Stop Triage Theater: Prioritize Known Exploits, Not Severity Scores

Imagine You're in Triage

Imagine you're the bug triage lead on a Tuesday morning. A developer just flagged a critical-severity bug in your authentication module — CVSS 9.8, the kind that makes everyone's stomach drop. But wait, there's also a medium-severity bug in a PDF generator that's been sitting in the backlog for three months, and it's now listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Which do you fix first? If you're like most teams, you'd rush to the critical bug. But you'd be wrong.

I've spent years watching teams treat bug triage as a reflex — a gut feeling that the scariest-looking score wins. But the evidence is clear: severity scores are a poor proxy for real-world risk. The bug that's actually being exploited in the wild, even if it scores "medium" on the CVSS scale, is a far bigger threat to your organization than a theoretical "critical" that nobody has touched. It's time to stop the triage theater and start prioritizing based on what's actually being exploited.

The Problem with Severity Scores

Let's be blunt: severity scores like CVSS are a crutch. They give us a false sense of objectivity. The NVD enriches every CVE with CVSS impact metrics, a CWE type, and CPE applicability statements (NVD). But that's just data, not wisdom. The CVSS v4.0 specification, maintained by FIRST, scores a vulnerability across four metric groups — Base, Threat, Environmental, and Supplemental (FIRST). That sounds thorough, but it's still a snapshot of a vulnerability's intrinsic properties, not its real-world exploitation status.

Here's the kicker: CISA's KEV catalog is the authoritative list of vulnerabilities that have actually been exploited in the wild (CISA). That's not hypothetical — that's reality. And yet, I see teams triaging with CVSS scores as their primary input, completely ignoring whether a vulnerability is in the KEV catalog. It's backwards. The KEV catalog tells you what's being attacked right now; CVSS tells you how bad it could be if someone attacked it. Which one do you think should drive your triage?

The KEV Catalog Is Your Triage Cheat Sheet

I'm not saying severity is useless. It's a useful starting point. But it's not the whole story. The CWE Top 25 for 2024, released by MITRE and sponsored by CISA, ranks the most severe and prevalent software weaknesses behind 31,770 CVE records (CWE). That's a great resource for understanding systemic weaknesses. But for triage, you need something more immediate: the KEV catalog.

Consider this: CISA's Binding Operational Directive 22-01 required federal agencies to remediate vulnerabilities in the KEV catalog, and it's been superseded by BOD 26-04 (CISA). That's the U.S. government telling you, "These are the bugs that matter." And yet, I see private companies ignoring it. Why? Because they're stuck in the severity-score mindset. They see a CVSS 6.5 and think, "Medium, we can wait." But if that bug is in the KEV catalog, you're already late. The attackers have moved on to the next target — or worse, they're still exploiting yours.

The table above shows the two philosophies. Severity-first is comfortable but myopic. Exploit-first is uncomfortable because it forces you to admit that a "medium" bug can be more dangerous than a "critical" one. But that's the truth. The KEV catalog is your triage cheat sheet — use it.

Counterargument: "But Severity Matters for Safety"

I can already hear the pushback: "But what about safety-critical bugs? A buffer overflow in a medical device is more severe than a SQL injection in a marketing site." Fair point. The Therac-25 accidents, where software errors led to massive radiation overdoses, are a stark reminder that some bugs are literally life-or-death (MIT). And the Ariane 5 explosion, caused by a simple integer conversion error, cost $500 million (University of Minnesota). No one is saying severity is irrelevant for safety-critical systems. But here's the thing: even in those cases, triage should still consider exploitability. The Therac-25 investigation found that most accidents weren't caused by coding errors but by errors in software requirements (MIT). That's a design flaw, not a random bug. And the Ariane 5 failure was a specification error. These are systemic issues, not triage decisions.

So yes, severity matters. But it's not the only thing. And for the vast majority of bugs — the ones in your web application, your SaaS product, your internal tools — the KEV catalog is a better predictor of what will hurt you. The research backs this up. NIST found that virtually all software failures are caused by six or fewer parameter interactions (NIST, 2010). That's about testing, but it speaks to the idea that bugs are complex. And the largest study on the delayed issue effect found no evidence that issues resolved later cost consistently more effort (arXiv). So the old "fix it now or pay later" argument doesn't even hold up. The real cost is in the exploitation, not the delay.

My Recommendation: Make KEV Your First Filter

Here's my specific recommendation: In your triage workflow, make the KEV catalog your first filter. If a bug is in the KEV catalog, it's automatically high priority, regardless of its CVSS score. If it's not in KEV, then use severity to rank it. That's a simple, defensible rule. It's not perfect, but it's a huge improvement over the status quo.

And don't just take my word for it — look at the numbers. The CWE Top 25 for 2024 lists CWE-79 Cross-site Scripting as the top weakness, with a score of 56.92, but only 3 CVEs in CISA's KEV catalog (CWE). Meanwhile, CWE-787 Out-of-bounds Write has a score of 45.20 but 18 KEV CVEs (CWE). If you're triaging based on prevalence, you'd fix XSS first. But if you're triaging based on active exploitation, you'd fix the out-of-bounds writes first. Which do you think is more urgent? I'd argue the ones with 18 KEV entries are the ones you should be sweating.

Quick tip: Set up a weekly job that pulls the KEV catalog and cross-references it with your bug tracker. It takes ten minutes and will save you from triage theater.

Bottom Line

Stop letting severity scores dictate your triage. Start with the KEV catalog. It's the single best move you can make to align your bug tracking with real-world risk. The bugs that are being exploited are the ones that matter — and they're not always the ones with the highest CVSS score. So, next Tuesday morning, when that critical bug comes in, ask yourself: "Is it in KEV?" If not, maybe it can wait. But if that PDF generator bug is in KEV, drop everything and fix it now.

Sources

• CISA - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST - https://www.first.org/cvss/v4.0/specification-document
• CWE - https://cwe.mitre.org/top25/archive/2024/2024_cwe_top25.html
• NVD - https://nvd.nist.gov/general
• MIT - https://web.mit.edu/6.033/2004/wwwdocs/papers/Therac_1.html
• University of Minnesota - https://www-users.cse.umn.edu/~arnold/disasters/ariane.html