When a vulnerability has a high CVSS base score but a low EPSS, what should be considered to prioritize remediation?

• A. The EPSS score alone determines priority.
• B. The vulnerability's potential environmental impact should be considered alongside CVSS and EPSS.
• C. Only the CVSS score should drive remediation urgency.
• D. Remediation urgency is random.

Answer: (B)

Risk prioritization relies on more than a single score. CVSS base score tells you how severe a vulnerability could be in theory, while EPSS estimates how likely it is to be exploited in practice. But the real risk to your environment also hinges on how important the affected asset is and what impact exploitation would have in that specific context.

So, when a vulnerability has a high CVSS base score but a low EPSS, you still need to weigh its environmental impact. If the affected component sits in a production asset that handles sensitive data, or is critical to business operations, or could enable broader access to other valuable systems, the potential harm is significant even if attackers aren’t likely to exploit it soon. In such cases remediation should be prioritized more strongly, reflecting the asset’s importance and the potential consequences. Conversely, if the asset is low-risk, isolated, or well-protected by other controls, the urgency may be lower.

In short, consider the environmental impact alongside CVSS and EPSS to determine remediation priority. This holistic view ensures you address vulnerabilities that could cause meaningful harm in your specific environment, not just those that are theoretically severe or statistically likely to be exploited.