CVE vs CVSS
CVE names a flaw. CVSS scores a severity model. EPSS estimates exploit likelihood. KEV records known exploitation. Your triage joins all four to exposure and asset value.
CVE (Common Vulnerabilities and Exposures) is an identifier, not a risk rating. One CVE can cover several products or versions; two CVEs can be the same underlying bug under different CNAs. When a wire says 'critical Adobe Commerce flaw', pin the CVE id, the vendor advisory, and the fixed build before you open a change ticket.
CVSS (Common Vulnerability Scoring System) is a 0–10 score plus a vector (attack vector, privileges, user interaction, scope, CIA impact). Prefer the vector over the headline number. A local privilege escalation with UI:R is not the same problem as an unauthenticated network RCE with the same base score. Vendor 'urgency' labels and CVSS 4.0 scores can diverge from NVD CVSS 3.1 — record which scorer you used.
EPSS estimates the probability of exploitation in the wild in the next 30 days. It is a forecast, not evidence. CISA KEV is evidence: the flaw is known exploited (federal BOD deadlines apply to US civilian agencies; Australian operators still treat KEV as an exploited-first signal). ASD's Essential Eight and ISM patching guidance prioritise internet-facing and high-impact applications — KEV and active exploitation sit above raw CVSS for those assets.
A 9.8 on an air-gapped printer driver is not your week. A 7.5 on an internet-facing gateway that is in KEV, or that WA SOC / ACSC has flagged for Australian exposure, is. Mathspace's 2026 Metabase delay and StyleSmuggler on Magento stores show the same pattern: the CVE was public; the operational failure was intake latency on an internet-reachable stack that held personal information.
Practitioner intake: (1) identify CVE + vendor advisory URL + fixed version; (2) ask exploited? (KEV / national CERT / reliable wire); (3) ask exposed? (internet-facing, partner-reachable, holds personal information); (4) ask worth? (crown jewel, regulated, hard to restore); (5) decide patch / mitigate / accept-with-expiry and write the evidence (received time, decision, change ticket, build installed, post-patch hunt). CVSS alone is a sorting hat for auditors — not a patch calendar.
Related desk pages: Critical advisory intake, Vulnerability management, CISA KEV, Essential Eight, NDB clock. When the desk publishes a vuln card it splits published_at (disclosure) from last_verified (this pass) so you can see freshness separately from the vendor publish date.