As AI is getting better by the day, we're seeing vulnerabilities with CVSS scores of 9.0+ emerge almost daily. By the end of October 2026, 89,859 CVEs had been published this year versus 48,152 for the whole of 2025. October alone averaged 550 a day. FIRST lists AI-assisted vulnerability discovery as one of the main drivers. With security teams under an enormous amount of pressure, how does one prioritise multiple high prio patches?
In my Resource Exhaustion post I argued that most outages are really just queues. Vulnerability management is quite similar to that, it's a queue of findings and a fixed budget of engineer hours.
What does CVSS measure?
The CVSS base score describes the vulnerability in isolation. It measures the attack vector, complexity, privileges required, user interaction, and impact on confidentiality, integrity and availability. It's the standard way of rating a vulnerability on a 0-10 scale, the higher, the more severe it is.
CVSS measures severity, not how risky it is for you.
Environmental Requirements
The three questions you need to answer when prioritising vulnerabilities:
- Present: is the vulnerable software installed?
- If you have a scanner, it will link the software and the relevant CVE together, but it doesn't know the additional context required to asess it properly. Is the vulnerable part actually being used? For example, a library that is bundled in a container image, where your code never uses the vulnerable function.
- Exploitable somewhere: are attackers using it against anyone?
- CISA's Known Exploited Vulnerabilities (KEV) list covers bugs confirmed as attacked IRL. EPSS gives each CVE a calculated percentage chance of being exploited in the next 30 days.
- Exploitable here: could an attacker use the vulnerability against you right now?
- Is the vulnerable service reachable, is it configured in a way to reproduce the bug, are there any security layers that may prevent it from being exploited?
Two identical, reachable, actively exploited bugs most likely won't be equal if one is on a lab VM and the other is on a domain controller.
You don't need a perfect asset register to make this work, three tiers is enough: crown jewels (identity, payments, customer data), business systems, and then everything else.
With this, you can fill in the parts of CVSS that scanners leave blank. Exploit status (KEV, EPSS) goes into the Threat metric and asset tier and exposure go into the Environmental metrics. The result is CVSS-BTE, which is the score for your environment.
Example
| Finding | CVSS | Exploited? | Reachable? | Asset | Priority |
|---|---|---|---|---|---|
| RCE in internal app | 9.8 | No, low EPSS | Isolated VLAN | Tier 3 | Patch cycle |
| Auth bypass on VPN | 8.1 | On KEV | Internet-facing | Tier 1 | Urgent |
| ReDoS in API | 7.5 | Public PoC | Yes, no rate limits | Tier 2 | This week |
| Library CVE in image | 9.1 | No | Function never called | Tier 2 | Next rebuild |
You'll see how the 8.1 becomes your actual emergency and the 9.8 ends up as lower priority.
Actionable Items
- Enrich your scan: link KEV and EPSS into your findings, this is fairly easily done with scripting.
- Tag assets by tier: three tiers, done once, reviewed quarterly. Can be a custom field in your asset management system.
- Record exposure: internet-facing, internal or isolated. Check your firewall rules.
- Set SLAs on the combination, not the score!
- Document the deprioritised ones: As a point-in-time decision you will want to document your decision, in case you have to circle back to it later,
CVSS is a great starting point, but it's not meant to be used as the finish line.