What Is EPSS? How to Read the Score and Use It With CVSS and KEV

EPSS, the Exploit Prediction Scoring System, is a free daily score that estimates the probability a published CVE will see exploitation activity in the next 30 days. FIRST, the Forum of Incident Response and Security Teams, publishes it for every scored CVE. It tells you how likely a flaw is to be used. It does not tell you how bad the damage would be.

Our guide to what a CVE is covered EPSS in one section, next to CVSS and the CISA KEV catalog. This post goes deeper on one question: how to read an EPSS score and where it belongs in a patch decision. It covers the two numbers, the model behind them, a free lookup, the limits for website teams and a worked example.

The short version: read the probability first, the percentile second. A KEV listing or a trusted report of attacks overrides any score. Use EPSS to sort a long list of flaws nobody has reported as exploited yet. Never read a low score as "safe," especially for WordPress plugins.

What EPSS measures

FIRST describes EPSS as a data-driven machine-learning model. It estimates the probability that a published CVE will be exploited in the wild in the next 30 days. Scores run from 0 to 1 and are published every day.

"Exploitation activity" has a specific meaning here. FIRST’s model page calls it evidence that exploitation of a vulnerability was attempted. That evidence comes from honeypots, intrusion detection and prevention sensors, and host-based detection. FIRST also notes it does not track whether those attempts succeed.

Three things the score leaves out:

• Impact. The EPSS FAQ says it does not measure how much damage exploitation would cause.
• Your environment. It does not know whether you run the software, or whether the flaw is reachable on your site.
• Risk as a whole. FIRST’s user guide says it should never be treated as a risk score. It covers only the threat part.

So it sits beside CVSS rather than replacing it. CVSS estimates how bad a flaw could be. EPSS estimates how likely it is to be used soon.

How to read an EPSS score: probability and percentile

Every scored CVE gets two numbers. Here are the Bricksforge values from October 21, 2026:

• Probability: 0.00312. The model puts the chance of exploitation activity in the next 30 days at about 0.3%.
• Percentile: 0.22784. That probability is at or above about 23% of all scored CVEs.

The probability is the number to act on. FIRST’s Using EPSS guide calls it a calibrated probability.

The percentile is a ranking. It moves when other CVEs’ scores move, even if yours does not. Bricksforge’s probability stayed at 0.00312 for two weeks while its percentile crept up each day.

Most scores are small. FIRST says the mean score is around 2.8% and the median around 0.7%. So a score of 50% is not "average." Anything above about 0.7% is already in the top half.

Small numbers also add up. FIRST’s user guide gives an example. Take 100 flaws, each with a 5% chance of exploitation. The chance that at least one is exploited is about 99.4%. An agency with many client sites holds many small probabilities at once.

Where the model comes from

EPSS began as research. Jay Jacobs, Sasha Romanosky, Benjamin Edwards, Michael Roytman and Idris Adjerid presented the first EPSS paper at Black Hat in 2019. That version predicted exploitation within the first twelve months after disclosure. The current model looks 30 days ahead.

A FIRST special interest group took it on in 2020. A 2023 paper by Jacobs and others described the third version. It reported an 82% performance improvement over past models.

FIRST’s data page lists five model versions:

As of October 2026, v5 is the newest version FIRST lists. Empirical Security’s v5 post says the model now scores all 318,000-plus published CVEs. It reports a 23% improvement over v4 on its own ranking metric. Empirical Security, Jacobs’ company, provides development and data support.

One practical point: FIRST warns that a time series crossing a version boundary reflects a change in method. A score can jump or drop on the day a new model starts.

How to look up an EPSS score

You do not need a security platform. FIRST runs a free public EPSS API. Paste a URL like this into a browser:

https://api.first.org/data/v1/epss?cve=CVE-2026-85097,CVE-2026-0257

The response lists each CVE with its probability, percentile and date. Trimmed, the Bricksforge entry looked like this on October 21, 2026:

{"cve":"CVE-2026-85097","epss":"0.003120000","percentile":"0.227840000","date":"2026-10-21"}

Three options are worth knowing:

• Several CVEs at once. Separate IDs with commas, as above.
• History. Add &scope=time-series to see about the last 30 days.
• A past date. Add &date=2026-05-14 to see what the score was that day. History goes back to April 14, 2021.

For a full list, FIRST publishes one compressed CSV file of every score each day. Its FAQ says new scores usually post shortly after 13:30 UTC. Many scanners and plugin security dashboards show the score too. Check which date their value comes from.

Using EPSS with CVSS and KEV

The three signals answer different questions. FIRST’s guide calls KEV a record of history and EPSS a forecast. A low score on a KEV-listed flaw is not a contradiction.

Two rules from FIRST are worth keeping. First, do not multiply EPSS by a CVSS score. FIRST says that does not produce a risk score. Second, confirmed and recent exploitation evidence should take precedence over the score. In our reading, that includes reports from Wordfence or Patchstack, not only KEV.

If you need a threshold, FIRST offers starting points. A CVSS "Critical only" policy takes about as much patching effort as fixing everything at or above the 90th percentile, roughly a 4% probability. A "High and above" policy roughly matches a 0.8% threshold. FIRST says thresholds are local and should be tuned over time.

Then make the score yours. FIRST suggests three checks: presence, reachability and consequence. Do we run it? Can an attacker reach it? What sits behind it? If any answer is no, urgency drops whatever the score. Our guide to reading a CVSS score covers the severity side in more depth.

Where EPSS falls short for website teams

Website teams hit the model’s edges more often than most.

• No CVE, no score. Only published CVEs get scored. A flaw fixed in a changelog without an ID gets nothing. FIRST’s FAQ says work is underway to score reserved IDs, but they are not scored today.
• A new CVE can start low. Bricksforge got its first score on October 8, 2026, the day its record was published. That score was 0.3%.
• Observed attacks are not a daily input. FIRST’s guide says exploitation activity trains the model but is not used in daily scoring. A flaw under attack today can keep a low score.
• The sensors may not see plugin attacks. The training data comes from honeypots and network and host sensors. Our reading is that attacks on niche WordPress plugins are seen first by plugin security firms.
• Method changes. A new model version can move a score overnight, as the next section shows.

For WordPress and Drupal work, treat the score as one input after the plugin security sources. Our post on the file upload flaws under attack in September shows how fast plugin attacks start.

Worked example: Bricksforge and GlobalProtect EPSS scores

All values below come from the FIRST API, fetched October 21, 2026. Check the live scores before you rely on them.

Bricksforge (CVE-2026-85097). Our Bricksforge post covers an unauthenticated file upload flaw in a Bricks add-on. Patchstack reported automated attacks from October 7, 2026. EPSS scored it 0.00312 on October 8 and every day through October 21. CISA’s own enrichment on the NVD record, dated October 8, marked exploitation as "none." EPSS and CISA both pointed low, and KEV had no entry. The plugin security source said patch today.

GlobalProtect (CVE-2026-0257). Our GlobalProtect post covers a VPN sign-in bypass. Its score history shows the model catching up:

Rapid7 reported exploitation from May 17, but the score stayed under 0.1% until May 30. The KEV listing on May 29 came a day before the jump.

A simple order for using EPSS

Here is how we would use it in a weekly patch review:

1. Drop anything you do not run, or run at a fixed version.
2. Patch anything in KEV, or reported as exploited by a trusted source, first.
3. Group the rest by impact and reachability, using CVSS and your own setup.
4. Within each group, sort by EPSS probability, highest first.
5. Re-check scores weekly. A jump is a reason to move a flaw up.

This is our rule of thumb, not FIRST’s. Adjust it for each client.

Frequently Asked Questions