Severity Is Not Exploitability: A Simple Taxonomy and Context Score for Better CVE Triage

Abstract

Modern security teams face a constant backlog of vulnerabilities and limited engineering time for patching. In practice, organizations turn this into a triage problem: deciding which findings to remediate first, which to monitor, and which to postpone, often encoding these choices into SLAs, dashboards, and automated patching workflows driven by scanner output. Today this prioritization is usually based on Common Vulnerability Scoring System (CVSS) base severity, even though severity does not equal exploitability. This paper presents a compact, single-tag taxonomy for exploitability preconditions (exposure, environment, configuration, authentication, cryptography, and related factors) and a transparent context score that estimates how easy a vulnerability is to exploit in a given deployment. We enriched a dataset of 2{,}426 Common Vulnerabilities and Exposures (CVE) with constraint annotations and compared the context score against CVSS severity and the Exploit Prediction Scoring System (EPSS). The score shows weak association with both signals, indicating it captures complementary information about situational ease rather than impact or ecosystem pressure. Grouped by severity, notable shares of medium- and even low-severity findings emerge as easy to exploit under common configurations. In a telecom self-care platform case study (100 findings), reordering by the context score surfaced 28 straightforward fixes across severities, reducing immediate exposure and consolidating root causes that a severity-only plan would postpone. We conclude that combining EPSS with the proposed context score yields a more effective, auditable triage process for applied informatics settings.