iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A Critical severity rating does not tell you whether a vulnerability is being exploited, and it does not tell you whether the flawed code is present or reachable in your environment. The popular claim that most Critical vulnerabilities are never exploited cannot be verified as written. No primary source establishes a percentage for the Critical subset, and nothing in the available evidence supports the word “never.” What the evidence does support is a more useful split: technical severity, the likelihood that attackers will use a flaw, and the consequences in your own deployment are three separate questions. Closing the gap between a static finding (a package version listed in a manifest or image) and the runtime facts that determine risk is what makes patch prioritization work.
What the “most are never exploited” claim can and cannot support
The closest official statement comes from NIST. In CSWP 41, Peter Mell of NIST and Jonathan Spring of CISA write:
“Only a small fraction of the tens of thousands of software and hardware vulnerabilities that are published every year will be exploited.”
Recommended Free Tools
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
That is a qualitative statement about published vulnerabilities as a whole. It is not a measured share of Critical ones. It also cannot support “never”: an observation window can show that exploitation has not been recorded so far, but it cannot show that a flaw will never be exploited. NIST CSWP 41 is the primary source for this wording.
#1 Best Overall
The accurate version of the headline is narrower. A Critical rating says little on its own about whether a specific flaw is being used by attackers now, or whether it will be soon, or whether the affected code runs in your systems. Those answers come from evidence that severity does not contain.
Three questions that severity and exploitation data answer separately
Each common prioritization signal answers a different question. Treating any one of them as the answer to all three is the most frequent source of misplaced urgency.
| Signal | What it answers | What it cannot establish |
|---|---|---|
| CVSS severity | How serious the vulnerability is technically. On the CVSS v3.x qualitative scale, Critical covers base scores from 9.0 to 10.0. | Whether anyone is exploiting it, or whether the affected component is deployed, reachable or exposed in your environment. |
| CISA KEV | Whether CISA lists the vulnerability as known to be exploited in the wild. | Whether your systems are affected or exposed. Absence from the catalog is a weaker signal than presence. |
| EPSS | An estimated probability of exploitation in the wild over the next 30 days. | Whether the vulnerable component is present or reachable in a specific deployment, or how much damage exploitation would cause. |
| Deployment context | Whether the component is in use, reachable through the deployed configuration, exposed to untrusted users or networks, and important to the business. | Anything beyond the quality of your inventory, configuration visibility and the context your team or tooling collects. |
CISA KEV: a strong signal that points one way
The Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilities that CISA knows to have been exploited in the wild, and CISA updates it continuously. The catalog’s own page states:
Rank #2
“Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.”
A KEV listing is a strong reason to move a finding up the queue. A missing listing means only that CISA has not added the flaw to the catalog. The limits of that absence are covered in the workflow below.
EPSS: a dated probability, not a confirmation
FIRST’s Exploit Prediction Scoring System (EPSS) estimates the likelihood that a vulnerability will be exploited in the wild over the next 30 days. According to FIRST’s “Why EPSS?” page, the model combines several signal types: exploitation telemetry, threat intelligence, exploit code availability, the language of the vulnerability description, product characteristics and weakness classifications. That page gives an approximate count of about 2,800 features. As of October 2026, that is FIRST’s published figure; the model’s methodology may change, so check the current page before citing the number. FIRST’s EPSS overview describes the scores as freely published, and its EPSS papers and evaluations page lists the original 2021 peer-reviewed paper and later evaluations.
EPSS forecasts the population of vulnerabilities, not the state of your systems. A high score does not mean your server runs the vulnerable code. A low score does not mean a flaw is harmless if an attacker can reach it from the internet.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Why static findings and runtime risk diverge
Most software composition analysis (SCA) and vulnerability scanners start from static evidence. A dependency appears in a lockfile, a package list or a container image at a particular version, and that version matches an advisory. This establishes that the vulnerable artifact is present somewhere in the build or image. It does not establish the three facts that usually decide risk:
- Whether the code path containing the flaw is ever executed.
- Whether untrusted input can reach that path in the deployed configuration.
- Whether the asset is exposed externally, or holds data or privileges an attacker would gain by compromising it.
That mismatch is the static-to-runtime context gap, and it produces two opposite errors. A finding can be present but unreachable: the package sits in the image, but the vulnerable function is never called or is disabled by configuration. The reverse also happens. A component can be missing from an inventory yet still ship, because the scanner did not parse a bundled copy or a particular image layer.
Reachability analysis tries to close this gap. There is not yet an established, universal definition of runtime reachability, so the quality of reachability evidence varies by tool and by the configuration data available to it. Treat a tool’s “not reachable” result as a lead to verify, not a verdict.
A workflow for deciding what to fix first
- Confirm the component is present in what actually runs. Check the exact package and version in the deployed artifact or host, not only the source manifest, and record where it appears.
- Map reachability in the deployed configuration. Ask whether the vulnerable functionality is loaded, enabled and callable with input an attacker can influence.
- Classify the asset. Determine whether the component is internet-facing, internal only, or behind authentication, and what data or privileges a compromise would reach.
- Check KEV. Search the CVE in the CISA KEV catalog. A listing is strong evidence of known exploitation.
- Check the current EPSS score. Use it as a near-term likelihood estimate and record both the score and the date you read it, because scores change.
- Estimate impact and fix options. Consider what an attacker could do after exploiting the flaw, and whether a vendor fix, a configuration change or a compensating control is available.
- Decide and document. Set the timeline from the combined picture, and record the reasoning so a later reviewer can see why a Critical item was scheduled, deferred or closed.
Do not label a finding safe only because it is absent from KEV or has a low EPSS score. Neither source establishes that exploitation is impossible, and neither measures whether the vulnerable code runs in your environment.
Worked patterns for common Critical findings
These patterns illustrate how the steps combine. They are reasoning examples, not a standard or a tested outcome.
Best Value
- Perfect for software engineers, ethical hackers, and cybersecurity pros who know the risks of vibe coding. This funny design highlights a warning about bugs, exploits, and A.I. coder tech while showing your passion for secure code and system integrity.
- Great for men, women, and tech lovers who spend their days debugging, pen testing, or reviewing code. Ideal for dev teams, programmers, or IT students who understand that vibe coding software development releases can lead to vulnerability as a service.
- Lightweight, Classic fit, Double-needle sleeve and bottom hem
- KEV-listed, present, callable, internet-facing: move to the front of the queue and apply the fix or a compensating control on the timeline your process sets for known-exploited issues.
- Present only in a build stage that never ships: document it as not deployed, with image evidence attached, and keep the record for audit.
- Present and callable, internal only, no KEV listing, low EPSS: schedule it within the normal patch cycle and revisit it when KEV or EPSS data changes.
- Absent from every deployed artifact: close it as not applicable, with the scan evidence that shows the package is missing.
How the federal directive frames the same inputs
CISA’s Binding Operational Directive 26-04, on prioritizing security updates based on risk, is reported as dated June 10, 2026. Its summary lists asset exposure, KEV status, exploit automation and post-exploitation technical impact as prioritization inputs. That matches the factors in the workflow above. Binding operational directives apply to federal executive-branch agencies. Their deadlines do not automatically apply to private organizations, and anyone relying on a date or requirement should check the official CISA directive text rather than a secondary copy.
NIST’s LEV proposal is a proposal
NIST’s CSWP 41, “Likely Exploited Vulnerabilities: A Proposed Metric for Vulnerability Exploitation Probability,” by Peter Mell and Jonathan Spring, was published on May 19, 2025. It proposes a metric called LEV, and the authors say industry collaboration is needed to measure how it performs. The paper does not show that LEV has displaced EPSS or KEV, and the workflow above does not depend on it.
Questions to ask when comparing scanners and platforms
If you are evaluating products that join findings to deployed assets, use the following as a procurement checklist. These are questions, not claims that any named product meets them. Verify each answer in a trial or in vendor documentation.
- How is the component inventory built, and from which artifacts: source, lockfile, container image or running host?
- Which languages and package ecosystems are covered, and where are the gaps?
- How is reachability determined, and does the tool show the evidence behind a “not reachable” result?
- Does the tool distinguish an absent package from a package that is present but unreachable?
- Where do exploitation signals come from, how recent are they, and is their provenance recorded?
- Can each finding be mapped to the deployed asset and its exposure?
- Does the tool support exceptions and compensating controls, with expiry dates and an audit trail?
- Does it integrate with ticketing systems and build pipelines?
The Bottom Line
Use CVSS to judge technical seriousness, KEV to see whether exploitation is recorded, EPSS to estimate near-term likelihood, and your own asset and reachability data to decide what to fix first. Severity alone cannot tell you which Critical findings matter in your environment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
