A quarterly scan returns 11,400 findings, 2,100 of them rated High or Critical. The infrastructure team can safely patch perhaps 300 systems a month. Sorting by CVSS score and starting at the top feels objective, but it can mean spending the month on a 9.8 in an isolated test lab while an actively exploited 7.8 on a domain controller waits its turn.
On the CompTIA Security+ SY0-801 exam, prioritization sits under objective 2.1, which expects you to know that a severity score is only one input to deciding what gets fixed first. This lesson covers why CVSS alone misleads, the evidence and context that should move a finding up or down, and a worked example that ranks five findings the way a working analyst would. The day-to-day workflow of scanning, validating, remediating, verifying and reporting is covered in the vulnerability management section.
A CVSS score measures severity, not your risk
A CVSS base score describes a flaw in a generic deployment. It doesn't know whether your system faces the internet, what data it holds, whether attackers are using the flaw right now, or whether a firewall rule already blocks the vulnerable port. FIRST's own specification says CVSS measures severity and should be combined with other information to assess risk.
Two facts about the vulnerability landscape make this matter. First, a large share of new CVEs score 7.0 or higher, so "patch every High and Critical" produces a list most teams can never finish. Second, only a small fraction of published CVEs are ever seen exploited in the wild; studies commonly put it in the single-digit percentages. Prioritization is the work of finding that fraction in your environment and fixing it first.
The factors in this lesson map onto the risk model from earlier in the section. Exploitation evidence and exposure raise or lower likelihood. Asset criticality and data sensitivity raise or lower impact. Compensating controls reduce one or both. The CVSS environmental metric group exists to capture some of this, but most teams apply the factors directly.
Evidence of exploitation moves a finding to the front of the line
The strongest single signal is proof that attackers are already using a vulnerability.
CISA's Known Exploited Vulnerabilities (KEV) catalog lists CVEs with reliable evidence of exploitation in the wild and a clear remediation action. Each entry has a due date and notes whether the flaw is known to be used in ransomware campaigns. Under Binding Operational Directive 22-01, issued in 2021, U.S. federal civilian agencies must fix KEV entries by those dates. Everyone else can use the catalog as a free, high-signal priority list: it holds well over a thousand entries out of hundreds of thousands of published CVEs, and many scanners tag KEV findings automatically. Some commercial intelligence vendors maintain their own known exploited vulnerability catalogs, often with wider coverage.
The Exploit Prediction Scoring System (EPSS), also from FIRST, looks forward instead of back. It gives each CVE a probability between 0 and 1 that exploitation activity will be observed in the next 30 days, recalculated daily from data such as public exploit code, vulnerability traits and observed attack traffic. An EPSS score of 0.92 means an estimated 92 percent probability, while most CVEs score far lower, often under 1 percent. EPSS also reports a percentile, so you can see, for example, that a score ranks above 99 percent of all scored CVEs.
Exploit availability fills the gap between the two. A public proof of concept or a module in a widely used penetration testing framework raises likelihood before any catalog lists the flaw, and CVSS records it in its temporal (in 4.0, threat) metrics.
A useful way to keep these straight: KEV says it has happened, EPSS says how likely it is to happen soon, and CVSS says how bad it would be in general. Some organizations combine signals in a decision tree such as SSVC (Stakeholder-Specific Vulnerability Categorization), which CISA uses. It weighs exploitation status, automatability, technical impact and mission and well-being impact to reach one of four outcomes: Track, Track*, Attend or Act.
On the exam, when a question asks which vulnerability to fix FIRST and one option is described as actively exploited or listed in KEV, that is usually the answer, even if another option has a higher CVSS score.