Methodology — EVULNABLE

The EVULNABLE Risk Score

CVSS answers “how technically severe is this vulnerability?” EVRS answers a different question: “how urgently should this be remediated?” A known-exploited finding with a moderate CVSS score can outrank a theoretical CVSS 9.8 with no known exploitation signal — CVSS alone cannot express that, so EVRS layers exploitation and disclosure intelligence on top of raw severity.

That is the whole design: on any given release most CVEs are not yet known-exploited, so most sit in the Elevated band or below under EVRS even where the vendor calls them Critical.

What it weighs

The factors the EVULNABLE Risk Score considers
Factor	What it measures
Active Exploitation	A vendor's own confirmation of exploitation in the wild, independent of CISA's listing.
CISA KEV	Listed in CISA's Known Exploited Vulnerabilities catalog — the US government's own confirmation that this CVE has been exploited.
CVSS	The CVSS base score — raw technical severity, independent of whether anyone is exploiting it.
EPSS	FIRST's Exploit Prediction Scoring System: the probability of exploitation in the next 30 days.
KEV listing recency	How recently CISA added the CVE to the KEV catalog. Something listed last month needs action this week; something listed in 2021 is a hygiene backlog item.
Microsoft Exploitability Index	Microsoft's own Exploitability Index, for CVEs that come from a Patch Tuesday release.
Public Disclosure	Disclosed publicly before a patch shipped, so defenders and attackers learned of it at the same time.
Ransomware	CISA records this CVE being used in a known ransomware campaign.

A factor with no data behind it contributes nothing and is reported as unavailable rather than scored as a zero — the difference between “checked, and it is not exploited” and “nobody has said”. That is what the Intelligence coverage line on a card is counting — and its denominator is what was obtainable for that CVE, not a flat 100, so an entry is never marked down for a source that could not apply to it.

Priority bands

These are deliberately not severity words. CVSS and a vendor's own rating say how bad a flaw is if exploited; EVRS says how soon to deal with it, and a flaw with no known exploitation signal and a near-zero exploitation probability is genuinely not urgent however severe it is. Sharing one vocabulary invited the two being read as the same measurement — under the old v1.0 vocabulary a Microsoft-Critical CVE at CVSS 9.8 showed as “EVRS 19 Medium”, which looked like a contradiction rather than two scales agreeing. The colors are unchanged, because escalation was never the part that was wrong.

EVRS priority bands and their recommended actions
Score	Band	Recommended priority
85–100	Immediate	Patch Immediately
65–84	Urgent	Patch This Cycle
10–64	Elevated	Scheduled Maintenance
4–9	Routine	Monitor
0–3	Informational	Monitor

Anything CISA KEV-listed or confirmed actively exploited is floored regardless of the weighted total, so known exploitation can never be buried by a merely moderate severity score.

Exigent — a flag, not a sixth band

Exigent never pushes a score above 100 and is never a band of its own. It is a flag layered on Immediate for the narrow case where every one of EVRS's strongest signals agrees at once: CISA KEV-listed, confirmed actively exploited, a real published CVSS of 9.0 or higher, and at least one genuine urgency signal — an EPSS probability of 90% or more, a known ransomware-campaign association, or a CISA remediation deadline inside the next 14 days.

That last requirement is what keeps it meaningful. On a KEV-sourced view the first two conditions are true of every entry by definition, so without it the flag collapses into a plain CVSS cutoff and lands on nearly every card. An Exigent CVE is floored higher still, and carries a more urgent recommended priority than Immediate alone. It is drawn in its own hue, distinct from every band color, so it cannot be misread as a level above Immediate.

A CVSS derived from a vendor's categorical severity rating rather than a published number can never trigger Exigent, however high it is.

What is deliberately not in the score

Public exploit availability — Metasploit or Exploit-DB presence — is an obvious candidate and is left out. EVULNABLE does not yet integrate a feed for it that it trusts, and a fabricated or unreliable signal is worse than an honestly absent one.

An environment-aware version of the score exists and is deliberately not used on this site.

The exact scoring model is intentionally not published beyond what is on this page.

Where the data comes from

The Patch Tuesday brief always reflects whatever Microsoft's Security Update Guide currently reports as its latest monthly release. The release to fetch is looked up dynamically every time the cache refreshes, never hardcoded to a month, so next month's is picked up with no code change.

Data sources, their role, and how often each refreshes
Source	Role	Refresh
Microsoft Security Update Guide (CVRF)	CVE list, titles, severity, exploitability signals, disclosure status	Every 6 hours
CISA Known Exploited Vulnerabilities (KEV)	Known-exploitation status, ransomware association, remediation deadline	Every 6 hours
FIRST EPSS	Exploit-prediction probability and percentile	Every 12 hours
NIST NVD	CVE search, and CVSS for KEV entries CISA's own schema does not carry	On demand, rate-limit aware
Cisco PSIRT, Red Hat, Google Chrome	Vendor-published CVSS, cross-referenced to fill the same gap for free	Every 6 hours
CyberSecurityTracker.ai	Fixed versions and vendor required actions, for scan analysis and search	On demand, cached per CVE; background refresh every 24 hours
Check Point Research	Per-CVE threat research coverage — title, date and link only, shown on CVE pages	Every 6 hours
endoflife.date	Microsoft lifecycle milestones (end of life, end of support, ESU)	Every 24 hours

These are passive cache windows, not a scheduled background job: a source refetches the next time a visitor's request needs it after its window has elapsed. A source that is down degrades the page it feeds — its factor goes unavailable in the score and the page says so — rather than being filled in from cache or estimated.

Status chips and terms

Terminology used across the site
Term	Meaning
Actively Exploited	The vendor's own confirmation that this CVE is being exploited in the wild, as reported in that release.
CISA KEV	Listed in the CISA Known Exploited Vulnerabilities catalog. On a KEV-sourced view this is true of every row by construction, which is why those pages state it once as the source rather than repeating it as a separate flag.
Publicly Disclosed	The vendor's own flag that this CVE was disclosed publicly before a patch shipped.
EPSS	Two numbers, shown as one. The probability (0–1) is the chance of exploitation in the next 30 days and is what EVRS scores on; the percentile ranks that probability against every other scored CVE and is shown in brackets as context. A displayed percentile is capped at the 99.99th and a probability at 0.999: nothing sits at the 100th percentile of a population it belongs to, and EPSS never assigns a probability of 1.
CVSS	The Common Vulnerability Scoring System base score — raw technical severity, independent of real-world exploitation. Base scores from different CVSS versions are computed from different metrics, so the version is named wherever a score is shown and left unlabelled rather than guessed when unknown.
Intelligence coverage	How much of the weight budget had real data behind it, and out of how much was obtainable for that CVE. A score built on 65 points of evidence rests on less than the same score built on 100, so the gap is named — "no CVSS vector published" — rather than left as a bare number. The denominator excludes anything that could not apply: Microsoft's Exploitability Index covers Microsoft's own products, so a Meta or Oracle CVE is not marked down for lacking one. It measures completeness of evidence, not how sure we are of the result.
Exigent	A flag layered on the Immediate band, never a sixth band and never a score above 100. It has its own hue, distinct from every band color, so it cannot be misread as a level above Immediate.