Analysis of Vulnerability Severity and Exploit Probability Scoring Frameworks: CVSS and EPSS

Effective cybersecurity risk management requires the systematic identification, quantification, and prioritization of vulnerabilities. Two widely used frameworks for assessing vulnerabilities are the Common Vulnerability Scoring System (CVSS) and the Exploit Prediction Scoring System (EPSS). CVSS quantifies the severity of vulnerabilities, while EPSS estimates the likelihood of their exploitation. This study analyzes the relationship between CVSS and EPSS scores, using datasets from both systems to investigate how these metrics correlate and evolve over time. Our findings reveal that there is no clear correlation between CVSS and EPSS scores, suggesting that severity does not predict exploitability. Additionally, EPSS scores are more likely to increase than decrease, with ‘medium’ CVSS scores showing the highest likelihood of EPSS score increases. The results provide valuable insights for cybersecurity professionals seeking to better prioritize mitigation efforts. Future work will explore the factors influencing EPSS score changes and involve the development of a dynamic tool for comparing CVSS, EPSS, and related vulnerability data.