[Agent Tools](https://tools.openkrill.app/) / [Blog](https://tools.openkrill.app/blog)

# How to triage CVEs with CISA KEV, EPSS and CVSS: why a CVSS 7.5 bug outranks a CVSS 10.0 bug

If you sort a vulnerability scanner report by CVSS base score alone, theoretical 9.8 and 10.0 flaws land ahead of 7.5 flaws that attackers are exploiting in the wild right now. We tested `CVE-2023-34362` (Progress MOVEit Transfer SQL injection) across 4 CVE lookup tools. Then we ran a 3-CVE batch triage through the [CVE Risk Check](https://tools.openkrill.app/tools/cve) MCP server to see how NVD CVSS, FIRST EPSS and the CISA Known Exploited Vulnerabilities (KEV) catalog change the patch order when you combine them.

By OpenKrill. Published 2026-10-20. Single-CVE benchmark runs were recorded on 2026-10-19 at 06:06 UTC, and the 3-CVE batch triage on 2026-10-20 at 07:20 UTC, against `https://cve.openkrill.app/mcp` (backed by NVD 2.0, FIRST EPSS and CISA KEV).

## The short answer

When triaging general infrastructure CVEs, rank them by three signals in this order: **CISA KEV membership** (confirmed active exploitation), **FIRST EPSS probability** (30-day likelihood of exploitation in the wild), and **NVD CVSS base score** (technical severity if exploited). An exception applies when an unexploited critical flaw sits on an internet-facing authentication boundary you run directly, where you patch it alongside KEV items. On `CVE-2023-34362`, one `check_cve` call to the free [CVE Risk Check](https://tools.openkrill.app/tools/cve) MCP server (`https://cve.openkrill.app/mcp`) took 1,493 ms and returned priority `exploited`, CVSS 3.1 base score `9.8` (`CRITICAL`), EPSS `0.99934` (`99.971st` percentile as of 2026-10-19), CISA KEV addition date `2023-06-02` (remediation due date `2023-06-23`, required action `Apply updates per vendor instructions.`), and the vendor patch advisory URL.

## Why sorting by CVSS alone gets the patch order backwards

On 2026-10-20 we passed three well-known vulnerabilities to `check_cves`: `CVE-2023-34362` (MOVEit Transfer SQL injection), `CVE-2024-3094` (the XZ Utils `liblzma` backdoor) and `CVE-2023-44487` (the HTTP/2 Rapid Reset denial-of-service attack):

```
{"method":"tools/call","params":{"name":"check_cves",
 "arguments":{"cves":["CVE-2023-34362","CVE-2024-3094","CVE-2023-44487"]}}}
```

A pure CVSS sort puts `CVE-2024-3094` first (10.0), `CVE-2023-34362` second (9.8) and `CVE-2023-44487` last (7.5 HIGH). Add CISA KEV and EPSS and the bottom two swap places:

| Triage rank | CVE ID | Vulnerability | Priority tier | In CISA KEV | EPSS (30-day probability) | CVSS 3.1 base |
| --- | --- | --- | --- | --- | --- | --- |
| 1 | `CVE-2023-34362` | Progress MOVEit Transfer SQL injection | `exploited` | Yes (added 2023-06-02, due 2023-06-23) | 0.99934 (99.971st percentile) | 9.8 CRITICAL |
| 2 | `CVE-2023-44487` | HTTP/2 Rapid Reset attack | `exploited` | Yes (added 2023-10-10, due 2023-10-31) | 0.99999 (99.998th percentile) | 7.5 HIGH |
| 3 | `CVE-2024-3094` | XZ Utils `liblzma` malicious backdoor | `likely` | No (`kev: null`) | 0.909 (99.807th percentile) | 10.0 CRITICAL |

`CVE-2023-44487` scores only `7.5 HIGH` because it causes denial of service without confidentiality or integrity loss. It is still exploited in the wild, and its EPSS of `0.99999` sits at the 99.998th percentile. `CVE-2024-3094` scored `10.0 CRITICAL`, but the backdoor was caught in pre-release distributions before widespread production exploitation, and it is not in CISA KEV.

## How the 4 priority values work

Both `check_cve` (for one ID) and `check_cves` (for up to 20 IDs) assign every CVE one of 4 `priority` values, and `check_cves` summarizes the batch in `counts: { exploited, likely, routine, unknown }`:

1. **`exploited`:** Listed in the CISA Known Exploited Vulnerabilities catalog, so active exploitation in the wild has been confirmed.
2. **`likely`:** Not in CISA KEV, but its FIRST EPSS score is `0.1` (10 percent 30-day probability) or higher.
3. **`routine`:** Not in KEV and EPSS is below `0.1`.
4. **`unknown`:** Neither NVD nor EPSS has a record for the requested CVE ID yet.

## How 4 CVE lookup tools compared on CVE-2023-34362

On 2026-10-19 we queried `CVE-2023-34362` across 4 services:

| Tool | Status and time | CVSS 3.1 | CISA KEV dates | FIRST EPSS | Auth or setup |
| --- | --- | --- | --- | --- | --- |
| [CVE Risk Check](https://tools.openkrill.app/tools/cve) MCP (`check_cve`) | HTTP 200 in 1,493 ms | 9.8 CRITICAL (scored by NVD) | Added 2023-06-02, due 2023-06-23 | 0.99934 (99.971st percentile) | None (keyless MCP server) |
| OpenCVE REST API (`/api/cve/CVE-2023-34362`) | HTTP 200 in 1,423 ms | 9.8 CRITICAL | Added 2023-06-02, due 2023-06-23 | 0.99934 (99.971st percentile) | Requires account and HTTP Basic Auth |
| CIRCL Vulnerability-Lookup API | HTTP 200 in 2,248 ms | 9.8 CRITICAL | Added 2023-06-02, due 2023-06-23 | Not included in response | None, but returns a 227 KB raw JSON bundle |
| CVEdetails web page | HTTP 403 in 67 ms | Blocked | Blocked | Blocked | Bot protection blocked automated fetch |

You can connect the server from the [CVE Risk Check tool page](https://tools.openkrill.app/tools/cve), browse sample prompts on [CVE Risk Check answers](https://tools.openkrill.app/answers/cve), or follow the [Claude integration guide](https://tools.openkrill.app/integrations/cve/claude).

## Frequently asked questions

### What is the difference between CVSS, EPSS and CISA KEV?

CVSS (Common Vulnerability Scoring System, published by NVD) scores the theoretical technical severity of a flaw from 0 to 10. EPSS (Exploit Prediction Scoring System, run by FIRST.org) estimates the probability from 0 to 1 that a vulnerability will be exploited in the wild over the next 30 days. CISA KEV (Known Exploited Vulnerabilities) is a US government catalog of vulnerabilities confirmed to have been exploited in real attacks.

### Why does check_cves rank CVE-2023-44487 (CVSS 7.5) ahead of CVE-2024-3094 (CVSS 10.0)?

CVE-2023-44487 (HTTP/2 Rapid Reset) is listed in CISA KEV (added 2023-10-10) with an EPSS score of 0.99999 (99.998th percentile), meaning attackers actively use it in the wild. CVE-2024-3094 (the XZ Utils liblzma backdoor) carries a CVSS 10.0 score and an EPSS of 0.909, but it was caught before wide production deployment and is not in CISA KEV, so its triage tier is likely rather than exploited.

### What are the 4 priority values returned by CVE Risk Check?

In descending order of urgency: exploited (listed in CISA KEV), likely (not in KEV, but EPSS is 0.1 or higher), routine (not in KEV and EPSS under 0.1), and unknown (no NVD or EPSS record found).

### Does CVE Risk Check require an NVD or OpenCVE API key?

No. The MCP server at https://cve.openkrill.app/mcp queries NVD 2.0, FIRST EPSS and the CISA KEV feed with no API key and no account, up to 60 calls a minute per network and 5,000 calls a day per server.

## Sources

- Single-CVE and batch triage runs: [CVE Risk Check MCP server](https://tools.openkrill.app/tools/cve) (`https://cve.openkrill.app/mcp`), read on 2026-10-19 at 06:06 UTC and 2026-10-20 at 07:20 UTC.
- National Vulnerability Database records: [NVD CVE-2023-34362](https://nvd.nist.gov/vuln/detail/CVE-2023-34362), [NVD CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) and [NVD CVE-2024-3094](https://nvd.nist.gov/vuln/detail/CVE-2024-3094).
- Exploitation probability data: [FIRST.org Exploit Prediction Scoring System (EPSS)](https://www.first.org/epss), as of 2026-10-19.
- Confirmed exploitation catalog: [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog).
- Vendor advisory for MOVEit Transfer: [Progress MOVEit Transfer Critical Vulnerability Advisory (31 May 2023)](https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023).
- Rival benchmarks: [OpenCVE REST API](https://docs.opencve.io/api/) and [CIRCL Vulnerability-Lookup](https://vulnerability.circl.lu/), tested on 2026-10-19.