EPSS score: exploit prediction scores for every CVE
The Exploit Prediction Scoring System (EPSS), published daily by FIRST.org, estimates the probability that a CVE will be exploited in the wild in the next 30 days. The percentile ranks that score against every other CVE. For example, a CVE with EPSS 0.42 and percentile 0.99 has a 42% chance of exploitation within 30 days and scores higher than 99% of CVEs. Unlike CVSS, which rates how bad a vulnerability would be, EPSS rates how likely an attack is. Patch what is on the CISA KEV catalog first, then work down by EPSS.
- Scores dated
- 2026-11-01
- CVEs above 10%
- 17,507
- CVEs above 30%
- 7,151
- Newly above 10% today
- 3
Highest EPSS scores
The CVEs most likely to be exploited in the next 30 days, by today's score.
- CVE-2014-0160EPSS 100.0%, 99th percentile
- CVE-2014-3566EPSS 100.0%, 100th percentile
- CVE-2014-6271EPSS 100.0%, 99th percentile
- CVE-2015-1635EPSS 100.0%, 99th percentile
- CVE-2017-5638EPSS 100.0%, 99th percentile
- CVE-2017-9841EPSS 100.0%, 99th percentile
- CVE-2018-13379EPSS 100.0%, 99th percentile
- CVE-2019-0708EPSS 100.0%, 99th percentile
- CVE-2019-11510EPSS 100.0%, 99th percentile
- CVE-2019-19781EPSS 100.0%, 99th percentile
- CVE-2020-5902EPSS 100.0%, 100th percentile
- CVE-2021-1498EPSS 100.0%, 99th percentile
- CVE-2021-21985EPSS 100.0%, 99th percentile
- CVE-2021-22005EPSS 100.0%, 99th percentile
- CVE-2021-26084EPSS 100.0%, 99th percentile
- CVE-2021-26086EPSS 100.0%, 99th percentile
- CVE-2021-34473EPSS 100.0%, 99th percentile
- CVE-2021-35464EPSS 100.0%, 99th percentile
- CVE-2021-40438EPSS 100.0%, 99th percentile
- CVE-2021-44228EPSS 100.0%, 100th percentile
- CVE-2021-45105EPSS 100.0%, 99th percentile
- CVE-2022-26134EPSS 100.0%, 99th percentile
- CVE-2022-29464EPSS 100.0%, 99th percentile
- CVE-2023-0669EPSS 100.0%, 99th percentile
- CVE-2023-1389EPSS 100.0%, 99th percentile
Largest EPSS increases in 24 hours
CVEs whose score rose the most since yesterday's scores, among those now above 10%.
- CVE-2021-3128EPSS 16.2%, 96th percentile (was 2.18%)
- CVE-2025-47269EPSS 56.3%, 99th percentile (was 44.5%)
- CVE-2018-1000006EPSS 88.8%, 99th percentile (was 84.4%)
- CVE-2023-5375EPSS 39.0%, 98th percentile (was 34.7%)
- CVE-2025-9769EPSS 33.0%, 98th percentile (was 29.0%)
- CVE-2021-30560EPSS 20.4%, 97th percentile (was 17.6%)
- CVE-2024-28988EPSS 41.7%, 98th percentile (was 39.1%)
- CVE-2024-55963EPSS 32.9%, 98th percentile (was 30.7%)
- CVE-2025-25231EPSS 25.1%, 97th percentile (was 23.5%)
- CVE-2025-9752EPSS 18.9%, 97th percentile (was 17.4%)
- CVE-2024-32640EPSS 78.4%, 99th percentile (was 77.1%)
- CVE-2025-4009EPSS 72.9%, 99th percentile (was 71.6%)
- CVE-2020-8641EPSS 12.1%, 96th percentile (was 10.8%)
- CVE-2025-32821EPSS 23.5%, 97th percentile (was 22.2%)
- CVE-2025-54261EPSS 26.5%, 98th percentile (was 25.3%)
- CVE-2026-3612EPSS 14.3%, 96th percentile (was 13.2%)
- CVE-2022-34753EPSS 71.6%, 99th percentile (was 70.5%)
- CVE-2015-0286EPSS 19.9%, 97th percentile (was 18.9%)
- CVE-2025-5623EPSS 19.5%, 97th percentile (was 18.5%)
- CVE-2007-0671EPSS 44.1%, 98th percentile (was 43.2%)
- CVE-2023-22884EPSS 11.9%, 96th percentile (was 11.1%)
- CVE-2026-1731EPSS 93.9%, 99th percentile (was 93.1%)
- CVE-2013-10037EPSS 14.1%, 96th percentile (was 13.4%)
- CVE-2012-2576EPSS 60.0%, 99th percentile (was 59.4%)
- CVE-2025-26399EPSS 90.6%, 99th percentile (was 90.1%)
Newly above 10%
CVEs whose EPSS crossed 10% since yesterday.
Newly above 30%
CVEs whose EPSS crossed 30% since yesterday.
EPSS questions.
What is an EPSS score?
The Exploit Prediction Scoring System (EPSS) estimates the probability that a CVE will be exploited in the wild in the next 30 days, from 0 to 100%. FIRST.org publishes a new score for every published CVE each day, using a model trained on observed exploitation activity.
What does the EPSS percentile mean?
The percentile ranks a CVE's score against every other CVE's. A CVE in the 95th percentile scores higher than 95% of all CVEs, even when its probability looks small, because most CVEs score well under 1%.
What is the difference between EPSS and CVSS?
CVSS measures how severe a vulnerability would be if exploited; EPSS measures how likely exploitation is. A CVSS 9.8 bug nobody targets can have an EPSS under 1%, while a CVSS 6.5 bug in a widely scanned product can score above 50%. Use both: CVSS for impact, EPSS for likelihood.
What is a good EPSS threshold?
There is no single cutoff. Many teams prioritize CVEs above 10% (roughly the top 4% of all CVEs) and treat anything above 30% as urgent. cve.now flags a high-severity CVE as critical once its EPSS reaches 10%.
How do EPSS and CISA KEV work together?
KEV lists vulnerabilities already exploited; EPSS predicts which will be. Patch everything on KEV first, then work down by EPSS score, starting with the highest-severity CVEs in your stack.