The short answer
When triaging general infrastructure CVEs, rank them by three signals in this order: CISA KEV membership (confirmed active exploitation), FIRST EPSS probability (30-day likelihood of exploitation in the wild), and NVD CVSS base score (technical severity if exploited). An exception applies when an unexploited critical flaw sits on an internet-facing authentication boundary you run directly, where you patch it alongside KEV items. On CVE-2023-34362, one check_cve call to the free CVE Risk Check MCP server (https://cve.openkrill.app/mcp) took 1,493 ms and returned priority exploited, CVSS 3.1 base score 9.8 (CRITICAL), EPSS 0.99934 (99.971st percentile as of 2026-10-19), CISA KEV addition date 2023-06-02 (remediation due date 2023-06-23, required action Apply updates per vendor instructions.), and the vendor patch advisory URL.
Why sorting by CVSS alone gets the patch order backwards
On 2026-10-20 we passed three well-known vulnerabilities to check_cves: CVE-2023-34362 (MOVEit Transfer SQL injection), CVE-2024-3094 (the XZ Utils liblzma backdoor) and CVE-2023-44487 (the HTTP/2 Rapid Reset denial-of-service attack):
{"method":"tools/call","params":{"name":"check_cves",
"arguments":{"cves":["CVE-2023-34362","CVE-2024-3094","CVE-2023-44487"]}}}A pure CVSS sort puts CVE-2024-3094 first (10.0), CVE-2023-34362 second (9.8) and CVE-2023-44487 last (7.5 HIGH). Add CISA KEV and EPSS and the bottom two swap places:
| Triage rank | CVE ID | Vulnerability | Priority tier | In CISA KEV | EPSS (30-day probability) | CVSS 3.1 base |
|---|---|---|---|---|---|---|
| 1 | CVE-2023-34362 | Progress MOVEit Transfer SQL injection | exploited | Yes (added 2023-06-02, due 2023-06-23) | 0.99934 (99.971st percentile) | 9.8 CRITICAL |
| 2 | CVE-2023-44487 | HTTP/2 Rapid Reset attack | exploited | Yes (added 2023-10-10, due 2023-10-31) | 0.99999 (99.998th percentile) | 7.5 HIGH |
| 3 | CVE-2024-3094 | XZ Utils liblzma malicious backdoor | likely | No (kev: null) | 0.909 (99.807th percentile) | 10.0 CRITICAL |
CVE-2023-44487 scores only 7.5 HIGH because it causes denial of service without confidentiality or integrity loss. It is still exploited in the wild, and its EPSS of 0.99999 sits at the 99.998th percentile. CVE-2024-3094 scored 10.0 CRITICAL, but the backdoor was caught in pre-release distributions before widespread production exploitation, and it is not in CISA KEV.
How the 4 priority values work
Both check_cve (for one ID) and check_cves (for up to 20 IDs) assign every CVE one of 4 priority values, and check_cves summarizes the batch in counts: { exploited, likely, routine, unknown }:
exploited: Listed in the CISA Known Exploited Vulnerabilities catalog, so active exploitation in the wild has been confirmed.likely: Not in CISA KEV, but its FIRST EPSS score is0.1(10 percent 30-day probability) or higher.routine: Not in KEV and EPSS is below0.1.unknown: Neither NVD nor EPSS has a record for the requested CVE ID yet.
How 4 CVE lookup tools compared on CVE-2023-34362
On 2026-10-19 we queried CVE-2023-34362 across 4 services:
| Tool | Status and time | CVSS 3.1 | CISA KEV dates | FIRST EPSS | Auth or setup |
|---|---|---|---|---|---|
CVE Risk Check MCP (check_cve) | HTTP 200 in 1,493 ms | 9.8 CRITICAL (scored by NVD) | Added 2023-06-02, due 2023-06-23 | 0.99934 (99.971st percentile) | None (keyless MCP server) |
OpenCVE REST API (/api/cve/CVE-2023-34362) | HTTP 200 in 1,423 ms | 9.8 CRITICAL | Added 2023-06-02, due 2023-06-23 | 0.99934 (99.971st percentile) | Requires account and HTTP Basic Auth |
| CIRCL Vulnerability-Lookup API | HTTP 200 in 2,248 ms | 9.8 CRITICAL | Added 2023-06-02, due 2023-06-23 | Not included in response | None, but returns a 227 KB raw JSON bundle |
| CVEdetails web page | HTTP 403 in 67 ms | Blocked | Blocked | Blocked | Bot protection blocked automated fetch |
You can connect the server from the CVE Risk Check tool page, browse sample prompts on CVE Risk Check answers, or follow the Claude integration guide.
Frequently asked questions
What is the difference between CVSS, EPSS and CISA KEV?
CVSS (Common Vulnerability Scoring System, published by NVD) scores the theoretical technical severity of a flaw from 0 to 10. EPSS (Exploit Prediction Scoring System, run by FIRST.org) estimates the probability from 0 to 1 that a vulnerability will be exploited in the wild over the next 30 days. CISA KEV (Known Exploited Vulnerabilities) is a US government catalog of vulnerabilities confirmed to have been exploited in real attacks.
Why does check_cves rank CVE-2023-44487 (CVSS 7.5) ahead of CVE-2024-3094 (CVSS 10.0)?
CVE-2023-44487 (HTTP/2 Rapid Reset) is listed in CISA KEV (added 2023-10-10) with an EPSS score of 0.99999 (99.998th percentile), meaning attackers actively use it in the wild. CVE-2024-3094 (the XZ Utils liblzma backdoor) carries a CVSS 10.0 score and an EPSS of 0.909, but it was caught before wide production deployment and is not in CISA KEV, so its triage tier is likely rather than exploited.
What are the 4 priority values returned by CVE Risk Check?
In descending order of urgency: exploited (listed in CISA KEV), likely (not in KEV, but EPSS is 0.1 or higher), routine (not in KEV and EPSS under 0.1), and unknown (no NVD or EPSS record found).
Does CVE Risk Check require an NVD or OpenCVE API key?
No. The MCP server at https://cve.openkrill.app/mcp queries NVD 2.0, FIRST EPSS and the CISA KEV feed with no API key and no account, up to 60 calls a minute per network and 5,000 calls a day per server.
Sources
- Single-CVE and batch triage runs: CVE Risk Check MCP server (
https://cve.openkrill.app/mcp), read on 2026-10-19 at 06:06 UTC and 2026-10-20 at 07:20 UTC. - National Vulnerability Database records: NVD CVE-2023-34362, NVD CVE-2023-44487 and NVD CVE-2024-3094.
- Exploitation probability data: FIRST.org Exploit Prediction Scoring System (EPSS), as of 2026-10-19.
- Confirmed exploitation catalog: CISA Known Exploited Vulnerabilities Catalog.
- Vendor advisory for MOVEit Transfer: Progress MOVEit Transfer Critical Vulnerability Advisory (31 May 2023).
- Rival benchmarks: OpenCVE REST API and CIRCL Vulnerability-Lookup, tested on 2026-10-19.