EPSS Score: How the Exploit Prediction Scoring System Helps You Prioritize Vulnerabilities

The Exploit Prediction Scoring System (EPSS) score is a daily probability, from 0 to 1, that a published vulnerability sees exploitation activity within 30 days. The Forum of Incident Response and Security Teams (FIRST) publishes an EPSS score and a percentile for every published Common Vulnerabilities and Exposures (CVE) record. Teams use it to decide which findings to fix first.

Key Takeaways about EPSS Score

• An EPSS score estimates the chance of exploitation activity across all organizations over the next 30 days. It says nothing about your assets, your controls, or the damage a successful attack would cause.
• Read the probability and the percentile together. A score of 0.04 looks small, yet it sits near the 90th percentile because most CVEs score close to zero.
• A listing in CISA’s Known Exploited Vulnerabilities catalog means confirmed exploitation, so it outranks any EPSS score. EPSS does its work across the far larger set of CVEs that the catalog has not listed.
• EPSS can lag on newly exploited flaws, and it cannot see whether an attacker can reach the vulnerable asset. Exposure validation from the outside answers that question with evidence.

This guide covers EPSS v5, which FIRST began publishing on June 15, 2026, and tests FIRST’s documentation against independent research on the model’s blind spots. It ends with a triage workflow for this month’s findings and marks the point where prediction needs evidence from your own attack surface.

What Is the Exploit Prediction Scoring System (EPSS)?

The Exploit Prediction Scoring System is a data-driven model of exploitation likelihood. It estimates how likely a CVE is to see exploitation activity in the wild over the next 30 days. The EPSS Special Interest Group at FIRST maintains it, and Empirical Security generates the daily scores and publishes them free.

The output covers likelihood and nothing else. According to FIRST’s FAQ, EPSS "does not measure how much damage successful exploitation would cause" or whether a flaw affects your environment. FIRST describes EPSS as one part of a risk calculation; impact and local context supply the rest.

Exploitation likelihood also differs from exploitability, which describes whether an attacker could use a flaw at all. This guide to exploitability in risk management traces that lifecycle from disclosure to weaponized exploit. EPSS forecasts a later step: whether attackers act on the flaw in the coming month.

EPSS has gone through five model versions since scores began on April 14, 2021. EPSS v4 started publishing on March 17, 2025, and EPSS v5 took over on June 15, 2026. Each release shifts scores on its launch date, so a score history that crosses a release reflects a method change plus any new signals.

How EPSS Scores Are Calculated

FIRST’s How EPSS Works documentation says the current model builds a daily record for each CVE from approximately 2,850 features. The features come from exploit code and offensive tooling, chatter across security sources, vulnerability characteristics, and the CVE’s age and reference count.

Public exploit code ranks among the strongest signals, and EPSS asks what kind of code exists and where. FIRST separates tested code in an exploit framework from a proof of concept pasted to a personal blog. Age matters too: FIRST reports that CVEs older than two years see exploitation at roughly five times the rate of CVEs under a month old.

EPSS takes the individual Common Vulnerability Scoring System (CVSS) metrics, such as attack vector and privileges required, as inputs and ignores the final CVSS score. The model learns from exploitation data how much weight each metric deserves.

Nearly a dozen data partners supply the training labels, drawn from malware telemetry, honeypots, intrusion detection and prevention systems, and threat intelligence feeds. Across the 12-month training window, those labels add up to more than 1.6 million recorded exploitation events. EPSS fits gradient-boosted trees with XGBoost, then calibrates the output so a score of 0.05 matches a 5% exploitation rate over 30 days.

The model stays fixed between releases. Each day, EPSS recomputes the features for every CVE and reruns the same model.

A score that jumps from 0.02 to 0.15 overnight means new signals arrived, such as fresh exploit code or a spike in chatter. The EPSS team retrains the model only when monitoring shows drift, which in practice has happened about once a year.

EPSS Score vs EPSS Percentile: Reading the Numbers Correctly

An EPSS score is an absolute probability, while the EPSS percentile ranks that score against every other scored CVE. FIRST’s FAQ gives the rule: "A vulnerability at the 90th percentile has a higher EPSS score than 90% of all scored vulnerabilities."

The two numbers diverge because scores bunch near zero. FIRST’s Using EPSS page puts the mean score near 2.8% and the median near 0.7%. A probability of 0.04 already reaches the 90th percentile.

Take a CVE that shows an EPSS score of 0.09 at the 95th percentile. The 0.09 means that, among CVEs with a similar profile, FIRST expects exploitation activity within 30 days for about 9 in 100. The 95th percentile means only about 5% of scored CVEs rank higher, which puts this one near the top of any large queue.

Teams tempted to drop everything under 0.2% should run the same math. FIRST reads 0.05 as roughly 1 in 20 over 30 days, or 500 exploitation events across 10,000 CVEs at that score. A low score lowers a finding’s place in the queue, and the finding stays open.

Percentiles also move while a probability holds still, because each day’s ranking covers a changing population. Store both values with the pull date. Use the probability for thresholds and math, and the percentile to explain rank to stakeholders.

EPSS vs CVSS: Likelihood vs Severity

The EPSS vs CVSS comparison comes down to two questions: how likely is exploitation soon, and how bad would a successful attack be? FIRST’s FAQ calls the two measures "empirically uncorrelated." A CVE can rate Critical in CVSS and low in EPSS. Both readings can be right.

Dimension	EPSS	CVSS Base
Question answered	How likely is exploitation activity in the next 30 days?	How severe is the flaw’s technical impact?
Output	Probability from 0 to 1, plus a percentile	Score from 0.0 to 10.0 with a severity rating
Update cadence	Daily, for every scored CVE	Set when the CVE is scored; changes only on a rescore
Inputs	About 2,850 features, including exploit code, chatter, CVSS metrics, and age	Analyst-assessed metrics such as attack vector and impact
Organization-specific?	No, it describes the whole population	No for Base scores; Environmental metrics add local context when teams apply them
Best use	Ordering a large queue by exploitation likelihood	Describing technical impact

Programs that act on CVSS Critical can switch at a similar volume, although your own findings may split differently. FIRST’s Using EPSS page estimates that the 90th EPSS percentile selects about as many published CVEs as a CVSS Critical filter. A separate guide in this series covers the CVSS metric groups and severity bands.

EPSS and CISA KEV: Predicted vs Confirmed Exploitation

The Cybersecurity and Infrastructure Security Agency (CISA) maintains the Known Exploited Vulnerabilities (KEV) catalog, a record of flaws attackers have already used. A listing requires "reliable evidence" of active exploitation in the wild, an assigned CVE ID, and a clear remediation action. On September 27, 2026, the catalog held 1,728 entries.

KEV records history and EPSS makes a forecast, so the two can disagree without either being wrong. In FIRST’s words, "A low EPSS score on a KEV-listed vulnerability is not a contradiction," because the two measure different things. FIRST’s guidance is to follow KEV whenever a CVE appears there.

Part of the gap comes from the design. Exploitation observed today trains future models, and FIRST states that it does not directly change tomorrow’s score. Score movement depends on public signals such as exploit code and chatter, and those can trail a confirmed attack.

CVE-2026-7273, a stack-based buffer overflow in Zyxel GS1900 series switches, shows the pattern. From its first score on June 16, 2026, until CISA added it to KEV on September 21, its EPSS score never rose above 0.00315. On September 27 it stood at 0.025, still only around the 84th percentile.

KEV has gaps of its own. The National Institute of Standards and Technology (NIST) published White Paper 41, "Likely Exploited Vulnerabilities," by Peter Mell and Jonathan Spring in May 2025. Their model found several hundred vulnerabilities with a probability of almost 1.0 of past exploitation, and many were missing from the KEV lists they tested.

Teams that combine EPSS and CISA KEV get both signals: confirmed attacks from KEV and a forecast for everything else. CISA’s Binding Operational Directive (BOD) 26-04 also uses KEV status as one input to federal patch priorities. For a running feed of new CVEs, the IONIX Threat Center curates flaws that unauthenticated attackers can exploit remotely.

EPSS Vulnerability Prioritization: A Practical Workflow

EPSS vulnerability prioritization works best as ordered filters, each one shrinking the queue before the next. The numbers below are illustrative: one month with 2,000 open CVE findings across internet-facing and internal assets.

1. Match scores to your findings. Pull the daily EPSS CSV, join it to scanner output by CVE ID, and store the pull date with each score. A high score on a CVE you do not run changes nothing.
2. Act on KEV first. Route every finding whose CVE appears in the catalog to remediation or mitigation, whatever its EPSS score. In the illustrative month, 60 findings land in this act tier.
3. Attend to high scores. FIRST notes that a 0.10 threshold is common but "carries no special authority," so pick one your team can sustain. A cutoff of 0.04, near the 90th percentile, adds 190 findings to the attend tier.
4. Check reachability and consequence for the act and attend tiers. Confirm whether an attacker can reach each asset from the internet and what the asset holds. An exposed login portal outranks the same CVE on an isolated lab server.
5. Track the rest. The remaining 1,750 findings stay in the normal patch cycle, and a daily job re-checks them for new KEV listings or sharp EPSS jumps.
6. Review the threshold each quarter. Count how many new KEV additions came from the track tier, and lower the cutoff if that number keeps rising.

The queue that needs attention this week drops from 2,000 findings to 250, or 12.5%. That reduction is the reason teams adopt EPSS. The exposure sits in the 1,750 tracked findings, where CVE-2026-7273 would have waited for three months.

Where EPSS Falls Short, and How Exposure Validation Fills the Gap

EPSS has three limits that a vulnerability management lead should write into the triage policy. The first is scope. FIRST states scores are "not tailored to any specific organization, industry, or technology stack" and advises layering them with asset inventory and local context.

The second is lag on newly exploited flaws. Rianna Parla’s November 2024 preprint, a single-author study without peer review, examined 57 high-severity CVEs from 2023 or later on KEV. It found that 42 of them "had consistently low (mostly single digit) EPSS scores prior to inclusion."

Parla studied EPSS v3. EPSS v5 may do better, although the Zyxel case above suggests the lag persists under the current model. The NIST white paper adds that EPSS probabilities "are known to be inaccurate for vulnerabilities that have been previously observed to be exploited."

Faster exploit development widens that gap. Research on LLM-generated one-day exploits (Fang et al., 2024) found a GPT-4 agent exploited 87% of 15 one-day vulnerabilities given the CVE description. Attackers working at that speed can hold a working exploit before the public signals EPSS reads build up.

The third limit matters most from the attacker’s side: EPSS cannot see whether the vulnerable asset is reachable on your attack surface. A 0.40 score on a server reachable only from the internal network and the same score on an exposed login page call for different responses. Exploitable vulnerability validation settles which case you face by testing the flaw against the live asset.

The same order of work drives zero-day vulnerability response: find the affected assets first, then confirm which ones an attacker can exploit. An EPSS score gives your team a free, daily, measured way to order a large queue by exploitation likelihood. Pair it with KEV, read the percentile beside the probability, and keep watching the tracked tier.

IONIX starts where the population-level score stops. The IONIX External Exposure Management platform maps internet-facing assets across subsidiaries and the digital supply chain. Its exposure validation then runs safe, non-intrusive tests to confirm whether a vulnerable asset is exploitable from the outside.

For newly published CVEs, Live Exposure Defense checks each one against your mapped external attack surface on a stated timeline and pinpoints potentially affected assets. It validates exploitability on those assets and, for an exploitable web asset, recommends a web application firewall (WAF) rule. Book a demo to see how IONIX validates exploitable exposures across your external attack surface.

FAQs about Epss Score

Sources

• FIRST, "How EPSS Works" (accessed September 28, 2026). https://www.first.org/epss/how-it-works.html
• FIRST, "EPSS Frequently Asked Questions" (accessed September 28, 2026). https://www.first.org/epss/faq.html
• FIRST, "Using EPSS" (accessed September 28, 2026). https://www.first.org/epss/using-epss.html
• FIRST, "Get the Data" (accessed September 28, 2026). https://www.first.org/epss/data.html
• CISA, "Known Exploited Vulnerabilities Catalog" (catalog version 2026.09.27). https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Parla, R., "Efficacy of EPSS in High Severity CVEs found in KEV," arXiv 2411.02618, preprint (2024). https://arxiv.org/abs/2411.02618
• Mell, P., and Spring, J., "Likely Exploited Vulnerabilities: A Proposed Metric for Vulnerability Exploitation Probability," NIST CSWP 41 (2025). https://doi.org/10.6028/NIST.CSWP.41
• CISA, "BOD 26-04: Prioritizing Security Updates Based on Risk" (2026). https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
• Fang, R., Bindu, R., Gupta, A., and Kang, D., "LLM Agents can Autonomously Exploit One-day Vulnerabilities," arXiv 2404.08144 (2024). https://arxiv.org/abs/2404.08144
• NIST National Vulnerability Database, CVE-2026-7273 record (2026). https://nvd.nist.gov/vuln/detail/CVE-2026-7273
• FIRST EPSS API, CVE-2026-7273 daily score history, June 16 to September 27, 2026. https://api.first.org/data/v1/epss?cve=CVE-2026-7273&scope=time-series