Monday morning. Your security scanner reports hundreds of vulnerabilities. Dozens are marked critical. Your team can fix maybe ten this week. Which ten?

The answer is hidden in three labels that look alike and mean very different things.

CVE: the name tag

A CVE is just an ID, like CVE-2026-12345. The CVE Program catalogs publicly disclosed vulnerabilities, with one record for each vulnerability. Its job is coordination: making sure everyone is discussing the same issue.

A CVE tells you nothing about how bad something is. It's a name, not a verdict.

CVSS: the severity score

CVSS gives a vulnerability a score from 0 to 10, based on things like how it can be reached and what an attacker could do with it. It's useful. It's also the most misused number in security.

FIRST, the organisation that maintains CVSS, says it plainly: CVSS measures severity and should not be used alone to assess risk. A real risk assessment also weighs exposure and threat. A 9.8 on a system that isn't reachable from the internet may matter less than a 7.5 on your login page.

KEV: the alarm bell

This is the one most teams underuse. CISA, the US cyber defence agency, keeps the Known Exploited Vulnerabilities catalog: its authoritative source of vulnerabilities exploited in the wild. Every entry means attackers have actually used that flaw, not just that they could.

When we checked, the catalog held 1,766 entries. That sounds like a lot, but it's a small slice of all known vulnerabilities, which is exactly why it's useful.

US federal agencies must fix these by set deadlines. Everyone else isn't bound, but CISA says private organisations can significantly strengthen their security by prioritising KEV entries too.

Putting them together

Here's our suggested order for that Monday list:

  1. Anything in KEV that you run, especially if it's internet-facing. Someone is already using it.
  2. High-severity flaws on exposed systems. Your CVSS score, adjusted for what you actually expose.
  3. Everything else, on your normal patch cycle.

CISA frames KEV as one input to your prioritisation, not the whole answer. But if you only change one habit, make it this: check KEV before you sort by score.

The question to ask your vendors

When a supplier tells you a vulnerability is only medium severity, ask whether it's in KEV. Medium severity and actively exploited is a worse combination than critical and theoretical.

Sources