How we score CVE risk

The Risk Priority number on each CVE page is a single 0–100 score that answers one question: how urgently should I act on this? It combines how likely the flaw is to be exploited (EPSS, and whether it is already exploited — CISA KEV), how easy it is to reach (from the CVSS vector: network vs. local, whether it needs privileges or user interaction), and how much damage it does (from the CVSS vector: the confidentiality, integrity and availability impact). It is a triage aid, not a substitute for your own environmental context.

The formula

We score urgency as certainty × reachability × blast–radius, then floor the result by severity so a dangerous CVE never sinks into the basement:

Certainty — is it actually being exploited? A CISA KEV listing means confirmed, so certainty is maxed. Otherwise we use the CVE’s peak EPSS (its highest predicted exploitation probability).
Reachability — how easy is it to trigger? Derived from the CVSS vector (attack vector, attack complexity, privileges required, user interaction). An unauthenticated, network-reachable bug scores high; a local bug that needs an existing account scores lower.
Blast–radius — how bad is the outcome? Derived from the CVSS vector’s confidentiality, integrity and availability impact, plus scope (does it break out of its security boundary?).
Severity floor — the score can never fall below a CVSS-based floor (Critical ≥ 70, High ≥ 55, Medium ≥ 35) or a peak-EPSS floor (≥ 0.5 → 80, ≥ 0.1 → 60), so a severe-but-dormant or likely-to-be-exploited CVE stays visible.

Why a known-exploited CVE isn’t automatically 100

An earlier version floored every CISA KEV CVE at 100 — which pinned more than 1,600 confirmed-exploited CVEs to the same top score, from a 5.5–severity local bug to a 10.0 unauthenticated remote takeover. That is not how a defender triages. Being on KEV now maxes certainty, but the final number still reflects reachability and blast–radius — so a known-exploited local privilege escalation lands around the low-to-mid 80s while a known-exploited unauthenticated network RCE reaches 100. Same KEV status, very different “drop everything” urgency.

Why “peak” EPSS, not current EPSS

EPSS is a daily prediction that rises and falls. A CVE that was once predicted highly likely to be exploited can see its score decay months later — and FIRST.org’s EPSS v4 rollout in September 2025 dropped initial scores for fresh CVEs by 4–6×. If we used the current score, an identical CVE published after that change would read as lower-risk than its 2024 peers purely because of a scale change. We therefore feed the composite the highest EPSS a CVE has ever reached. The score on display next to it is still the current EPSS; only the risk number uses the peak.

Why a floor

Reachability and blast–radius describe this CVE, but a genuinely severe or already-likely bug shouldn’t read as low-risk just because it hasn’t been weaponised yet. The severity and peak-EPSS floors guarantee that: a Critical-severity CVE can never read below 70, and a CVE whose predicted exploitation once crossed 50% is floored at 80 — regardless of the other signals. (What we removed was the flat KEV floor of 100; see above.)

Worked examples

Scenario	CVSS	Vector	peak EPSS	KEV	Risk
Critical, not yet exploited	9.8	network, unauth	0.002	no	70
Known-exploited local priv-esc	7.8	local, needs privileges	0.05	yes	78
Known-exploited local priv-esc, high CVSS	9.1	local, scope-changed	0.10	yes	84
Known-exploited unauthenticated network RCE	10.0	network, unauth, scope-changed	0.90	yes	100
High predicted exploitation, not KEV	8.8	network, unauth	0.85	no	95
Low severity, no exploit signal	4.3	limited impact	0.001	no	35

Notice the two known-exploited local bugs (78 and 84) rank below the known-exploited unauthenticated network RCE (100) — identical KEV status, but the vector tells you which one to patch tonight.