Three public signals get used to decide what to patch first, and they don't agree with each other. CVSS rates how bad a flaw could be, and its own documentation says the base score isn't risk and shouldn't set patch order alone. EPSS estimates the chance exploitation attempts will be seen in the next thirty days. CISA's KEV catalogue lists flaws with real evidence of exploitation and a clear fix.
Working from the public feeds of 25 September 2026, CVSS and EPSS rank vulnerabilities differently, so which one you pick genuinely changes what gets fixed, and KEV is small at about 0.5% of all CVEs. I tested how well each signal would have ranked the flaws CISA went on to add to KEV the following month, across eighteen months. Nearly half the additions turned out to be too new to have been scored at all. For the rest, CVSS found about as many as EPSS for the same effort and did better on some measures, while EPSS was clearly better at pushing the right things to the very top of the list.
Some of that CVSS advantage probably comes from scores added after the fact, so I wouldn't lean on it. The EPSS maintainers report that EPSS finds as many exploited flaws as a "CVSS 7 or above" rule for roughly an eighth of the work, but their data is private, so I'd treat that as a vendor claim rather than a result.
In practice I'd fix KEV items first and not sort by CVSS alone. EPSS is worth using to pick out the top of the queue rather than as a pass-or-fail line. And I'd watch new flaws on exposed systems separately, because EPSS starts them low and that's exactly where the eighteen-month test found the gap. Whether EPSS beats CVSS in general isn't something anyone can settle without public exploitation data.