Loading today’s newest CISA KEV additions...

The Exploit Prediction Scoring System (EPSS), maintained by the EPSS Special Interest Group at FIRST (Forum of Incident Response and Security Teams), is a calibrated probability estimating the likelihood that a vulnerability will see exploitation activity in the wild within the next 30 days.

• Scale: Expressed as a value from 0.0% to 100%. FIRST's stated preference for display is percent (e.g. 2.4%) rather than decimal (0.024).

• How it's generated: EPSS is a machine-learning model, rescored daily, trained on a fixed set of features — CVE age, CVSS subscores, vendor, references, exploit-code and social signals, among others. Score movement reflects new signals in that feature set, not a live feed of current events; a confirmed exploitation report today does not itself move the score today.

• Relationship to CVSS: CVSS measures technical severity — what happens if a vulnerability is exploited. EPSS measures probability — how likely that exploitation is to occur. They answer different questions and are not interchangeable.

• What it is not: FIRST is explicit that EPSS is "not a severity score and not a complete risk score" on its own.

No. They answer two different questions.

• KEV = confirmed history. It means this vulnerability has been exploited at least once.

• EPSS = a forecast. It estimates the chance of further exploitation activity in the next 30 days.

A KEV entry can carry a low EPSS score if the exploitation was a one-off incident rather than part of a sustained, widespread attack pattern. Both facts can be true at the same time without contradicting each other.

The rule to apply: if a CVE is on KEV, treat it as high priority regardless of its EPSS score. KEV already confirms real-world exploitation — that alone is enough to act. The EPSS score on a KEV entry isn't there to tell you whether to patch; it's there to show whether that exploitation appears to be intensifying or staying isolated.

EPSS percentile ranks that probability against every other scored CVE. The EPSS score is an absolute probability.

• Interpretation: A percentile of 85 means 85% of all scored CVEs have a lower EPSS score than this one. Percentile is displayed with an ordinal suffix (85th), not a percent sign, to keep it visually distinct from the probability value.

• Why it matters: EPSS scores are heavily skewed toward zero — across the full population, mean EPSS is roughly 2.8% and median is roughly 0.7%, because the observed base rate of exploitation is only around 2–3% of all published CVEs in any 30-day window. A modest absolute probability can therefore still represent a high percentile rank.

• Reference point: FIRST states that a program currently treating CVSS Critical as its action threshold produces a roughly equivalent population size by acting at approximately the 90th EPSS percentile (≈4% probability). A CVSS High-and-above threshold corresponds to roughly the 0.8% EPSS threshold.

FIRST's published guidance ("Combining EPSS with other signals," first.org/epss/using-epss) states that EPSS reflects exploitation probability at the global population level — it has no visibility into what is present in a given environment, whether it is reachable by an attacker, or whether it is already confirmed exploited. Converting a population-level score into an operational decision requires combining it with three localizing factors:

• Presence — whether the vulnerability exists in the environment at all.
• Reachability — whether an attacker can actually reach and trigger it, accounting for network exposure, authentication requirements, and compensating controls.
• Consequence — the impact if the asset is compromised (criticality, data sensitivity, connectivity).

FIRST's stated rule of thumb on CISA KEV: a vulnerability listed on KEV should be treated as actively exploited and prioritized accordingly, regardless of its EPSS score. This is not conditioned on ransomware association or reachability, KEV listing alone is sufficient under FIRST's guidance. FIRST also notes this signal is not static: exploitation confirmed recently is a stronger indicator of near-term continued exploitation than an old KEV entry; the priority weight of a KEV listing decays over time in the absence of continued activity.

FIRST separately states that EPSS scores must not be mathematically combined with CVSS (e.g. multiplied together) to produce a single composite "risk score." EPSS is a calibrated probability; CVSS is an ordinal ranking with no equivalent calibration. Combining them arithmetically produces a number with no defined interpretation.

A four-tier prioritization structure based on these signals:

• Tier 1 — Confirmed exploitation, reachable asset
  Signal: CISA KEV listing (regardless of EPSS score) on a reachable/internet-facing asset.
  Action: Immediate remediation. KEV confirms exploitation has already occurred; reachability confirms the asset is exposed to it.
• Tier 2 — High predictive risk, reachable asset
  Signal: High EPSS score/percentile, not yet KEV-listed, on a reachable asset.
  Action: High priority. If the same vulnerability exists but the affected function is unreachable or fully isolated by compensating controls, FIRST's reachability principle means operational priority drops even at a high EPSS score.
• Tier 3 — High severity, low reachability or low predictive risk
  Signal: High CVSS severity with low EPSS, local-only access, or effective compensating controls (WAF, segmented network, no external exposure).
  Action: Scheduled remediation within standard maintenance windows.
• Tier 4 — Low signal across the board
  Signal: Low EPSS, low CVSS severity, no confirmed exploitation, non-critical or non-production asset.
  Action: Routine patch cycle.

This structure is consistent with CISA's own posture (KEV listing warrants prioritization independent of other scores) and NCSC UK's published vulnerability management guidance (prioritize internet-facing assets and highest-impact systems first, within a fix/acknowledge/investigate triage model). It is not attributed to a named "stakeholder-specific" framework — Stakeholder-Specific Vulnerability Categorization (SSVC) is a distinct CISA/CERT-CC methodology with its own decision criteria and does not use EPSS as an input.

The CISA Known Exploited Vulnerabilities (KEV) catalog focuses on vulnerabilities confirmed to be actively exploited in real-world attacks, making it far more valuable for patch prioritisation than the broader CVE list. While thousands of CVEs are published every year, only a smaller subset are actively targeted by threat actors, ransomware groups, and automated exploitation campaigns.

Track actively exploited vulnerabilities using KEV intelligence feeds, vendor advisories, exploit monitoring, threat intelligence platforms, and real-time vulnerability databases. Security teams should monitor CISA KEV updates, exploit proof-of-concept releases, ransomware activity, and attack telemetry to prioritise vulnerabilities with confirmed exploitation activity.

In 2026, ransomware operators continue to heavily exploit KEVs affecting VPN appliances, edge security devices, remote management tools, identity platforms, and internet-facing applications. Vulnerabilities enabling remote code execution, authentication bypass, privilege escalation, and insecure remote access remain the most common initial access vectors used in ransomware campaigns.

Read our latest 2026 half yearly Ransomware vulnerability report for stats, weakness patterns and trends affecting edge devices here

Integrate CISA KEV alerts into your patching workflow by mapping KEV entries to asset inventories, vulnerability scanners, ticketing systems, and SIEM or SOAR platforms. Many organisations automate KEV prioritisation by flagging affected internet-facing assets, triggering remediation tickets, and escalating vulnerabilities with active exploitation indicators.