Operational guidance, not legal advice. This page distills named public sources (regulator guidance and industry practice). It is not a legal determination, not a notification decision, and not a substitute for your counsel, insurer, or a retained DFIR firm. Verify applicability and current deadlines for your facts and jurisdiction.
How should you prioritize vulnerabilities for remediation?
Updated
A defensible triage order checks confirmed exploitation (CISA KEV) first, then exploitation probability (FIRST EPSS) and asset exposure, treating CVSS severity as one input, not the sole sort key. CISA's SSVC offers a structured alternative. Not legal advice; it does not determine that any framework applies to YOU.
How-to-prioritize guide, last verified 10 September 2026 against CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) guide, FIRST's Exploit Prediction Scoring System (EPSS), CISA's Known Exploited Vulnerabilities (KEV) catalog, and NIST Special Publication 800-40 Revision 4. It is not legal advice, not an audit, and not a substitute for your own risk judgment.
This is a triage order, not YOUR SLA
Audience: a security lead or engineering manager staring at a backlog of hundreds of findings and needing a defensible order to work through it. This page is not legal advice. It does not start a clock. Reading it does not start a clock. This product does not patch YOUR estate — a named human still decides the actual order for a specific finding on a specific asset.
The problem with sorting by CVSS severity alone is distributional: a large estate routinely carries hundreds of high-or-critical findings, more than any team clears in a quarter, so a severity-only sort produces a list nobody finishes and an arbitrary order within each severity band. Layering confirmed exploitation and exploitation probability on top of severity turns an unworkable list into a short, defensible queue.
- A dedicated what-is-vulnerability-management pillar is not on this site yet. Naming it is not a link. The what-is-KEV guide on this site is the live directive-status page. The vulnerability-remediation-SLAs guide and the how-ShipReadyMetrics-prioritizes-risk guide on this site are live siblings.
Triage order as an accessible table
The table below is a decision order, not a JavaScript widget — read it top to bottom as a checklist for each finding. Reaching 'yes' at any row places the finding in that tier; stop there and move to remediation planning rather than continuing down the table. This is an SRM-recommendation informed by CISA's and FIRST's published guidance, not a quotation from any single named framework, unless the row says otherwise. Last verified 10 September 2026. Not legal advice.
- This table is a starting order, not a mandate from any named framework. CISA's own SSVC guide uses a different, more granular decision-tree structure — see the comparison table below.
- Re-triage, don't set-and-forget: KEV additions, EPSS score changes, and exposure changes (a system newly connected to the internet, or removed from it) should re-trigger this table for affected findings.
| Step | Question | If yes | If no, continue to |
|---|---|---|---|
| 1 | Is the CVE on the CISA KEV catalog — confirmed, evidenced active exploitation? | Highest tier. Treat as an emergency-remediation candidate regardless of CVSS score. The zero-day / emergency-response guide on this site covers the fastest path. | Step 2 |
| 2 | Is the affected asset publicly exposed (internet-reachable, unauthenticated or lightly authenticated)? | Continue to step 3 with exposure noted as a risk-raising factor. | Continue to step 3 with exposure noted as a risk-lowering factor, not a reason to skip triage entirely. |
| 3 | Does the CVE have a high FIRST EPSS score (a high estimated probability of exploitation in the next 30 days)? | High tier if also publicly exposed; medium-high tier if not. Schedule remediation ahead of same-severity findings with low EPSS. | Step 4 |
| 4 | Is the CVSS base score critical or high, and does the finding sit on a business-critical or sensitive-data-handling asset? | Medium tier. Schedule remediation within the program's standard SLA window for that severity and exposure combination. | Step 5 |
| 5 | Is the CVE on an asset with no internet exposure, low EPSS, and not KEV-listed? | Lower tier. Schedule for the next regular patch cycle rather than off-cycle emergency work. | Re-run this triage when any input changes — a newly exposed asset, a new KEV addition, or a rising EPSS score. |
CVSS-only versus SSVC versus EPSS-informed
Three named approaches, compared on the criteria each one actually uses. None of the three is a legal requirement for a private-sector organization; CISA states SSVC and KEV as guidance it encourages, not a mandate outside the FCEB-agency-specific BOD 26-04 timelines. Last verified 10 September 2026. Not legal advice.
| Approach | Stated criteria | Kind of text | Main limitation |
|---|---|---|---|
| CVSS-only | Sort strictly by CVSS base severity score, patch criticals first, then highs, then mediums. | Common industry practice, not itself a named framework requirement. CVSS is a FIRST specification; using it as the sole sort key is a choice this page and CISA's own guidance both caution against. | Ignores exploitation status and asset exposure entirely. Produces an unworkable, arbitrarily ordered severity band when hundreds of findings share the same score. |
| CISA SSVC (Stakeholder-Specific Vulnerability Categorization) | A structured decision tree evaluating exploitation status, technical impact, automatability, and mission/well-being impact, producing one of four outcomes: Track, Track*, Attend, or Act. | CISA framework guidance, published November 2022 and offered for voluntary adoption. Not a legal mandate outside the FCEB-specific BOD 26-04 remediation timelines, which state they draw on SSVC's methodology. | Requires assessing mission-prevalence and safety-impact decision points per organization — more setup than a single sort key, and CISA's public decision tree is generic rather than pre-tuned to your specific environment. |
| EPSS-informed (layered with KEV and CVSS) | Rank by a combination: KEV status first, then EPSS probability, then CVSS severity and asset exposure — the approach the triage table above uses. | SRM-recommendation, built from published FIRST and CISA signals. Not itself a single named framework's mandated formula. | EPSS is a population-level probability, retrained daily; it does not know your specific asset's exposure, and a low score is not a guarantee, only a lower estimated probability. |
Framework guidance versus best practice versus SRM-recommendation
The table below distinguishes what CISA's SSVC actually is (a named framework offered as guidance), from general best practice, from this page's own recommendation where no single source states the specific rule. Last verified 10 September 2026. Not legal advice.
| Text | What it is | What this page does not do |
|---|---|---|
| CISA SSVC Guide (published November 2022) and SSVC Calculator | CISA framework guidance — a decision-tree methodology, offered for voluntary use by any stakeholder, not a private-sector legal mandate. | Does not require YOU to adopt SSVC. Does not run YOUR SSVC assessment. |
| FIRST EPSS | A published, continuously retrained statistical model. Not a regulation, not a framework mandate. | Does not tell you the probability for YOUR specific asset's exposure — only the population-level probability for that CVE. |
| CISA KEV catalog | CISA guidance for most organizations; binding only on FCEB agencies under current CISA Binding Operational Directive 26-04. The what-is-KEV guide on this site is that distinction in full. | Does not bind private-sector organizations. Does not start a remediation clock for YOU unless you are an FCEB agency. |
| NIST SP 800-40 Revision 4 | NIST guidance on enterprise patch management planning, including defining risk-response scenarios by maintenance group. | Does not mandate any specific triage order. Its risk-response-scenario concept informs this page's triage table, but is not quoted as a rule. |
| The triage table and CVSS/SSVC/EPSS comparison on this page | SRM-recommendation — this page's own synthesis of the above, not a quotation from a single named framework. | Does not claim to be a mandate. Use it as a starting order, then adapt to your own asset context. |
What to do now
As of last verification on 10 September 2026, none of the named sources above has changed. The list below is operational, not a determination that any framework applies to YOU.
- Pick one triage order — the table above, SSVC, or your own variant — and write it down, so 'why did we fix this before that' has a repeatable answer instead of an ad hoc one during a busy week.
- Layer signals rather than replacing one with another: KEV for confirmed exploitation, EPSS for probability, CVSS for potential impact, and your own exposure assessment for context. No single signal answers the whole question.
- Re-run triage when inputs change, not only at intake. A finding's KEV or EPSS status is not fixed at discovery time.
- If you are an FCEB agency bound by CISA BOD 26-04, read that directive's own Table 1 directly for your mandated timelines — this page's triage table is a general-purpose starting order, not a substitute for that directive.
Where this shows up in ShipReady Metrics
Signed-in app → Security → Findings ranks vulnerabilities ingested from connected scanners (Dependabot, code scanning, secret scanning, DAST, and first-party SAST where configured) using KEV status, FIRST EPSS score, and CVSS severity together, with cross-source deduplication so the same underlying vulnerability reported by two tools counts once, and transitive-npm blast-radius analysis to identify which repositories actually resolve an affected package version through their lockfiles.
The product's ranking logic is a documented method, not a claim to reproduce CISA's SSVC decision tree or CISA BOD 26-04's FCEB-specific remediation tiers exactly. It surfaces the signals; it does not set your SLA policy, does not assign an owner, and does not patch YOUR estate. A named human still owns the final triage decision.
This page does not document a public demo URL. There is no public vulnerability-management demo path.
Primary sources (last verified 10 September 2026)
Every claim on this page is taken from one of these. CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) Guide (published November 2022) and SSVC Calculator; FIRST's Exploit Prediction Scoring System (EPSS); CISA's Known Exploited Vulnerabilities (KEV) catalog; NIST Special Publication 800-40 Revision 4 (Guide to Enterprise Patch Management Planning, 2022). These are not a complete world list. Not legal advice.
The what-is-KEV guide on this site is the current-directive page. The vulnerability-vs-exploit-vs-risk guide on this site covers what each signal does and does not tell you. The vulnerability-remediation-SLAs guide and the how-ShipReadyMetrics-prioritizes-risk guide on this site are live siblings. A dedicated what-is-vulnerability-management pillar is not on this site yet. Naming it is not a link.
Frequently asked questions
Should we sort our backlog by CVSS score alone?
No. CVSS-only sorting ignores whether anyone is actually exploiting a vulnerability and whether your specific asset is exposed. Combine CVSS with confirmed exploitation (CISA KEV) and exploitation probability (FIRST EPSS), plus your own exposure assessment, as the triage table on this page walks through.
Is CISA's SSVC framework mandatory for us?
No, not for private-sector organizations. SSVC is CISA guidance offered for voluntary adoption by any stakeholder. It becomes part of a binding requirement only for US federal civilian executive branch agencies, where CISA Binding Operational Directive 26-04 states its FCEB remediation timelines draw on SSVC's methodology.
What is the difference between the triage table on this page and SSVC?
The triage table on this page is an SRM-recommendation — a simplified, general-purpose ordering built from published KEV, EPSS, and CVSS signals. CISA's SSVC is a more formal, named decision-tree framework with its own defined decision points (exploitation status, technical impact, automatability, mission and well-being impact) and four possible outcomes. Either can work; they are not the same methodology.
Does a low EPSS score mean a vulnerability is safe to leave unpatched?
No. EPSS estimates population-level exploitation probability over the next 30 days; it is not a guarantee for your specific instance, and it changes over time as the model is retrained daily. A low score lowers priority relative to higher-scored findings; it does not eliminate the underlying vulnerability or justify leaving it permanently unpatched.
Does ShipReady decide our final remediation order for us?
No. Signed-in Security → Findings ranks vulnerabilities using KEV, EPSS, and CVSS together with cross-source deduplication and blast-radius analysis, but a named human still makes the final triage call for each finding, sets the SLA policy, and owns any exception. The product surfaces signals; it does not patch your estate.
Published by ShipReady Metrics, an evidence-based technology and compliance intelligence platform. This guide is educational and vendor-neutral.