Rezilion Discovers Critical Security Flaws Omitted by CISA KEV Catalog

New Report Highlights the Importance of Exploitability Probability Prediction Score (EPSS) in Vulnerability Management

New York, July 26, 2023 – Rezilion, an automated software supply chain security platform, has released a report emphasizing the critical role of the Exploitability Probability Prediction Score (EPSS) in effective vulnerability management. The report builds upon Rezilion‘s previous research on Known Exploited Vulnerabilities (KEVs), further demonstrating the limitations of relying solely on the Common Vulnerability Scoring System (CVSS) and the KEV catalog provided by the Cybersecurity and Infrastructure Security Agency (CISA).

The Limitations of Conventional Vulnerability Prioritization

The conventional method of prioritizing vulnerabilities based solely on CVSS scores is often ineffective. CVSS provides a numeric score to measure the severity of a vulnerability, but it does not consider the likelihood of exploitation or the real-world context in which vulnerabilities operate. Rezilion‘s new research specifically highlights the importance of considering the EPSS score in vulnerability management.

The Significance of the Exploitability Probability Prediction Score (EPSS)

The EPSS score measures the likelihood of a vulnerability being exploited. Rezilion‘s vulnerability researchers discovered more than 30 actively exploited vulnerabilities with high EPSS scores that were not listed in the CISA KEV catalog. This not only exposes the gaps in the KEV catalog but also underlines the importance of incorporating EPSS into vulnerability management strategies.

Comprehensive Vulnerability Management Approach

Rezilion‘s Director of Vulnerability Research, Yotam Perkal, emphasizes the necessity of a holistic approach that incorporates CVSS, CISA’s KEV, and EPSS for effective vulnerability management. Perkal argues that relying on any single metric or database can leave organizations vulnerable to targeted attacks.

The Launch of Rezilion‘s Enrichment Feeds

As a response to their research findings, Rezilion has launched a new feature called Enrichment Feeds. This feature provides organizations with crucial intelligence based on EPSS scores, allowing them to prioritize vulnerabilities accurately. The Enrichment Feeds offer real-time information on exploitability, assisting organizations in addressing the most dangerous vulnerabilities promptly.

Editorial: The Complex Landscape of Vulnerability Management

Vulnerability management has become an increasingly challenging task in today’s digital landscape. As organizations rely more on software and digital infrastructure, cyber attackers are constantly searching for vulnerabilities to exploit. The traditional approach of prioritizing vulnerabilities based on CVSS scores clearly falls short, as highlighted by Rezilion‘s research.

It is crucial for organizations to adopt a comprehensive vulnerability management strategy that considers multiple factors such as CVSS, CISA’s KEV, and EPSS. Without this multi-dimensional perspective, organizations risk leaving significant security gaps that can be exploited by malicious actors.

The Importance of Real-time Visibility

Rezilion‘s Enrichment Feeds, which provide real-time information on exploitability, address a key challenge in vulnerability management. Delayed updates to the KEV catalog can lead to organizations being unaware of newly discovered vulnerabilities. By incorporating EPSS into their vulnerability management approach, organizations gain a more accurate understanding of the risks they face.

Advice for Organizations

In light of Rezilion‘s research findings, organizations should take the following steps to enhance their vulnerability management practices:

1. Adopt a Holistic Approach:

Relying solely on CVSS scores or the KEV catalog is inadequate for comprehensive vulnerability management. Organizations should consider multiple metrics, including CVSS, CISA’s KEV, and EPSS, to gain a comprehensive understanding of vulnerabilities.

2. Leverage Real-time Intelligence:

Utilize tools and services, such as Rezilion‘s Enrichment Feeds, that provide real-time information on exploitability. This enables organizations to promptly address vulnerabilities that pose a higher risk of exploitation.

3. Prioritize Patching and Remediation:

Based on the comprehensive assessment of vulnerabilities, prioritize patching and remediation efforts accordingly. Identify vulnerabilities with high EPSS scores and ensure they are addressed promptly to mitigate the risk of exploitation.

Conclusion

Rezilion‘s research sheds light on the limitations of relying solely on CVSS scores and the KEV catalog for vulnerability management. To effectively manage vulnerabilities and reduce the risk of exploitation, organizations must adopt a comprehensive approach that incorporates multiple metrics, real-time intelligence, and timely patching. By taking these steps, organizations can enhance their security posture and protect themselves from evolving cyber threats.