Severity Is Not Probability: Reading CVSS, EPSS, and KEV Together

A 7.8 That Was Predicted at Under One Percent and Already Exploited

Microsoft's September 2026 Patch Tuesday contained two zero-days, both local privilege escalations. One of them, CVE-2026-85880, a heap-based buffer overflow in the Windows Advanced Local Procedure Call subsystem, carried a CVSS base score of 7.8 (high) and, according to public tracking, an EPSS score below one percent. It was being exploited in the wild when Microsoft shipped the fix, and CISA added it to the Known Exploited Vulnerabilities catalog the same day.

Read those three data points together and they look contradictory. A "high" severity, not a "critical." A predicted exploitation probability that rounds to zero. And confirmed, active, in-the-wild exploitation. They are not contradictory. They are three instruments measuring three different quantities, and the discomfort you feel looking at them side by side is the whole point of this article. If you run vulnerability prioritization off any one of them alone, this is the case that burns you.

Three Scores, Three Questions

The single most useful habit in vulnerability management is to say out loud what question each score answers.

CVSS answers: if this is exploited, how bad is it? The Common Vulnerability Scoring System base score is a measure of intrinsic severity, built from the mechanics of the flaw: the attack vector, the complexity, the privileges required, and the impact to confidentiality, integrity, and availability. It is a property of the vulnerability itself. Crucially, the base score says nothing about whether exploitation is likely or occurring. A CVSS 10 can sit untouched for years, and a CVSS 5.3 can be the thing attackers actually use.

EPSS answers: how likely is this to be exploited in the next 30 days? The Exploit Prediction Scoring System, maintained by a special interest group at FIRST, is a machine-learning model that outputs a daily probability between 0 and 1 that a given CVE will be exploited in the wild within the following month. It is trained on observed exploitation and on features like the presence of public exploit code, vendor, and CVE characteristics. It is a forecast, and like any forecast it is probabilistic and it lags reality: it predicts from patterns, so a novel or narrowly targeted exploit that does not match historical patterns can be underweighted right up until it is used.

KEV answers: is this being exploited, yes or no? The CISA Known Exploited Vulnerabilities catalog is not a score at all. It is a binary, evidence-based assertion: CISA has reliable evidence that this vulnerability has been exploited in the wild. There is no probability and no severity ranking. Inclusion is the strongest signal in the set because it is not a prediction; it is an observation.

Severity, probability, observation. Once those are separated, CVE-2026-85880 stops being a paradox. Its impact if exploited is high (CVSS 7.8). Its exploitation was not something the statistical model saw coming (EPSS under one percent). And it was, in fact, exploited (in KEV). All three can be true at once because they were never answering the same question.

Where the Scores Disagree, and Why That Matters

The disagreements are not noise to be smoothed over. Each direction of disagreement is a distinct operational warning.

High EPSS, not in KEV. This is the model doing its job: flagging vulnerabilities that share the characteristics of things that get exploited, often because public exploit code exists, before confirmed exploitation shows up. This is the useful, actionable end of EPSS. It is a good input for prioritizing the enormous backlog of CVEs that are not yet in KEV.

Low EPSS, in KEV. This is CVE-2026-85880, and it is the dangerous direction. The model assigned a low probability and reality overrode it. Both September Windows zero-days fit here: they are local privilege escalations, a class that a probability model may underweight because it lacks the internet-facing, mass-scanned profile of a typical high-EPSS CVE, yet they are precisely the second-stage bugs targeted intrusions rely on. If your program had used a rule like "only remediate EPSS above some threshold," it would have deprioritized an actively exploited flaw. The lesson the FIRST guidance itself stresses is that EPSS is a complement to KEV, not a replacement: KEV always wins.

Low CVSS, in KEV. This is the mirror-image trap, and the September data is full of it. Sixteen of the roughly 150 CVEs added to KEV in 2026 are rated only medium severity. CVE-2026-56164, a SharePoint "missing authentication for critical function" flaw, scores just 5.3, and CVE-2026-20316, a hard-coded password in Cisco's Secure Firewall Management Center, also scores 5.3. Both are confirmed exploited. A program that triages by CVSS and stops at "critical and high" would never have scheduled either, and attackers were using them. Severity is a poor proxy for what gets attacked, because attackers optimize for usefulness and reliability, not for the number in the CVSS calculator.

The Two Failure Modes

Put plainly, there are two ways to misuse these scores, and most organizations are vulnerable to at least one.

The first is prioritizing by severity alone. This is the traditional "patch all the criticals" program. It over-invests in high-CVSS vulnerabilities that may never be exploited, and it systematically misses the medium-severity flaws that show up in KEV. It feels rigorous because it is sorting by a precise-looking number, but the number answers the wrong question. There are far more CVSS 9-and-10 vulnerabilities than any team can patch at once, and severity gives you no way to tell which of them attackers actually care about.

The second, newer failure mode is prioritizing by EPSS alone. As EPSS adoption has grown, some programs have swung to "only patch what the model says is likely," which is efficient right up until it deprioritizes a CVE-2026-85880. EPSS is a genuinely valuable tool for ordering the long tail, but it is a forecast with a known lag, and treating a low forecast as evidence of safety is treating the absence of a prediction as the presence of one. The model not seeing it coming is not the same as it not happening.

How to Read Them Together

The scores are designed to be layered, and the layering has a natural order that follows directly from the question each one answers.

Start with KEV as a non-negotiable. Anything in the catalog is confirmed exploited and should be remediated on the deadline regardless of its CVSS or EPSS. This is the top of the queue, full stop. It is also the smallest and most reliable list, which is what makes it a good place to anchor.

Use EPSS plus exposure to triage everything not in KEV. The overwhelming majority of CVEs are not in KEV and never will be, and you cannot patch all of them at once. This is where EPSS earns its place: combine a high EPSS probability with the fact that the asset is internet-facing and unauthenticated, and you have a defensible ordering for the backlog. EPSS is the right tool for the "what next, among the many" problem, not the "is this safe" problem.

Use CVSS to size the blast radius, not to gate the queue. Severity is most useful after you have decided something needs attention, to understand how bad exploitation would be and how much response to mount. It tells you whether a confirmed-exploited flaw yields SYSTEM or just an information leak. It is a magnitude, not a trigger.

Keep the exposure context in the loop. None of the three scores knows whether the affected system is reachable from the internet, whether it is authenticated, or whether it holds your crown jewels. A CVSS 10 on an isolated lab box and a CVSS 6.5 on an internet-facing identity provider are not close, and no scoring system will tell you that. Your asset inventory does.

What the September Data Teaches

The two Windows zero-days and the medium-severity KEV entries make the same argument from opposite directions. CVE-2026-85880 shows that a low EPSS does not mean safe. CVE-2026-56164 and CVE-2026-20316 show that a medium CVSS does not mean ignorable. In both cases the score that would have led you astray was the one being used as a filter, and the score that would have saved you was KEV, the one that is not a score at all but an observation.

That is the durable takeaway. CVSS, EPSS, and KEV are complementary because they answer severity, probability, and reality in turn, and each is excellent at its own question and misleading when pressed into another's. Use KEV to decide what is already burning, EPSS and exposure to decide what to reach for next, and CVSS to decide how hard to swing once you have picked something up. A program built that way would have patched a 7.8 that the model scored at under one percent, on the day it mattered, for the only reason that ultimately counts: it was actually being exploited.