Vulnerability management

Patch what is exploited, not what scores loudest

A scanner that sorts by CVSS gives you a list ordered by how bad each vulnerability could be in the worst case. That is a different question from which one is being used against people this week — and with a backlog you cannot clear, the second question is the one that matters.

Written by a network security engineer · last reviewed 20 August 2026

Three scores, three different questions

Signal	Answers	Does not answer
CVSS FIRST	How severe is this if exploited? Attack vector, complexity, privileges required, impact.	Whether anyone is exploiting it. Whether you are exposed.
CISA KEV catalogue	Has exploitation of this been observed in the wild? Binary — it is in the catalogue or it is not.	How likely the ones not listed are. Absence is not evidence of safety.
EPSS FIRST, updated daily	Probability of exploitation activity in the next 30 days, as a number between 0 and 1.	Severity. A high-probability, low-impact bug still scores high.

None of the three is a priority on its own. CVSS alone gives you a backlog sorted by hypothetical worst case. KEV alone is a short list that misses everything not yet catalogued. EPSS alone will rank a noisy low-impact bug above a quiet catastrophic one.

An order that survives contact with a real backlog

In KEV and present in your inventory. Confirmed exploitation, confirmed exposure. Nothing else competes with this tier.
High EPSS and high CVSS. Likely to be attacked, serious if it is.
High EPSS, lower CVSS. Will probably be attacked. Often the entry point rather than the objective — which is exactly how intrusions start.
High CVSS, low EPSS. Serious but nobody is using it. Schedule it; do not drop everything.
Everything else. Normal patch cycle.

The step that changes the numbers most is not scoring — it is inventory. A CVE in a package you do not run is not a vulnerability, it is noise. Most teams' backlogs shrink dramatically the first time the CVE list is matched against what is actually installed and actually reachable.

A failure mode worth knowing about

I hit this in my own code, and it is the kind of bug that produces a confident wrong answer rather than an error.

Ask an exploit-prediction API for six hundred CVEs in one request and it answers with the first page. The CVEs that were never returned are not marked missing — if your code treats "not in the response" as "score is zero", they are read as harmless. Then the zero gets cached, so the mistake does not disappear on the next scan. It hardens.

A small inventory never shows this, because a small inventory fits in one page. It appears exactly where prioritisation matters most.

Three rules that prevent it, in any tool you build or buy. Paginate, then assert you got back what you asked for. Keep "the score is zero" and "no answer came" as distinct states. Never cache the second one.

Worth checking in whatever you currently use: pick a CVE you know has a non-trivial EPSS score, confirm your tool shows it, then run a scan with a much larger inventory and check the same CVE again.

Patchlight

Matches CVEs against your actual inventory and ranks them by KEV, EPSS and CVSS together. Single Go binary, SQLite, embedded UI. No telemetry.

Run it

Grab the tarball and SHA256SUMS from the releases page, then:

sha256sum -c SHA256SUMS
tar -xzf patchlight-free-*-linux-amd64.tar.gz
./patchlight
# dashboard on http://127.0.0.1:8425 — add your inventory

Source on GitHub Other Hexward tools

Honest limits

It reaches out to fetch KEV and EPSS data — that is the one place a Hexward tool talks to the internet, and it is the public feeds, not me. Everything else stays local, and there is no telemetry.
It ranks; it does not patch. No agent, no deployment, no orchestration.
Inventory quality decides output quality. Feed it a stale asset list and you will get a confident ranking of the wrong things.
EPSS is a probability model, not a prediction. A low score is not a guarantee, and treating it as one is how you get surprised.

Related: attack surface discovery — because the host you forgot to decommission is not in the inventory you are scanning.