PATCH//NOTES Open the interactive version
← All lessons
Defence · Beginner · 5 min

Vulnerabilities & patching

CVE, CVSS, EPSS, KEV: how teams decide what to fix first.

What it is

Every public security bug gets a CVE ID. CVSS scores how bad it could be (0–10). EPSS estimates how likely it is to be exploited in the next 30 days. CISA's KEV list confirms which are being exploited right now. Tens of thousands of CVEs appear every year, far more than anyone can patch at once, so good teams prioritise by real-world risk: exploited first, likely next, then severity.

Real case · 2017

Equifax

A patch for a critical Apache Struts flaw was available for two months, but one internet-facing system wasn't updated. Attackers used it to steal personal data on about 147 million people.

Source: Wikipedia: 2017 Equifax data breach

How defenders stop it

  • Keep an accurate inventory of systems and software
  • Patch KEV-listed and internet-facing issues first
  • Use EPSS alongside CVSS to cut the noise
  • Track time-to-patch as a team metric

Try it yourself

Explore this week's CVEs on the Radar

Check yourself

1. A CVE has CVSS 6.5 and is on CISA's KEV list. Another has CVSS 9.8 with EPSS 0.2%. Which should most teams patch first?

  1. The 9.8, higher score always wins
  2. The 6.5 on KEV, because it's being exploited
  3. Neither until both have patches
  4. Whichever was published first
Show answer

The 6.5 on KEV, because it's being exploited. Confirmed exploitation beats a theoretical worst case.

2. What does EPSS estimate?

  1. How severe a vulnerability could be
  2. How many computers are affected
  3. How likely a vulnerability is to be exploited in the next 30 days
  4. How long a patch takes to install
Show answer

How likely a vulnerability is to be exploited in the next 30 days. CVSS scores how bad a bug could be; EPSS estimates the chance it's exploited in the next 30 days.

3. What does a CVE ID give you?

  1. A patch
  2. Proof it's being exploited
  3. A severity score
  4. A unique name for one public vulnerability
Show answer

A unique name for one public vulnerability. A CVE ID is a shared name so everyone means the same bug. Severity comes from CVSS, and exploitation from CISA's KEV list.

Answer them in the app to earn XP.

Next: Supply chain attacks →