What Is EPSS? The Exploit Prediction Scoring System

Last verified on Nov 8, 2026.

EPSS, the Exploit Prediction Scoring System, estimates the probability that a published CVE will be exploited in the wild within the next 30 days. It gives every CVE a score between 0 and 1, updated daily. The model is developed by the EPSS Special Interest Group at FIRST, with scores generated by Empirical Security and published free.

What the Score Means

A score of 0.05 means a 5% estimated probability of observed exploitation activity in the next 30 days. FIRST's explanation: among many vulnerabilities scoring around 0.05, you would expect to see exploitation for about 5 in 100.

EPSS is a prediction, not a lookup of past exploitation. FIRST says it is generated without knowing whether the vulnerability was recently exploited, so a low score is a forecast, not a data gap. For confirmed exploitation, use CISA KEV.

Probability vs Percentile

Each CVE has both. The probability is the model's primary output. The percentile is a relative rank: the proportion of all scored vulnerabilities with the same score or lower.

Most vulnerabilities see no exploitation, so scores bunch near zero. FIRST notes that a probability of 0.10 currently sits around the 95th percentile. A "low-looking" 10% is high in relative terms.

To make that concrete: the daily file fetched on 2026-11-08 (scores dated 2026-11-07) held 401,675 scored CVEs, and 17,524 of them had a score of 0.1 or higher, about 4.4%. A threshold of 0.1 flags a short list.

Querying EPSS

The API is meant for looking up one CVE or a small batch. Here is Log4Shell:

curl -s "https://api.first.org/data/v1/epss?cve=CVE-2021-44228" | jq '.data[0]'

{
  "cve": "CVE-2021-44228",
  "epss": "0.999990000",
  "percentile": "1.000000000",
  "date": "2026-11-07"
}

For batch work, pull the daily CSV once. The three fields are cve, epss, and percentile. Files from model v2 onward start with a # comment line giving the model version, so skip it when parsing:

curl -sL https://epss.empiricalsecurity.com/epss_scores-current.csv.gz \
  | gunzip -c | grep -v '^#' | awk -F, 'NR > 1 && $2 >= 0.1' | wc -l

If you keep a time series, note FIRST's warning: each model version shifted scores on the date it started publishing, so a chart that crosses a boundary shows a methodology change, not a change in the vulnerability.

EPSS vs CVSS

FIRST states that CVSS and EPSS measure different things and that multiplying them does not compute probability times severity. Use them as two inputs. EPSS is also not a complete risk score: it does not account for compensating controls or what the affected system is worth to you.

Choosing a Threshold

1. Start with everything in KEV, since exploitation is observed.
2. Add anything with a high EPSS score on an asset you expose to the internet.
3. Use CVSS to order what remains.

Review the threshold against the size of your backlog. A threshold that yields a few dozen items a month gets worked. One that yields thousands gets ignored.

EPSS on cve.now

cve.now, a free vulnerability feed from Sazabi, records when a vulnerability's EPSS score first reaches 0.1 and shows it as likely exploitation, labeled a prediction rather than an observed attack. It lists an entry as critical when EPSS has reached 0.1 and its CVSS score is 7.0 or higher. See the known-exploited feed, and watch for new advisories in your stack.