{
  "title": "Does CVSS severity predict realised exploitation? — KEV × CVSS × EPSS analysis",
  "publisher": "Aivistix Research",
  "license": "CC BY 4.0",
  "retrieved": "2026-07-09",
  "methodology": "Population = all CVEs with a CVSS v3 base severity in the NVD. Ground-truth exploitation label = NVD 'hasKev' flag (membership in the CISA Known Exploited Vulnerabilities catalog). Counts pulled from the NVD REST API v2.0 (services.nvd.nist.gov) as totalResults per (cvssV3Severity x hasKev) query on 2026-07-09 — the entire population by band, not a sample. EPSS (exploitation probability) for the marquee CVEs pulled from the FIRST EPSS API (api.first.org) the same day. This design deliberately removes the selection-on-outcome bias of the original n=5 illustrative set.",
  "sources": {
    "nvd_api": "https://services.nvd.nist.gov/rest/json/cves/2.0",
    "cisa_kev": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
    "epss_api": "https://api.first.org/data/v1/epss",
    "epss_home": "https://www.first.org/epss/"
  },
  "population_total_cvss_v3": 191079,
  "kev_total_cvss_v3": 1266,
  "overall_kev_rate": 0.00663,
  "by_severity": [
    {"severity": "CRITICAL", "population": 30301, "kev": 475, "p_kev_given_severity": 0.0157, "share_of_exploited": 0.375, "lift_vs_base": 2.37},
    {"severity": "HIGH", "population": 75456, "kev": 654, "p_kev_given_severity": 0.0087, "share_of_exploited": 0.517, "lift_vs_base": 1.31},
    {"severity": "MEDIUM", "population": 82119, "kev": 134, "p_kev_given_severity": 0.0016, "share_of_exploited": 0.106, "lift_vs_base": 0.25},
    {"severity": "LOW", "population": 3203, "kev": 3, "p_kev_given_severity": 0.0009, "share_of_exploited": 0.002, "lift_vs_base": 0.14}
  ],
  "headline": {
    "miss_if_only_critical": 0.625,
    "critical_precision": 0.0157,
    "critical_never_exploited": 0.9843,
    "chi_square": 751.8,
    "dof": 3,
    "cramers_v": 0.063
  },
  "auc": {
    "note": "ROC-AUC of each signal as a predictor of KEV membership. CVSS AUC is severity-banded (4 ordinal levels) computed analytically from by_severity; EPSS AUC is rank-AUC over all EPSS-scored CVEs. Retrieved 2026-07-09. EPSS reflects encoded (not time-of-disclosure) exploitation — see limitations.",
    "cvss_banded_auc": 0.704,
    "epss_auc_full": 0.947,
    "epss_auc_censored_le2024": 0.948,
    "epss_cve_count": 346176,
    "kev_total": 1635,
    "kev_covered_by_epss": 1635
  },
  "epss_marquee": [
    {"cve": "CVE-2021-44228", "name": "Log4Shell", "cvss_v31_nvd": 10.0, "epss": 0.99999, "epss_percentile": 1.0000},
    {"cve": "CVE-2024-3094", "name": "XZ Utils", "cvss_v31_nvd": 10.0, "epss": 0.85974, "epss_percentile": 0.9970},
    {"cve": "CVE-2023-34362", "name": "MOVEit", "cvss_v31_nvd": 9.8, "epss": 0.99934, "epss_percentile": 0.9997},
    {"cve": "CVE-2023-22515", "name": "Confluence", "cvss_v31_nvd": 9.8, "epss": 0.99156, "epss_percentile": 0.9993},
    {"cve": "CVE-2014-0160", "name": "Heartbleed", "cvss_v31_nvd": 7.5, "epss": 0.99999, "epss_percentile": 1.0000}
  ],
  "interpretation": "CVSS base severity carries directional signal (Critical CVEs are exploited at 2.4x the base rate; the chi-square is highly significant) but explains almost none of the variance (Cramer's V = 0.063). As a prioritisation filter it is low-precision (98.4% of Critical CVEs are never known-exploited) and, for a Critical-only strategy, low-recall (misses 62.5% of exploited CVEs, because the majority of exploited CVEs are rated High). Exploitation-likelihood signals (EPSS) place all five marquee CVEs above the 99.7th percentile despite their CVSS spanning 7.5-10.0. Severity is necessary context, not a risk score.",
  "limitations": [
    "KEV is a lower bound on real exploitation (curated, US-centric, lags disclosure); true exploitation is higher, so precision figures are conservative.",
    "Restricted to CVEs carrying a CVSS v3 base score; v2-only and unscored CVEs excluded.",
    "Point-in-time snapshot (2026-07-09); KEV and NVD scores change over time.",
    "KEV membership and CVSS are both partly analyst-assigned, not independent oracles."
  ]
}