How to Prioritize Patches Using CVSS, EPSS, and KEV

Here's the uncomfortable math of patching. Your scanner reports thousands of vulnerabilities. Your team can realistically remediate a few dozen per cycle. Something has to decide what moves first, and for most organizations that something is still a CVSS score - a number that describes how bad a vulnerability could theoretically be, and says nothing about whether anyone is actually attacking it.

That approach was already showing strain. In June 2026 it lost its most visible institutional backer. CISA issued Binding Operational Directive 26-04, which revoked the two directives that had governed federal vulnerability remediation for years - and in doing so, removed the requirement that federal civilian agencies use CVSS for prioritization at all.

If you build patch policy around CVSS thresholds, that deserves your attention. It does not, however, mean CVSS is dead. This guide covers what each of the three signals actually tells you, what changed in June, and a five-tier framework that reconciles the federal model with the CVSS-and-EPSS approach most private-sector teams already run.

New to the discipline? Start with our [Patch Management: The Complete Guide] for the full lifecycle.

The three signals, and the different questions they answer

The most common mistake in prioritization is treating these as three versions of the same number. They are not. Each answers a genuinely different question, and the value comes from the combination.

Patch prioritization is the process of ranking known vulnerabilities for remediation by combining severity, exploitation likelihood, confirmed exploitation, and asset exposure - so that limited remediation capacity is spent on the vulnerabilities most likely to cause real harm.

CVSS gives you impact. The Exploit Prediction Scoring System, maintained by FIRST, gives you a forward-looking probability. CISA's Known Exploited Vulnerabilities catalog gives you confirmed, evidence-backed exploitation. A vulnerability can score high on one and low on the others, and each of those combinations means something different for your queue.

What changed in June 2026

CISA issued BOD 26-04, "Prioritizing Security Updates Based on Risk," on June 10, 2026. It replaces flat, one-size-fits-all deadlines with a graduated model built on four binary variables:

1. Public exposure - is the vulnerable asset reachable from outside the network?
2. KEV status - is the CVE in the Known Exploited Vulnerabilities catalog?
3. Automatability - can an attacker automate every step of exploitation?
4. Technical impact - does exploitation yield total control of the system, or partial?

Those four binary variables produce sixteen combinations, mapped to five remediation tiers: three days with mandatory forensic triage, three days without, fourteen days, sixty days, and a deferral tier where the fix waits for the next system upgrade. CISA publishes its determinations for variables two through four via its Vulnrichment program, which means agencies only have to answer the exposure question themselves - and that turns out to be the hard one.

Three details matter more than the headline.

The CVSS mandate is gone. BOD 26-04 supersedes both BOD 22-01 (the KEV directive, November 2021) and BOD 19-02 (April 2019). It was BOD 19-02 that required CVSS-based prioritization for internet-accessible federal systems. With its revocation, that requirement no longer exists. CISA's implementation guidance says so directly. The underlying methodology has shifted toward Stakeholder-Specific Vulnerability Categorization, a decision-tree approach rather than a severity score.

Deferral is now explicitly permitted. BOD 22-01 had no mechanism for saying "not yet." Every KEV demanded action. BOD 26-04 allows vulnerabilities meeting none of the four criteria to wait for the next upgrade cycle. In CISA's own analysis at one large civilian agency, roughly 1% of vulnerability instances landed in the three-day tier while more than 60% qualified for deferral. The model is designed to concentrate effort, not expand it.

Patching alone is no longer considered sufficient at the top tier. For the highest-risk combination, agencies must also perform forensic triage - determine whether the system was already compromised before the patch went on. That is a meaningful admission: by the time something is KEV-listed and grants total control, applying the update may be closing a door the attacker already walked through.

The directive is binding only on Federal Civilian Executive Branch agencies. But BOD 22-01's KEV catalog became a global prioritization standard well beyond federal networks, and there is little reason to expect a different trajectory here. Agencies must be operating against the new timelines within 180 days of issuance, and FedRAMP has told cloud service providers that December 7, 2026 is the date to plan around.

So does CVSS still earn a seat?

Yes - but a smaller and more specific one than it currently occupies in most programs.

Start with what the federal model actually replaced. BOD 26-04's fourth variable, technical impact, is a coarse binary: total control or partial control. That is a simplification of what CVSS measures across confidentiality, integrity, and availability. CISA can afford the simplification because it is issuing one rule for hundreds of agencies. You are not. Inside a single organization, the difference between an availability-only flaw on a batch server and an integrity flaw on a payments system is exactly the kind of distinction you need to preserve, and CVSS base metrics still encode it.

Three practical reasons CVSS stays in the stack:

• Severity floor. A critical-impact vulnerability should not be indefinitely deprioritized just because the model currently rates exploitation as improbable. Probability estimates move; catastrophic impact does not.
• Contractual and regulatory reality. PCI DSS, many cyber insurance questionnaires, and a large share of customer security addenda still specify CVSS thresholds. A federal directive does not rewrite your contracts. See [Patch Management Compliance Requirements by Framework].
• Environmental metrics. CVSS v4's environmental scoring lets you adjust for your own deployment context the part of CVSS almost nobody uses, and the part that actually addresses the "CVSS ignores my environment" complaint.

The change is one of role. CVSS stops being the sort order and becomes a floor and a tiebreaker. Exploitation evidence sets the order.

Where EPSS fits - and the gap it fills in the federal model

Notice what is missing from BOD 26-04's four variables: any forward-looking signal. KEV is retrospective by design; CISA adds a CVE once there is evidence of exploitation. That evidence threshold exists for good reason, but it means KEV always lags the first wave.

EPSS is the layer that covers that lag. It estimates the probability of exploitation in the next thirty days, updates daily, and - since the v4 model went live in March 2025 - scores CVEs still sitting in the NVD backlog without an official CVSS score. A CVE can carry a high EPSS percentile weeks before CISA's evidence bar is met.

Two things trip teams up.

Probability and percentile are different signals, and you need both. Most CVEs are never exploited, so the distribution is heavily skewed - the median score sits well under 0.01. A raw probability of 0.15 sounds trivial but may place a CVE above 92% of all scored vulnerabilities. FIRST's own convention is to report both together: "15.3% (92nd)." Percentile thresholds also stay stable as the overall distribution shifts, which makes them the better basis for a written policy.

There is no authoritative threshold. A cutoff of 0.10 circulates widely, but FIRST is explicit that it carries no special standing. The right threshold is the one your remediation capacity can actually sustain - FIRST's coverage, effort, and efficiency framework exists precisely to help you calibrate that against your own throughput rather than borrowing someone else's number.

The trend line is often more informative than the value. A CVE that sat near zero for two years and jumped to 0.78 last week is telling you something a static threshold check will miss entirely. Build delta monitoring into your workflow, not just a nightly threshold query.

A five-tier framework that reconciles both models

This maps the federal logic onto signals you already have, with CVSS restored as a floor and EPSS filling the predictive gap. Calibrate the thresholds to your own capacity before adopting them.

Three rules make this hold together in practice.

Tiers are dynamic, not assigned once. A KEV addition promotes instantly. Taking an asset off the public internet demotes. If your process assigns a tier at scan time and never revisits it, you have built a snapshot, not a prioritization system.

Deferral must be documented deferral. Tier 4 is the tier that makes the rest affordable, and it is also the one that quietly turns into technical debt. Record why each item was deferred and what would change its tier. When an auditor or a board member asks why something sat for eight months, "it met none of four documented criteria and here is the review date" is a defensible answer. Silence is not.

Exposure is the variable you own. CISA hands agencies the answers to three of its four questions and leaves exposure to them, because no external party can know which of your assets are internet-facing. The same holds for you, and it is the input most likely to be wrong. An asset inventory that is a quarter stale makes every tier assignment downstream of it unreliable.

A worked example

Three vulnerabilities land in the same Tuesday scan.

CVE-A: CVSS 9.8, EPSS 0.02 (61st percentile), not in KEV, internal file server. The severity is alarming and the exploitation signal is not. Tier 3 - normal cycle, with a watch on the EPSS trend.

CVE-B: CVSS 7.5, EPSS 0.71 (98th percentile), not in KEV, public-facing web application. Lower severity, far higher likelihood, exposed asset. Tier 2, and realistically a Tier 1 candidate within days if the score keeps climbing. Under a pure CVSS sort, this sits below CVE-A. That inversion is the entire argument for the framework.

CVE-C: CVSS 8.1, KEV-listed, total control, internet-facing. Tier 0. Seventy-two hours, and a compromise assessment alongside the patch.

Most teams patch CVE-A first, because 9.8 is the largest number on the screen. CVE-C is the one already being used against someone.

Making it operational

A framework that requires manual evaluation of four to six variables across thousands of findings will not survive contact with a real backlog. The bridge from framework to practice is automation on three specific things.

Continuous exposure detection, not quarterly discovery. Tier assignment depends on knowing what is internet-facing today.

Automated enrichment. KEV status, EPSS score, EPSS delta, and CVSS vector should attach to every finding without anyone opening a browser tab. All three feeds are public and free.

Tier-driven deployment. Tier 1 and 2 need to bypass the normal change queue with pre-approved emergency windows. Tier 3 and 4 belong in scheduled rings. If everything routes through the same monthly change advisory board, your three-day tier is aspirational. See [Ring-Based Patch Deployment].

This is also where the honest constraint sits. The 2026 Verizon DBIR found that only 26% of KEV-listed vulnerabilities were fully remediated during 2025, down from 38% the year before, with the median time to full resolution rising to 43 days. Prioritization frameworks do not fix that on their own - they tell you which 26% should have been the 26%. Closing the remaining gap is a deployment capacity problem.

Trinetri EndpointOps connects the prioritization signals to the deployment side, pulling KEV and EPSS enrichment into the same console that pushes the patch, so the tier a vulnerability lands in determines how it gets deployed rather than sitting in a separate spreadsheet.

Four mistakes worth avoiding

Treating EPSS as permission to never patch. EPSS tells you when, not whether. A low-probability CVE is still a vulnerability, and deferring it forever is how backlogs become unmanageable.

Sorting by CVSS and calling it risk-based. Severity is one input. Sorting descending by a single static number is the thing the last five years of vulnerability research argued against.

Assuming BOD 26-04 applies to you. It binds federal civilian agencies. If you are a private organization, adopt the logic because it is sound, not because you are required to - and do not let a compliance-flavored framing paper over the fact that your actual obligations still reference CVSS.

Static tiers. Covered above, and it is the most common failure of all. Exploitation status changes daily. A prioritization model that does not is a ranking of last month's risk.

Where to start

If you are running CVSS-only prioritization today, the first move is not adopting all five tiers. It is adding two free data feeds - KEV status and EPSS score - to your existing findings and looking at how much your current queue order changes. For most teams the answer is: substantially. That single comparison usually makes the rest of the case internally without a slide deck.

For the full lifecycle context around this, see our [Patch Management: The Complete Guide], and for the deployment mechanics that turn a tier into a shipped patch, [Patch Management Best Practices].

---

FAQ (FAQPage schema)

Is CVSS still relevant after CISA BOD 26-04? Yes, but in a narrower role. BOD 26-04 revoked BOD 19-02, which removed the federal requirement to use CVSS for prioritization. CVSS remains useful as a severity floor, for regulatory and contractual obligations such as PCI DSS, and for environmental scoring within your own context. It is no longer a defensible primary sort order.

What is the difference between EPSS and KEV? KEV records confirmed exploitation that CISA has evidence for. EPSS predicts the probability of exploitation over the next thirty days. KEV is retrospective and authoritative; EPSS is forward-looking and probabilistic. A CVE can carry a high EPSS score well before it appears in KEV, which is precisely why the two are complementary.

What EPSS score should trigger immediate patching? There is no universal threshold, and FIRST is explicit that the commonly cited 0.10 carries no special authority. Most teams use percentile rather than raw probability - 95th percentile and above for accelerated treatment - and calibrate against remediation capacity using FIRST's coverage, effort, and efficiency framework.

Does BOD 26-04 apply to private companies? No. It is binding only on Federal Civilian Executive Branch agencies. CISA encourages broader adoption, and the framework is worth adopting on its merits, but private organizations have no compliance obligation under it. Federal contractors and cloud service providers should check their own flow-down requirements.

How many vulnerabilities should end up in the highest-urgency tier? Very few. In CISA's analysis at one large civilian agency, roughly 1% of vulnerability instances fell into the three-day category and over 60% qualified for deferral. If your top tier holds a large share of your backlog, your thresholds are miscalibrated and the tier has stopped functioning as a priority signal.