Out of 48,000 Vulnerabilities Only 1% Are Dangerous: How to Find Them Using CVSS 4.0, EPSS, KEV and FSTEC Methodology

The article is part 10 of the “Vulnerability Management for Beginners” series and focuses on the core challenge of prioritization: out of 48,185 vulnerabilities published in 2025, only about one percent showed signs of real-world exploitation.

Verizon DBIR 2026 reports that exploitation of vulnerabilities overtook stolen credentials as the leading initial access method at 31 percent. Effective prioritization requires complete asset inventory and categorization of every node in the infrastructure.

CVSS alone is insufficient because it measures technical severity rather than actual risk in a specific environment. In 2025 roughly 39 percent of vulnerabilities received high or critical scores, yet the vast majority are never exploited. Additional factors include possible consequences of exploitation, asset criticality, presence of public exploits, attacker accessibility, and trending actively exploited vulnerabilities.

CVSS 4.0, released by FIRST in November 2023, introduced explicit nomenclature such as CVSS-B, CVSS-BT, CVSS-BE and CVSS-BTE, the new Attack Requirements metric, more granular User Interaction values, and a dual impact model separating vulnerable and subsequent systems. However, only 25.9 percent of 2025 vulnerabilities received CVSS 4.0 scores because major sources like NVD still rarely publish them.

In April 2026 NIST announced that NVD would enrich only vulnerabilities in the actively exploited catalog, federal U.S. software, or critical software lists. Approximately 29,000 accumulated records were moved to “not planned for processing,” forcing organizations to rely on vendor scores or calculate their own.

EPSS answers whether a vulnerability will be exploited within the next 30 days using machine learning. Version 4 released in March 2025 added malware telemetry and now observes activity across roughly 12,000 vulnerabilities monthly. A threshold of EPSS greater than 0.1 achieves 63.2 percent coverage with 65.2 percent precision, dramatically better than the common CVSS 7+ approach.

CISA KEV contains vulnerabilities with confirmed exploitation in real attacks. By July 2026 the catalog reached approximately 1,650 entries. The new BOD 26-04 directive introduced risk-based timelines, with the hottest issues required to be remediated within three days. Commercial alternatives such as VulnCheck KEV contain over 3,600 records and detect exploitation on average 27 days earlier.

The article also introduces the experimental LEV metric from NIST CSWP 41 that aggregates historical EPSS scores to highlight older vulnerabilities that were likely exploited but never catalogued. Both EPSS and KEV depend on CVE identifiers, creating limitations for Russian infrastructure where many vulnerabilities lack CVE entries and must be assessed using FSTEC BDU data instead.