What is EPSS, and how should you read it?
Reviewed November 11, 2026 · figures computed from 1,780 CISA-listed CVEs in the 0dayNews dataset at build time
EPSS (Exploit Prediction Scoring System) is a model run by FIRST.org that gives each CVE a probability, between 0 and 1, that exploitation activity will be observed in the next 30 days. It is refreshed daily and is a forecast, not a severity rating.
What the number means
An EPSS of 0.30 means the model estimates a 30% chance of observed exploitation in the next 30 days. FIRST also publishes a percentile, which says how a CVE ranks against all scored CVEs. The two answer different questions: probability is the absolute estimate, percentile is the relative standing.
EPSS is built from attributes of the CVE and from exploitation activity FIRST's data partners observe. The model has been retrained over time, so scores from different model versions are not directly comparable.
EPSS and KEV answer different questions
KEV says exploitation has been confirmed. EPSS estimates whether it is likely soon. A CVE can be on KEV with a low EPSS, and a high EPSS CVE can be absent from KEV.
The data shows the gap. Of 1,780 CISA-listed CVEs in our dataset with an EPSS value, 441 (25%) have an EPSS below 0.10 and 908 (51%) are at 0.50 or higher. A sizeable share of confirmed-exploited CVEs, particularly older ones, score low today. EPSS is a probability for the next 30 days, so it cannot replace the KEV list.
Reading it sensibly
Every CVE page on 0dayNews shows the EPSS value and the date it was taken, and our KEV tracker can sort by it.
- Treat KEV membership as the first filter, then use EPSS to order what is left.
- Look at the EPSS date. A score is a snapshot; it moves when exploit code appears or exploitation is reported.
- Do not treat a low EPSS as a reason to ignore an internet-facing, unauthenticated flaw in a product you run.