What EPSS measures
EPSS is the 0-to-1 score that estimates the probability a CVE will be exploited in the wild over the next thirty days. The full name is Exploit Prediction Scoring System, and the model is maintained by FIRST, the Forum of Incident Response and Security Teams, through an open working group.
The score ships daily. The public file dated 16 September 2026 ran model version v2026.06.15 and carried 374,847 scored CVEs. Each row holds two fields: the probability, and that CVE's percentile within the whole set.
The model reads the CVE, what has been published about it, and what sensors around the world recorded. It estimates the behaviour of a population, and your environment sits outside the calculation by design.
How to read the score and the percentile
The probability is literal. EPSS 0.42 means the model puts a 42% chance on exploitation activity appearing against that CVE in the coming month. The percentile gives relative position: a CVE at percentile 0.97 sits above 97% of the others.
Swapping one for the other gets expensive, because the distribution is heavily skewed. The median in the 16 September 2026 file is 0.0066, which puts half of all CVEs under a 0.7% chance. A high percentile lives comfortably alongside a small probability, since the height is measured against a universe that is mostly inert.
Teams that write SLA rules on percentile find this out in the third quarter, once the priority queue has filled with items nobody has ever tried to exploit.
How much of the queue an EPSS cutoff removes
A cutoff shrinks volume fast. In the 16 September 2026 file, 4.64% of scored CVEs sit at EPSS 0.1 or above, and 1.16% reach 0.5. The 0.088 cutoff, which appears as a worked example in the EPSS documentation, selects 19,090 CVEs, or 5.09% of the set.
Crossed against CISA's known exploited vulnerabilities catalog at version 2026.09.16, that cutoff covers 76.8% of the 1,711 catalog entries carrying a score. Five percent of the universe catching three quarters of what is already known to be exploited is a good trade for anyone who has to cut something.
The rest of the arithmetic is the part that matters. The other 397 entries, close to a quarter of the catalog, fall below 0.088. These are flaws with exploitation confirmed by observation that the model rates as unlikely, and an automatic EPSS filter drops them from the queue without telling anyone.
What EPSS does not know about your estate
It does not know whether you run that component, whether the service answers from outside or only on the internal network, whether the CVE's precondition holds on that asset, or what revenue runs through it.
The consequence cuts both ways. A CVE at EPSS 0.9 in a component you do not run is worth zero. A CVE at EPSS 0.02 on an exposed authentication server can be the most urgent item of the week.
There is also a bias that rarely makes it onto a slide. The model feeds on exploitation observation, and CISA's catalog is one source of that kind of signal. Median EPSS across catalog entries is 0.54 against 0.0066 for the whole file, and part of that eightyfold gap comes from the model having seen the same signal the catalog recorded.
EPSS, CVSS and KEV answer different questions
The market treats the three as versions of each other. They measure separate things.
CVSS answers how much damage the flaw would cause if exploited, under conditions ideal for the attacker. Theoretical severity, frozen in time.
EPSS answers the chance someone exploits that flaw somewhere in the world next month. A forecast, recomputed daily.
KEV answers whether exploitation against a real target has been confirmed. Observed fact, with no gradation: the CVE is in CISA's catalog or it sits outside.
A queue ordered by one of the three alone fails in a predictable way. By CVSS, the top fills with old 9.8s that have no known exploit. An EPSS-only order loses a quarter of what CISA has already confirmed. KEV on its own gives you a short list that ignores everything about to happen.
How to use EPSS on a queue of thousands
As an accelerator, never as an exclusion filter. Promoting a high-EPSS item is cheap and usually right. Discarding a low-EPSS item throws away the quarter of CISA's catalog the model rates as unlikely.
Crossed with reachability. EPSS 0.9 on an asset that answers on the internet is one thing; the same number behind a VPN is another. Crossing the score with the external attack surface changes the final order more than any tuning of the cutoff value.
By the movement of the score. A CVE that went from 0.02 to 0.60 in two weeks says more than one parked at 0.55 for six months. The jump means something changed outside, almost always a public exploit.
At the cadence of the data. The score changes daily. A queue recomputed once a month runs on thirty-day-old EPSS for 29 of those days.
What happens when the model changes version
EPSS is unstable across years. Each model version swaps variables and recalibrates the whole scale, and a CVE's score can rise or fall with nothing having changed about the flaw itself.
Anyone keeping history has to keep the model version alongside it. Without that, comparing a 2024 score against today's measures the model's drift and calls the result a change in risk.
What this choice does to the wider program is covered in vulnerability management. Prioritization by observed risk is where CSURFACE combines EPSS, CISA's catalog, public exploit and attack telemetry over a customer's external surface.