6. Risk Data: CWE, CCI, CISA KEV and EPSS

A Nessus scan tells you what is wrong. It does not tell you whether anyone is actually exploiting it, how likely that is, what kind of weakness it is, or which security control it breaches. NESSviewer adds all four from reference data it carries offline, and the results appear as extra columns on every finding.

None of it requires a network connection at scan time. The datasets ship with the application, live on your machine, and are updated by downloading a file and importing it.

Dataset	Answers	Matched by
EPSS	How likely is this to be exploited in the next 30 days?	CVE
CISA KEV	Is this being exploited right now, and by when must it be fixed?	CVE
CWE	What kind of weakness is this?	The plugin’s own CWE references
CCI	Which NIST SP 800-53 control does this violate?	CWE

6.1 EPSS — how likely is this to be exploited?

EPSS is the Exploit Prediction Scoring System, published by FIRST. It is a daily-refreshed estimate of the probability that a given CVE will be exploited in the wild in the next 30 days.

This is the question CVSS does not answer. CVSS measures how bad it would be if someone exploited it — a static judgement made when the vulnerability was published. EPSS measures how likely that is now, and it is re-scored every day from real-world exploitation data. A CVSS 9.8 with an EPSS score of 0.04% is a severe weakness that nobody is attacking; a CVSS 7.5 at 97% is being attacked today.

The columns

Column	What it shows
EPSS Score	The probability, as a percentage — for example 97.36% or 0.04%. Where a finding carries several CVEs, this is the highest-scoring one.
EPSS Percentile	Where that score ranks among every scored CVE, as an ordinal — 99th means at least 99% of all scored CVEs are less likely to be exploited than this one.
EPSS Date	The date of the score file the values came from. EPSS is re-scored daily, so the date matters.

All three sit in the risk colour band on the Analyze grid and on the Risk tab of the details panel. They are blank where the finding has no CVE, where FIRST has not scored that CVE, or where EPSS is switched off.

Note

EPSS Score and EPSS Percentile sort by their numeric value, not alphabetically — so 97.36% sorts above 9.21% as you would expect, rather than below it.

On the Dashboard

The Summary tab carries a tile headed Likely exploited (EPSS ≥10%) counting every finding scoring 10% or more, and a panel headed Exploit Likelihood (EPSS) that crosses severity against likelihood:

Column	Band
<1%	Under 1% — exploitation in the next month is unlikely.
1–10%	1% up to 10%.
10–50%	10% up to 50% — the application’s own “likely exploited” threshold starts here.
≥50%	50% or more. Shown in red; treat as immediate.
No score	No CVE, a CVE FIRST has not scored, or EPSS switched off.

Rows are Critical, High, Medium and Low, plus a Total. Informational findings are excluded — they carry no CVEs to score. The panel’s own caption puts the point plainly: “High severity and high likelihood is where to start; many severe findings are rarely exploited.”

Keeping EPSS current

EPSS changes every day, which makes it the one dataset worth updating regularly. Download epss_scores-current.csv.gz from the Data page at first.org/epss and import it under Options → Reference Data → EPSS (FIRST) → Update…. The dated and uncompressed forms are accepted too.

Important

Imported reference data applies to the scans that are loaded, so EPSS and CCI re-score immediately — but CWE and CISA KEV only affect scans loaded after the import. After updating those two, reload your scans.

The “no EPSS score” notice

If your findings carry CVEs with no score and the loaded score file is 30 days old or older, a banner appears above the Analyze grid reading {n} CVEs in these scans have no EPSS score, with the age of the file you have and where to get a fresh one. Open Reference Data takes you straight to the setting; ✕ hides the notice until either the scans or the EPSS file change.

Note

Some CVEs are never scored — rejected entries, or ones too new even for today’s file. The banner only appears when your file is also stale, because that is the case a download actually fixes.

6.2 CISA KEV — what is being exploited right now

The Known Exploited Vulnerabilities catalog is published by the US Cybersecurity and Infrastructure Security Agency. Everything on it has been confirmed exploited in the wild, and federal systems carry a mandatory remediation deadline for each entry under Binding Operational Directive 22-01.

Column	What it shows
CISA KEV	Yes when one of the finding’s CVEs is on the catalog; otherwise blank.
CISA KEV Due Date	The BOD 22-01 remediation deadline for that entry.
KEV Ransomware	Known when the entry has been linked to ransomware campaigns; otherwise blank.

Tip

KEV is the only one of the four datasets that carries an externally imposed deadline. Filter the Analyze grid on CISA KEV = Yes and sort by CISA KEV Due Date and you have your mandatory work queue, in order.

Update it by downloading known_exploited_vulnerabilities.json from cisa.gov and importing it under Options → Reference Data → CISA KEV → Update….

6.3 CWE — what kind of weakness it is

A CWE (Common Weakness Enumeration, from MITRE) classifies the kind of flaw rather than the specific instance. A CVE is one particular vulnerability in one particular product; a CWE is the category it belongs to — CWE-79 Cross-site Scripting, say, which covers thousands of individual CVEs.

Column	What it shows
CWE	The weakness identifiers and names carried by the plugin.
CWE Details	The weakness name together with its consequences and mitigations, from the offline MITRE data.

CWE matters beyond its own column: it is the link that produces the CCI mapping described next. A plugin with no CWE gets no CCI, ever.

Update it by downloading the CWEC XML from cwe.mitre.org — .xml or .xml.zip — and importing it under Options → Reference Data → CWE (MITRE) → Update….

6.4 CCI — which control this finding violates

A CCI (Control Correlation Identifier) is DISA’s atomic statement of a single security requirement. It is the connective tissue between a high-level policy control — a NIST SP 800-53 control such as SI-10 (6) — and the concrete technical check that proves it. Each CCI has an identifier such as CCI-005003, a definition in words, and the 800-53 control it belongs to.

NESSviewer takes the CWE identifiers a plugin reports, looks each one up in a CWE-to-CCI mapping, and shows the resulting CCIs on the finding with their controls and definitions.

What this gives you

Before, going from a scanner finding to the RMF control it breaches meant working CWE → CCI → 800-53 by hand or in a spreadsheet. Now you can:

• Cite a finding against a specific control in a POA&M, SSP or control assessment, with the control reference already attached.

• Group or filter the Analyze grid by CCI to see which controls a scan set is failing.

• Show which 800-53 controls a particular remediation would close out.

Column	What it shows
CCI	The CCIs this finding’s CWEs map to, comma-separated — for example CCI-005003, CCI-002771.
CCI Details	One block per CCI: the identifier and its 800-53 control, then the DISA definition beneath it. Hover a truncated cell to read it all.

Note

Both appear in the details panel, and both are labelled CCI — the one on the Vulnerability tab is the plain identifier list, and the one on the Risk tab is the full detail with controls and definitions.

The two CCI files

CCI traceability needs two datasets, both of which ship with NESSviewer:

Dataset	What it provides	Where to get it
CWE to CCI	Which CCIs each CWE maps to.	The CWE-to-CCI traceability JSON, cwe_cci_traceability.json.
CCI List (DISA)	Each CCI’s definition and its NIST SP 800-53 Revision 5 control.	DISA’s CCI List XML, U_CCI_List.xml, from public.cyber.mil.

6.5 Switching EPSS and CCI off

Both features have an on/off switch on the Reference Data tab, and both are on by default.

Setting	Default	What it does
Use EPSS scores	On	Off removes the three EPSS columns from findings and exports, and stops the EPSS notice on Analyze. The data stays loaded, so switching back on is instant.
Show CCIs for CWEs	On	Off removes the CCI and CCI Details columns.

6.6 Updating and resetting reference data

All five datasets are updated the same way: download the raw file from the source and import it with Update…. No preparation is needed — NESSviewer reads the publisher’s own format and condenses it for its own use.

Each row shows what is currently loaded, in the form {Source} {version} · {date} · {n} entries. Where nothing has been imported, you will see Loaded (bundled) or Not loaded. The EPSS row adds the age of the scores once they are a week or more old.

Reset to bundled discards every dataset you have imported and restores the copies that shipped with the application.

Important

Reset to bundled takes effect immediately with no confirmation prompt, and it resets all five datasets, not just the one you were looking at. Anything you imported must be imported again.

6.7 Which one do I act on?

Four risk signals on the same finding is three more than most people want. They answer different questions, and they are not interchangeable.

Signal	What it drives in NESSviewer
CISA KEV	Nothing automatic — but it is the only signal with a legally mandated deadline attached (CISA KEV Due Date).
Severity / CVSS	Everything in the compliance machinery: the DOD severity, the POA&M aging threshold, the POA&M Required column, the reports.
EPSS	Nothing automatic. It is decision support, with one defined threshold: ≥10% counts as “likely exploited” on the Dashboard.
CCI	Nothing automatic. It supplies the control reference your POA&M entry needs.

A workable order of attack, which the data supports:

1. Anything on the CISA KEV catalog, by due date. These are confirmed exploited and externally mandated.

2. High severity with EPSS at or above 10%. Severe, and likely to be used.

3. High severity with low EPSS. Still a POA&M obligation, but less urgent in practice.

4. Low and moderate findings, regardless of EPSS — though a high EPSS score on a moderate finding is a good reason to pull it forward by hand.

Important

EPSS never changes a finding’s severity, its POA&M deadline or whether POA&M Required says Yes. A moderate finding with a 90% EPSS score will not be flagged as requiring a POA&M any sooner than one at 0.1%. Treat EPSS as a reason to act, not as something the application acts on for you.