What Is EPSS? Exploit Prediction Scoring Explained
EPSS scores predict 30-day exploitation probability. A CVE with CVSS 6.5 and EPSS 0.94 deserves more urgency than a CVSS 9.8 with EPSS 0.01.
Morgan "airgap" ReyesCVSS tells you how bad a CVE is if exploited. EPSS tells you whether it will be. They measure different things. You need both.
The score
Confirmed: EPSS is a probability value between 0.0 and 1.0. It represents the estimated likelihood that a given CVE is exploited in the wild within the next 30 days. Maintained by FIRST.org. Updated daily. Source: first.org/epss.
It does not measure severity. It does not measure impact. It measures probability of observed real-world exploitation.
Score of 0.95 means roughly 95% of CVEs with similar characteristics get exploited within a month. Different question than “how bad if exploited” — and often the more operationally urgent one.
EPSS vs. CVSS
CVSS answers: given worst-case exploitation, how severe is the damage? It scores attack vector, complexity, and confidentiality/integrity/availability impact. CVSS 9.8 means: if this hits, the damage is severe.
CVSS does not predict exploitation likelihood. Full stop.
Observed pattern: CVSS 9.8 with EPSS 0.01 sits unpatched for years without an attacker touching it. CVSS 6.5 with EPSS 0.94 is being weaponized this month against real targets. Patch prioritization on CVSS alone optimizes for theoretical severity. EPSS adds the exploitation-probability signal.
Both are legitimate inputs. Neither replaces the other.
How EPSS is calculated
FIRST runs a machine-learning classifier against per-CVE features: public PoC or exploit availability, vulnerability age, NVD metadata, threat intelligence signals, mentions in security databases and forums. Retrained continuously as data accumulates. Scores shift daily.
Observed: scores spike when a PoC goes public. A jump from 0.03 to 0.60 overnight is an active-exploitation signal worth acting on regardless of CVSS.
Limitation — confirmed by FIRST: scores for newly disclosed CVEs with limited signal data can be noisy. Full methodology: first.org/epss/user-guide. Treat EPSS as a signal. Not a verdict.
Two-axis triage
High CVSS + High EPSS: Patch immediately. Severe impact, high exploitation probability. Confirmed — this is what CISA KEV entries look like in metric terms.
High CVSS + Low EPSS: Patch on cycle, monitor for movement. Set a threshold — if EPSS crosses 0.10, it jumps the queue. Scores shift.
Low CVSS + High EPSS: Investigate. Likely patch fast. Active exploitation at scale. Attackers use “lower severity” CVEs for initial access, persistence, and credential theft — paths CVSS base scores underweight. Take the signal seriously.
Low CVSS + Low EPSS: Normal cycle. No urgency from either metric.
Concrete: path traversal, CVSS 5.4, EPSS 0.97 — being exploited now. Memory corruption, CVSS 9.3, EPSS 0.02 — theoretically severe, no observed real-world exploitation. Given a constrained patching window: the path traversal gets the slot.
Where to find scores
FIRST publishes EPSS data and a JSON API at first.org/epss. NVD CVE detail pages surface EPSS directly. Tenable, Qualys, and Rapid7 incorporate EPSS in risk-scoring output.
Here: the 0dayNews KEV Tracker shows EPSS alongside CVSS and CISA KEV status for every tracked entry. Sortable. Updated automatically. Start there.
What EPSS doesn’t know
EPSS is population-level. It doesn’t know your environment.
EPSS 0.30 on software you run publicly accessible: treat it with urgency. EPSS 0.30 on software isolated on an internal management network: different calculus. Same score, different exposure, different response.
Use EPSS to rank. Use your own exposure surface, compensating controls, and operational context to apply the ranking.
Confirmed: the number gives signal. Judgment turns signal into action.
Continue reading:
- What Is the CISA KEV Catalog? — how CISA determines which CVEs are actively exploited and what the federal three-week deadline signals for the broader industry
- How CVSS Scoring Works — a plain-language guide to the CVSS 3.1 components and where the score falls short of operational reality
- KEV Tracker — EPSS scores, CVSS, and CISA KEV status in one sortable table, updated daily
Found this useful? Share it.
