What an EPSS Score Means and How FIRST Calculates It
FIRST, the Forum of Incident Response and Security Teams, publishes a new EPSS score for every CVE each day. A machine learning model produces the number from features of the vulnerability, such as its CVSS vector, its weakness type (CVE records map to CWE categories), the vendor, how long ago it was published, and whether public exploit code exists. The model learns from real exploitation activity that partner sensors and threat intelligence feeds observe. FIRST releases the full dataset as a free daily file and through a public API at first.org/epss, so any scanner or spreadsheet can read it. Because the inputs change, the score moves. A CVE can jump sharply the day a working exploit appears.
Why CVSS Alone Cannot Set Your Patch Order
Tens of thousands of new CVEs appear every year, and a single scan can hand you hundreds of “high” and “critical” findings at once. Sorting by CVSS alone leaves you with no way to pick among them. Research behind EPSS and earlier Cyentia studies found that only a small share of published CVEs, in the range of 5 percent, are ever seen exploited in the wild. That is the real problem EPSS solves. A flaw that attackers have no working exploit for rarely justifies a weekend of emergency patching, and a mid-severity flaw with a public exploit often does. We recommend treating CVSS as the impact estimate and EPSS as the urgency estimate.
How to Read an EPSS Score: Probability and Percentile
Every EPSS record carries two numbers, and mixing them up is the most common mistake. The score is a probability: 0.28 means a 28 percent chance of exploitation activity in the next 30 days. The percentile ranks that score against every other CVE: 0.98 means 98 percent of CVEs score lower. Because most CVEs are never exploited, even a modest probability lands near the top of the distribution. CVE-2024-1086, a Linux kernel flaw, scored 0.28 on 16 October 2026 and still sat at the 98th percentile. Read the probability to decide how urgent a patch is. Read the percentile to compare one flaw with the rest of your backlog.
| CVE | Flaw | EPSS score | Percentile |
|---|---|---|---|
| CVE-2021-44228 | Log4Shell in Apache Log4j | 0.99999 | 100th |
| CVE-2023-4966 | Citrix Bleed in NetScaler | 0.99999 | 99.99th |
| CVE-2017-0144 | EternalBlue in Microsoft SMB | 0.9923 | 99.94th |
| CVE-2019-5786 | Chrome FileReader use after free | 0.6109 | 99.15th |
| CVE-2024-1086 | Linux kernel netfilter use after free | 0.2806 | 98.09th |
Scores above come from the FIRST EPSS API on 16 October 2026. They change daily, so look up current values before you act on them.
EPSS vs CVSS vs CISA KEV
These three signals answer different questions, and none of them is enough alone. CVSS rates how bad a flaw could be if someone exploits it. EPSS estimates how likely exploitation is soon. The CISA Known Exploited Vulnerabilities (KEV) catalog confirms that attackers have already used a flaw. Our stance: KEV beats EPSS, and EPSS beats CVSS when you have to choose. A CVSS 9.8 flaw that nobody exploits can wait behind a CVSS 7.5 flaw that sits on KEV and runs on your internet-facing server. Use all three together, and let KEV and EPSS break ties inside each CVSS band.
| Signal | Question it answers | Who publishes it | Changes |
|---|---|---|---|
| CVSS | How severe is the flaw? | NVD and the vendor | Rarely |
| EPSS | How likely is exploitation in 30 days? | FIRST | Daily |
| CISA KEV | Have attackers already exploited it? | CISA | When CISA adds an entry |
Limits of EPSS You Should Plan For
EPSS is a strong signal with four known blind spots. Plan around each one.
- Expect weak scores on brand-new CVEs. A flaw published this morning has little exploitation evidence, so its first score rests on the flaw’s features alone.
- Remember that EPSS knows nothing about your network. It scores the CVE across the whole internet, not the one server where you run that software.
- Treat a low score as “not yet”, never as “never”. A probability is not a guarantee, and flaws in niche software may have little sensor coverage.
- Check what your auditor expects. Many compliance policies still set deadlines by CVSS severity, so EPSS works as a tiebreaker inside a severity band, not as a replacement.
Where to Find EPSS Scores
You do not need a paid product to read EPSS. Three free routes cover most teams:
- Query the FIRST API at api.first.org/data/v1/epss?cve=CVE-2021-44228 for one CVE, or pass several IDs separated by commas to get scores and percentiles in one call.
- Download the full daily file from FIRST when you want every CVE in a spreadsheet or database for your own reports.
- Paste your CVE list into the CVE Priority Checker if you want the scores sorted next to CVSS and KEV without writing a script.
Whichever route you pick, store the date with the score, because yesterday’s number may already be out of date.
Using EPSS to Prioritize Patching
A two-person IT team cannot patch 300 findings a week, so the order matters more than the volume. Follow this sequence:
- Check the CISA KEV catalog first. If a CVE is listed, patch it now, whatever its EPSS score says.
- Pull the EPSS score and percentile for every remaining CVE from the FIRST API, or paste your list into the CVE Priority Checker, which ranks it by CVSS, EPSS and KEV.
- Sort by score and split the list into bands. Our rule of thumb, not an official FIRST threshold: 0.50 or higher gets patched within days, 0.10 to 0.49 goes into the next maintenance window, and anything below 0.10 follows the routine cycle.
- Raise anything internet-facing or tied to a critical asset by one band.
- Recheck weekly, because scores change daily and a quiet CVE can turn urgent overnight.
EPSS ranks, a deadline decidesEPSS tells you what to patch first, not how fast. Turn the bands into deadlines with the Remediation SLA Generator, and read how to prioritize vulnerability remediation for the full workflow.
Frequently Asked Questions
What does EPSS stand for?
EPSS stands for Exploit Prediction Scoring System. It is a data-driven model, maintained by FIRST, that gives every CVE a probability between 0 and 1 of being exploited in the wild within the next 30 days.
Is EPSS free to use?
Yes. FIRST publishes the scores for every CVE at no cost as a daily download and through a public API, so you can use them in your own scripts, dashboards and scanners without a licence.
What is a good EPSS score?
There is no good or bad score, only more or less urgent. A higher score means exploitation is more likely in the next 30 days. As a practical guide, treat 0.10 or higher as worth scheduling and 0.50 or higher as urgent, then adjust for exposure.
Does EPSS replace CVSS?
No. CVSS measures how severe a flaw would be, and EPSS measures how likely exploitation is. They answer different questions, so teams use CVSS for impact, EPSS for likelihood, and CISA KEV for confirmed exploitation.
Related terms: CVE and CVSS. Sources: FIRST EPSS, CISA KEV catalog, and the National Vulnerability Database.
A website vulnerability scanner finds the CVEs that affect your software. Rank them with the free CVE Priority Checker and patch the ones attackers are most likely to use first.
