# How verdicts work

Canonical: https://craguard.eu/methodology
Language: en
Last updated: 2026-09-02

CRAguard

Every finding gets exactly one verdict from a fixed, open set of rules — no black-box score. The rules are evaluated top to bottom; the first match wins.

## The rules, in order

- 1In CISA KEV (actively exploited) → Fix now
- 2CVSS ≥ 9.0 → Fix now
- 3CVSS ≥ 7.0 and EPSS ≥ 0.10 → Fix now
- 4CVSS ≥ 7.0 → Plan
- 5CVSS ≥ 4.0 or EPSS ≥ 0.01 → Plan
- 6Unknown severity (no CVSS) → Plan
- 7Otherwise → Informational

## Sources

- **OSV** — Open-source vulnerability database — which components are affected and in which version ranges.
- **CISA KEV** — The US catalog of vulnerabilities known to be actively exploited in the wild.
- **EPSS (FIRST)** — A probability score (0–1) that a vulnerability will be exploited in the next 30 days.

## Limits

No alert does not mean no vulnerability. Matching is based on package identifiers (purl) and version ranges; OS packages are matched on a best-effort basis. Verdicts are input for your own assessment, not a legal conclusion.

Rules version: 27 July 2026 (Commission guidance + FAQ).

---
Source: CRAguard — https://craguard.eu