Evaluating Vulnerability Prioritization Strategies Based on CVSS and EPSS - Pinto, Felipe Curty do Rego (Anais do Simpósio Brasileiro de Cibersegurança (SBSeg); 2026: Anais do XXVI Simpósio Brasileiro de CibersegurançaDO - 10.5753/sbseg.2026.26967, 2026)
The number of disclosed vulnerabilities should surpass 50,000 in 2026, making prioritization essential for allocating scarce remediation capacity to the vulnerabilities that most require attention. This paper empirically evaluates CVSS-based, EPSS-based, and combined CVSS+EPSS vulnerability prioritization strategies in terms of effectiveness and remediation effort, providing guidance on how to select among them. We built a corpus of 31, 779 vulnerabilities disclosed in 2024 from the National Vulnerability Database and used the CISA Known Exploited Vulnerabilities (KEV) catalog as ground truth to identify the vulnerabilities that warrant prioritization. Our results show that CVSS-based strategies provide broader coverage but produce substantially larger prioritized sets, whereas EPSS-based strategies are more selective and concentrate a higher share of known-exploited vulnerabilities in the prioritized set. Combined strategies based on OR conditions can provide balanced trade-offs by increasing coverage with a modest increase in remediation effort, while AND combinations offer limited advantage over EPSS alone. Finally, our results provide evidence to enable organizations to choose the best prioritization strategy considering their remediation capacity and tolerance for missing relevant vulnerabilities.