> ## Content Index
> Fetch the complete content index at: https://thecyberstories.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# CVE, CVSS, KEV: the three labels that decide what to patch first
- URL: https://thecyberstories.com/cve-cvss-kev-explained-2/
- Published: 2026-11-03T02:41:57.000Z
- Updated: 2026-11-03T04:07:30.000Z
- Description: Security advisories arrive covered in acronyms. Three of them do most of the work: CVE names a flaw, CVSS rates how severe it is, and KEV tells you attackers are already using it. Mixing them up is how teams patch the wrong thing first.
- Author: Raja Sekhar Thota
- Tags: Incidents, #csv-6ae94e64832c7bcae925b883, #Import 2026-11-03 16:27

Monday morning. Your security scanner reports hundreds of vulnerabilities. Dozens are marked critical. Your team can fix maybe ten this week. Which ten?

The answer is hidden in three labels that look alike and mean very different things.

## CVE: the name tag

A CVE is just an ID, like CVE-2026-12345\. The CVE Program catalogs publicly disclosed vulnerabilities, with [one record for each vulnerability](https://www.cve.org/About/Overview?ref=thecyberstories.com). Its job is coordination: making sure [everyone is discussing the same issue](https://www.cve.org/About/Overview?ref=thecyberstories.com).

A CVE tells you nothing about how bad something is. It's a name, not a verdict.

## CVSS: the severity score

CVSS gives a vulnerability a score from 0 to 10, based on things like how it can be reached and what an attacker could do with it. It's useful. It's also the most misused number in security.

FIRST, the organisation that maintains CVSS, says it plainly: CVSS measures severity and [should not be used alone to assess risk](https://www.first.org/cvss/v3.1/user-guide?ref=thecyberstories.com). A real risk assessment also weighs [exposure and threat](https://www.first.org/cvss/v3.1/user-guide?ref=thecyberstories.com). A 9.8 on a system that isn't reachable from the internet may matter less than a 7.5 on your login page.

## KEV: the alarm bell

This is the one most teams underuse. CISA, the US cyber defence agency, keeps the Known Exploited Vulnerabilities catalog: its [authoritative source of vulnerabilities exploited in the wild](https://www.cisa.gov/known-exploited-vulnerabilities-catalog/reducing-significant-risk-known-exploited-vulnerabilities?ref=thecyberstories.com). Every entry means attackers have actually used that flaw, not just that they could.

When we checked, the catalog held [1,766 entries](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?ref=thecyberstories.com). That sounds like a lot, but it's a small slice of all known vulnerabilities, which is exactly why it's useful.

US federal agencies must fix these by set deadlines. Everyone else isn't bound, but CISA says [private organisations can significantly strengthen their security by prioritising KEV entries too](https://www.cisa.gov/known-exploited-vulnerabilities-catalog/reducing-significant-risk-known-exploited-vulnerabilities?ref=thecyberstories.com).

## Putting them together

Here's our suggested order for that Monday list:

1. **Anything in KEV that you run, especially if it's internet-facing.** Someone is already using it.
2. **High-severity flaws on exposed systems.** Your CVSS score, adjusted for what you actually expose.
3. **Everything else,** on your normal patch cycle.

CISA frames KEV as [one input to your prioritisation](https://www.cisa.gov/known-exploited-vulnerabilities-catalog/reducing-significant-risk-known-exploited-vulnerabilities?ref=thecyberstories.com), not the whole answer. But if you only change one habit, make it this: check KEV before you sort by score.

## The question to ask your vendors

When a supplier tells you a vulnerability is only medium severity, ask whether it's in KEV. Medium severity and actively exploited is a worse combination than critical and theoretical.

## Sources

- [About the CVE Program (CVE.org)](https://www.cve.org/About/Overview?ref=thecyberstories.com)
- [CVSS v3.1 User Guide (FIRST)](https://www.first.org/cvss/v3.1/user-guide?ref=thecyberstories.com)
- [Reducing the significant risk of known exploited vulnerabilities (CISA)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog/reducing-significant-risk-known-exploited-vulnerabilities?ref=thecyberstories.com)
- [Known Exploited Vulnerabilities Catalog (CISA)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?ref=thecyberstories.com)