cve-triage.tools

Is this CVE urgent? CVSS, EPSS & KEV in one lookup

Three questions decide how fast you have to move on a vulnerability: how bad is it (CVSS), how likely is it to be exploited (EPSS), and is it already being exploited in the wild (CISA KEV). This puts all three on one screen. Data is fetched live from NVD, FIRST and CISA in your browser.

Try: CVE-2021-44228 · CVE-2024-3094 · CVE-2019-0708 · CVE-2023-4863

Four CVEs, four different answers

The three signals often point different ways, and those disagreements are where triage judgement lives. These four were chosen because each one sits on a different rung of the verdict ladder, for a different reason. Figures are as of 22 October 2026; EPSS moves daily, so a live lookup will differ.

CVE-2021-44228  Apache Log4j 2 (Log4Shell)
Actively exploited: patch now

CVSS 10.0 (NVD and CISA-ADP agree) · EPSS 99.999% · in KEV since 10 Dec 2021, known ransomware use

The easy case: every signal points the same way. It is worth knowing as a reference point, because almost nothing else looks like this. Note the timing, though. CISA listed it the day it was published, and EPSS had no score for it the day before, because there was no CVE to score yet. For the first hours of a mass-exploitation event, the only signal you have is the news.

CVE-2025-4427  Ivanti Endpoint Manager Mobile
Actively exploited: patch now

CVSS 7.5 from NVD, 5.3 from Ivanti · EPSS 99.9% today, 4.9% the day before listing · in KEV since 19 May 2025

An authentication bypass that Ivanti rated Medium. On its own it exposes protected API resources. Paired with CVE-2025-4428, a code-injection bug (NVD 8.8, Ivanti 7.2) in the same component, it gives an unauthenticated attacker remote code execution, and attackers did exactly that. CISA listed both six days after disclosure. Neither half scores Critical, so a queue sorted by CVSS puts this chain below hundreds of theoretical 9.8s. CVSS scores each bug alone, and exploitation rarely respects that boundary.

CVE-2024-3094  xz Utils backdoor
High exploitation probability

CVSS 10.0 · EPSS 90.9% · not in KEV

A deliberately planted backdoor in xz versions 5.6.0 and 5.6.1, caught in March 2024 before it reached most stable distributions. EPSS rates it very likely to be exploited, partly because it was one of the most discussed vulnerabilities of the year, and EPSS draws on public exploit code and attention. CISA has not listed it. The backdoor only answers to a key held by whoever planted it, so the useful triage question is narrow: did any system you run ever ship 5.6.0 or 5.6.1? If not, the 90.9% does not apply to you.

CVE-2024-47092  Checkmk Exchange plugin check-mk-api
Severe, watch closely

CVSS 9.8 from NVD (v3.1), 7.7 from Checkmk (v4.0) · EPSS 0.38% · not in KEV

A deserialization and certificate-validation flaw in a community plugin. NVD scored it as network-reachable with no conditions, hence 9.8. The vendor's own CVSS v4.0 vector says attack complexity is high, the attack needs specific preconditions, and a user has to take part, hence 7.7. EPSS puts it below roughly 70% of all CVEs. This is the typical shape of a Critical: severe on paper, unlikely in practice, and entirely irrelevant if you do not run the plugin. If you do, the disagreement between the two vectors is the thing to read before deciding how fast to move.

Two of these four are on the KEV list, and one of those two is not even rated Critical. The data on every KEV entry shows that is not a coincidence.

Frequently asked questions

What does an EPSS score mean?

EPSS (Exploit Prediction Scoring System) is the probability, from 0 to 100%, that a vulnerability will be exploited in the wild within the next 30 days. FIRST publishes it daily and it updates as new threat data arrives.

What is the difference between EPSS and CVSS?

CVSS rates how severe a vulnerability is if exploited; EPSS estimates how likely it is to actually be exploited. A CVE can be CVSS 9.8 yet have a low EPSS, meaning severe in theory but not currently under attack.

What does it mean if a CVE is in the CISA KEV catalog?

The CISA Known Exploited Vulnerabilities catalog is an evidence-based list of CVEs confirmed exploited in the wild. Inclusion is the strongest signal to patch immediately, and U.S. federal agencies must remediate KEV entries by a set due date.

What EPSS score counts as high risk?

There is no official cutoff. This tool labels 5% and above as elevated and 50% and above as high; other teams use 10% as the elevated line. Always pair it with KEV status: any KEV-listed CVE is high priority regardless of its EPSS, and many were listed while their EPSS was still under 1%.

Does a high CVSS score mean a CVE is being exploited right now?

No. CVSS measures potential severity, not active exploitation. Check EPSS for probability and CISA KEV for confirmed in-the-wild use to know whether it is actually being attacked.

How often are EPSS and KEV data updated?

EPSS is recomputed daily by FIRST; the CISA KEV catalog is updated whenever CISA confirms new exploited vulnerabilities. This tool shows the KEV catalog date so you can see how fresh that data is.

Do I need to patch every high-CVSS CVE first?

Not necessarily. Modern prioritization uses all three signals: patch KEV-listed and high-EPSS CVEs first, then work down by CVSS. A high CVSS with near-zero EPSS and no KEV listing is usually lower urgency.

Guides

Sources. CVSS + description from the NVD 2.0 API; exploitation probability from FIRST EPSS; in-the-wild status from the CISA KEV catalog. EPSS is the probability of exploitation activity in the next 30 days; the percentile ranks a CVE against all others. KEV is CISA's evidence-based list of vulnerabilities with confirmed exploitation. A high CVSS with a low EPSS is common: severe in theory, not currently being exploited. Nothing you type is stored or sent anywhere but those three public APIs.