not sponsored by any vendor or organization
• Corrections Policy: We correct errors promptly and transparently. Report inaccuracies to This email address is being protected from spambots. You need JavaScript enabled to view it.

Editorial Policy: Ethics, Non-Bias, Fact Checking and Corrections

Learn More: About Hackerstorm.com | FAQs

 

Source Transparency

 

→ FIRST.org - Exploit Prediction Scoring System (EPSS) - https://www.first.org/epss/

→ ACM Digital Library - "Exploit Prediction Scoring System (EPSS)" - https://dl.acm.org/doi/pdf/10.1145/3436242

→ Orca Security - "EPSS Scoring System Explained" - https://orca.security/resources/blog/epss-scoring-system-explained/

→ Splunk - "EPSS: Exploit Prediction Scoring System" - https://www.splunk.com/en_us/blog/learn/epss-exploit-prediction-scoring-system.html

→ CyberSierra - "Vulnerability Prioritization Beyond CVSS" - https://cybersierra.co/blog/vulnerability-prioritization-beyond-cvss/

→ Tenable - "Why You Need to Stop Using CVSS for Vulnerability Prioritization" - https://www.tenable.com/blog/why-you-need-to-stop-using-cvss-for-vulnerability-prioritization

→ Intruder - "EPSS vs CVSS" - https://www.intruder.io/blog/epss-vs-cvss

→ Wikipedia - "Jaguar Land Rover Cyberattack" - https://en.wikipedia.org/wiki/Jaguar_Land_Rover_cyberattack

→ Trace Security - "The Jaguar Land Rover Hack Explained" - https://www.tracesecurity.com/blog/articles/the-jaguar-land-rover-hack-explained/

→ Dark Reading - "Jaguar Land Rover Cyberattacks: Bad for Business" - https://www.darkreading.com/cyberattacks-data-breaches/jaguar-land-rover-cyberattacks-bad-business

→ CyberPeace Foundation - "Jaguar Land Rover Cyber Attack: A Disruption in the Automotive Supply Chain" - https://cyberpeace.org/resources/blogs/jaguar-land-rover-cyber-attack-a-disruption-in-the-automotive-supply-chain

→ Manufacturing Digital - "JLR: How Can Companies Avoid a Major Cyber Attack" - https://manufacturingdigital.com/news/jlr-how-can-companies-avoid-a-major-cyber-attack

→ Cybersecurity Dive - "MOVEit File Transfer CVEs" - https://www.cybersecuritydive.com/news/moveit-file-transfer-cves/719933/

→ Picus Security - "CVE-2023-34362: Cl0p Ransomware Exploits MOVEit Transfer SQLi Vulnerability" - https://www.picussecurity.com/resource/blog/cve-2023-34362-cl0p-ransomware-exploits-moveit-transfer-sqli-vulnerability

→ Phoenix Security - "MOVEit Transfer Vulnerability" - https://phoenix.security/movit-transfer-vuln/

→ Cloudsmith - "CVSS vs EPSS" - https://cloudsmith.com/cvss-vs-epss

→ Seemplicity - "What is Exploit Prediction Scoring System (EPSS)" - https://seemplicity.io/remops-glossary/what-is-exploit-prediction-scoring-system-epss/

→ BitSight - "EPSS: Exploit Prediction Scoring System" - https://www.bitsight.com/glossary/epss-exploit-prediction-scoring-system

→ Wiz - "What is CVSS: Common Vulnerability Scoring System" - https://www.wiz.io/academy/vulnerability-management/what-is-cvss-common-vulnerability-scoring-system

→ Wiz - "Vulnerability Prioritization" - https://www.wiz.io/academy/vulnerability-management/vulnerability-prioritization