EPSS, the Exploit Prediction Scoring System, is a data-driven model that estimates the probability a given vulnerability will be exploited in the wild within the next 30 days, expressed as a score from 0 to 1. It is maintained by FIRST.org, refreshed daily, and built to answer the one question CVSS cannot: not how bad a flaw could be in theory, but how likely it is to actually be attacked. For anyone drowning in a backlog of "critical" CVEs, EPSS is the tool that tells you what to fix first.

EPSS gives you two numbers for each CVE: a probability (for example 0.92, meaning a 92% modeled chance of exploitation in the next 30 days) and a percentile that ranks it against every other scored vulnerability. A CVE in the 99th percentile is among the most likely to be attacked of anything tracked. The model is trained on real exploitation evidence and hundreds of features (CVE metadata, references, exploit-code availability, vendor, and observed attack traffic), and because it retrains continuously, a score can climb sharply once a proof-of-concept drops or in-the-wild activity appears.

How is EPSS different from CVSS?

CVSS measures severity: the potential impact and exploitability characteristics of a flaw, scored 0 to 10. EPSS measures likelihood: the probability it gets exploited soon. They answer different questions, and using CVSS alone to prioritize is why teams patch things that never get attacked while missing the ones that do. The strongest programs combine all three signals: CVSS for impact, EPSS for probability, and CISA KEV for confirmed exploitation.

When should you trust EPSS, and when should you not?

Trust EPSS as a prioritization signal for the broad middle of your backlog: it is very good at pushing the genuinely dangerous, actively-targeted CVEs to the top so you patch them first. Where it is weaker is fresh local-privilege-escalation and kernel bugs. Because EPSS leans on observable signals like public exploit traffic, a brand-new kernel flaw with a reliable but quiet exploit can show a low EPSS score and low percentile even when a working root exploit already exists. In our own tracking, that gap is a recurring trap. The fix is to never rely on a single number: weight "a public exploit exists" heavily even when EPSS and KEV have not caught up yet.

Our read

EPSS is one of the most useful free security data sources available, but it is a prioritization aid, not an oracle, and treating it as verifiable-by-design means understanding its blind spots as well as its strengths. Our 2025 analysis of the CISA KEV catalog found the median gap from disclosure to confirmed exploitation was just 26 days, which is exactly the window EPSS is built to help you win, provided you pair it with impact and confirmed-exploitation data rather than trusting any score in isolation.

Data per FIRST.org (EPSS), NVD, and CISA. Sources linked above.

Related: what CVSS misses for patch prioritization and why annual pentests miss most exploited bugs.