EPSS (Exploit Prediction Scoring System)

Why it matters

Somewhere between 2 and 7 % of published CVEs are ever exploited in the wild, yet every one of them arrives with a CVSS score, and roughly a fifth of them are rated High or Critical. A team that patches by CVSS alone spends most of its time on vulnerabilities nobody will ever attack, while the one that gets weaponised next week sits at 7.5 in the queue. EPSS is the model that separates the two: it looks at the evidence that predicts exploitation — exploit code published, vendor, product, CWE, references, mentions on lists — and outputs a probability. Sorting the backlog by EPSS instead of CVSS catches a much larger share of the vulnerabilities that actually get exploited, for the same patching effort. FIRST publishes the numbers.

How to read it

Each CVE gets two numbers, recomputed daily by FIRST's model (v3 since March 2023, v4 since March 2025):

• The score: a probability between 0 and 1 that exploitation activity will be observed in the next 30 days. 0.02 means 2 %; 0.94 means it is being exploited or is about to be.
• The percentile: where that score sits among all scored CVEs. A score of 0.10 sounds small but is around the 94th percentile — only ~6 % of CVEs are more likely to be exploited. Most CVEs cluster below 0.01, so the percentile is what makes a score meaningful.

Thresholds are yours to pick; a common operating point is EPSS ≥ 0.1 or in CISA KEV as "fix now", EPSS ≥ 0.01 as "fix this cycle", the rest by CVSS and exposure. KEV is the complement: not a prediction but a confirmed list of CVEs with evidence of exploitation, with a due date for US federal agencies (which the rest of the world borrows as a deadline). Anything on KEV should sit at the top regardless of its EPSS score; anything with high EPSS and not yet on KEV is the early warning.

EPSS is a global probability. It knows nothing about whether you run the product or whether the vulnerable component is reachable — that is the Environmental part of CVSS or a decision framework like SSVC.

Common misreadings

• Low EPSS is not "safe". A 0.5 % chance per month, across a thousand internet-facing hosts, is not nothing — and targeted attackers are not modelled by a population statistic.
• Scores move. An exploit published on Tuesday can move a CVE from 0.01 to 0.9 by Wednesday; re-query at decision time, do not cache last month's export.
• EPSS is for CVEs only. Misconfigurations, missing controls and zero-days without a CVE id have no score; the absence of a number is not a low number.

Related terms

• CVSS — CVSS is the industry formula that turns the intrinsic characteristics of a vulnerability — how it is reached, how hard it is, what it breaks — into a 0–10 severity score and a vector string that records how the score was derived.
• IOC — An IOC is a piece of forensic evidence — a file hash, an IP address, a domain, a registry key, a mutex — whose presence on a system or in traffic indicates that a known intrusion has occurred.