KEV Beats CVSS: The Framework CISOs Use When Scores Lie

On August 31, 2026, vulnerability prioritization gained an official decision framework: CISA BOD 26-04 mandates four scoring variables, while the private sector adopts the hierarchical rule—KEV first, EPSS second, CVSS last. The Langflow CVE-2026-55255 case—with CISA assigning CVSS 6.1 and KEVIntel/CIRCL 9.9—demonstrates that divergence is not an exception but the system, and that following only the highest or lowest score is a security error.

BOD 26-04: From Single-Score Theory to Multi-Variable Framework

The Binding Operational Directive 26-04, issued by CISA, breaks with the logic of CVSS as the sole yardstick. The four official variables—Asset Exposure, KEV Status, Exploit Automation, Technical Impact—introduce a decision criterion where technical severity is only one factor. The shift is operational: federal civilian agencies must now integrate heterogeneous signals, not sum them arbitrarily.

The directive is not binding on the private sector, but it serves as a regulatory signal. When a U.S. federal entity redefines mandatory update criteria, the enterprise market follows—especially vendors with government contracts. BOD 26-04 legitimizes what advanced CISOs already practiced: CVSS describes the potential impact of a flaw, not the risk to the specific organization.

Langflow: The Case Study of a Divergence That Is Not an Error

The vulnerability CVE-2026-55255 in the Langflow AI agent platform is the perfect specimen of systemic misalignment. CISA assigns CVSS 6.1; KEVIntel and CIRCL calculate 9.9 for the same identifier. The technical explanation—documented in the GitHub advisory GHSA-qrpv-q767-xqq2—lies in the CVSS v3.1 "scope" field: the IDOR allows crossing tenant boundaries in multi-tenant environments, an impact the standard calculator can underestimate if the vendor does not explicitly declare the separation as a security boundary.

The fix released in Langflow 1.9.1 adds ownership validation in the get_flow_by_id_or_endpoint_name function. The change is surgical but revealing: the flaw was not technically complex to fix, but its classification was. A vulnerability management team patching by descending CVSS would have delayed Langflow relative to an RCE with a higher score but no in-the-wild exploitation.

Why the Three Signals Contradict by Design

The problem is not that one of the three scores is "right" and the others wrong. CVSS, EPSS, and KEV measure orthogonal dimensions: the first measures maximum theoretical technical severity, the second the statistical probability of exploitation in the next 30 days, the third empirical confirmation of active exploitation. Their divergence is predictable, indeed structural: they capture different phenomena with different methodologies.

"CVSS, EPSS, and CISA KEV each carry a useful but incomplete signal. Static metadata like these cannot describe whether a vulnerability is safely protected in a development environment or exposed in an application absorbing 30,000 attacks a month." — Contrast Security, AppSec Overflow 2026

Contrast Security's runtime data, while proprietary and not independently verifiable, converges on a critical picture: the average remediation time for critical vulnerabilities in custom code is 92 days, while weaponization can occur in hours. The gap between attack speed and defense speed makes correct prioritization—not the fastest, but the right one—the only controllable factor.

What to Do Now

For vulnerability management teams, the framework translates into four priority actions:

1. Adopt the KEV > EPSS > CVSS hierarchy as the default decision rule, not as an option among peers. When the three signals converge, the choice is obvious; when they diverge, the tiebreaker is confirmed exploitation.

2. Map actual asset exposure before applying any score. Dr. Joye Purser, Global Field CISO at Cohesity, states the explicit criterion: "active exploitation first, then exploit likelihood, then technical severity, with adjustments for asset exposure, business criticality, compensating controls, and the potential consequences of compromise." The same vulnerability in an exposed identity system outranks an RCE in an isolated asset.

3. Set differentiated remediation targets by risk class: 24-72 hours for critical internet-exposed vulnerabilities with known exploitation, with awareness that this requires organizational tradeoffs for mid-sized enterprises.

4. Treat scoring discrepancies as data, not anomalies to ignore. The Langflow case (6.1 vs 9.9) should be documented internally as an example of underestimated scope, not as an "error" by a single vendor.

Ryan Dewhurst of KEVIntel quantifies the volume problem: roughly 200 CVEs per day make patching everything impossible. AI-accelerated exploitation—"attackers move faster using AI to reverse engineer patches"—further compresses the window. Prioritization is no longer a process improvement: it is the process.

FAQ

Why do CISA and KEVIntel give different CVSS scores for the same CVE?
Because the CVSS v3.1 "scope" field depends on the vendor's declaration of security boundaries. If Langflow does not explicitly declare tenant separation as a protected boundary, the calculator assigns a lower score. The divergence is legitimate, not a calculation error.

Does BOD 26-04 bind me if I am not a U.S. federal agency?
No, it applies to federal civilian agencies. It is, however, an operational signal for the private sector, especially for vendors with government business or for audits that verify its adoption as best practice.

High EPSS but no KEV and low CVSS: what to do?
The KEV>EPSS>CVSS framework suggests EPSS before CVSS in the absence of confirmed exploitation, but the dossier does not provide case studies on this specific combination. The source does not specify how to handle this edge case.

Sources

• https://www.helpnetsecurity.com/2026/08/31/joye-purser-cohesity-kev-epss-cvss-conflicts/
• https://nhimg.org/articles/cve-prioritization-needs-kev-and-epss-not-cvss-alone/
• https://www.techtimes.com/articles/319918/20260708/cisa-adds-first-ai-agent-platform-kev-sets-thursday-deadline-4-cves.htm
• https://www.01net.it/ai-is-breaking-the-find-and-fix-model-for-application-security-new-contrast-research-finds/
• https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
• https://www.techtimes.com/go?u=https%3A%2F%2Fhelpx.adobe.com%2Fsecurity%2Fproducts%2Fcoldfusion%2Fapsb26-68.html&aid=319918
• https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2
• https://www.helpnetsecurity.com/2026/07/30/ryan-dewhurst-kevintel-known-exploited-vulnerabilities/

Information verified against cited sources and current as of publication.

Sources