In 2025, 48,185 CVEs were published, 20.6% more than the 39,962 of 2024. No security team in the world fixes that volume. The useful question, then, was never how many vulnerabilities you close per month — it is which, and in what order.
The market's standard answer is to sort by CVSS and start with the criticals. It is a poor answer, and it is worth understanding exactly why before swapping it for another.
What CVSS measures — and what it does not
CVSS is a technical severity score. It describes how serious the flaw is if it is exploited: whether it gives remote code execution, whether it needs authentication, whether it affects confidentiality, integrity and availability. It is a good description of the anatomy of the flaw.
What it does not contain is any information about probability. A 9.8 flaw for which public exploitation has never existed and a 9.8 flaw being used in a ransomware campaign this week get exactly the same score. For the decision of what to fix first on Monday morning, treating the two as equal means spending the team's scarce time in the wrong place.
Add to that a distribution problem: because the score is calculated from the characteristics of the flaw, and serious flaws are common, the high end of CVSS is crowded. A list of criticals with thousands of rows prioritises nothing — it just hands the problem of choosing over to whoever has to do the work.
EPSS: the probability that was missing
EPSS (Exploit Prediction Scoring System), maintained by FIRST, answers a different question: what is the probability that this vulnerability will be exploited in the next 30 days. The output is a probability between 0 and 1, recalculated daily from signals observed in the real world.
It is a dimension independent of CVSS, and that is what makes it useful. Crossing the two produces four quadrants with very different meanings:
| High EPSS | Low EPSS | |
|---|---|---|
| High CVSS | Fix now. It is serious and it is being attacked. | Plan it. It is serious, but nobody is exploiting it today. |
| Low CVSS | Look again. Heavily exploited for some reason — usually because it is easy and exposed. | Normal maintenance queue. |
The quadrant that changes the routine most is the bottom left. These are the flaws a CVSS-ordered queue pushes to the end of the list and that attackers use precisely because almost nobody fixes them.
KEV: what has already left theory behind
CISA's KEV catalogue (Known Exploited Vulnerabilities) is a list of vulnerabilities for which there is confirmed evidence of real exploitation. It is not a model or a forecast: it is observation.
One comparison circulates widely and deserves care, because it is almost always presented wrongly. KEV held around 1,500 entries at the end of 2025 — but that number is the total since the catalogue was created, in 2021, adding up every year. The 48,185 CVEs are from a single year. Comparing the two directly, as if 3% of the 2025 flaws were exploited, is wrong.
What the comparison does show even so, and it is enough for the decision: confirmed exploitation is a small fraction of the volume published. Fixing in CVSS order is treating 48,000 items as if they all had the same chance of becoming an incident.
KEV comes with a deadline, not just a score. For US federal agencies, entering KEV creates an obligation to remediate within a period set by directive. Your organisation is not subject to that directive — but the deadline is a ready-made, defensible reference for urgency, already calibrated by people who observe exploitation at scale.
The order that works
With the three sources, the queue stops being a list and becomes a funnel:
- 1. Is it in KEV and present in your environment? Straight to the top, no discussion. Confirmed exploitation plus confirmed presence is the definition of urgency.
- 2. High EPSS on an exposed asset? Next in line. High probability on a reachable surface.
- 3. High CVSS on a business-critical asset? Goes into maintenance-window planning, with a deadline, not into the on-call shift.
- 4. Everything else. Normal queue, handled by patching campaign, not case by case.
Notice that step 1 and step 2 depend on information that is in none of the three scoring systems: what you have and where it is exposed. Without an inventory, KEV and EPSS turn into news reading — you know the flaw is being exploited and you do not know whether it exists in your house. It is the same prerequisite that stalls asset-based risk assessment.
What to tell the board
There is a gain in the conversation here, on top of the operational one. "We have 4,200 open critical vulnerabilities" is a sentence that leads nowhere: it frightens, it does not guide, and next year the number will be larger because the volume published grows every year.
"We have 11 vulnerabilities with confirmed exploitation on exposed assets, and the plan closes all of them in 14 days" is a sentence you answer with a decision. The difference between the two is not rhetoric — it is having prioritised by probability and exposure instead of by theoretical severity.
Sources consulted on 11 September 2026: 2025 CVE Data Review, by Jerry Gamblin (volume of CVEs published in 2025 and comparison with 2024); CISA's Known Exploited Vulnerabilities catalogue; Exploit Prediction Scoring System (EPSS), maintained by FIRST. Volume figures change continuously; check the sources before quoting them.