EPSS score: exploit prediction scores for every CVE
The Exploit Prediction Scoring System (EPSS), published daily by FIRST.org, estimates the probability that a CVE will be exploited in the wild in the next 30 days. The percentile ranks that score against every other CVE. For example, a CVE with EPSS 0.42 and percentile 0.99 has a 42% chance of exploitation within 30 days and scores higher than 99% of CVEs. Unlike CVSS, which rates how bad a vulnerability would be, EPSS rates how likely an attack is. Patch what is on the CISA KEV catalog first, then work down by EPSS.
- EPSS score
- 2.82%
- Percentile
- 86th
- CISA KEV
- Not listed
- Scores dated
- 2026-11-02
- CVEs above 10%
- 17,508
- CVEs above 30%
- 7,152
- Newly above 10% today
- 2
Highest EPSS scores
The CVEs most likely to be exploited in the next 30 days, by today's score.
- CVE-2014-0160EPSS 100.0%, 99th percentile
- CVE-2014-3566EPSS 100.0%, 100th percentile
- CVE-2014-6271EPSS 100.0%, 99th percentile
- CVE-2015-1635EPSS 100.0%, 99th percentile
- CVE-2017-5638EPSS 100.0%, 99th percentile
- CVE-2017-9841EPSS 100.0%, 99th percentile
- CVE-2018-13379EPSS 100.0%, 99th percentile
- CVE-2019-0708EPSS 100.0%, 99th percentile
- CVE-2019-11510EPSS 100.0%, 99th percentile
- CVE-2019-19781EPSS 100.0%, 99th percentile
- CVE-2020-5902EPSS 100.0%, 100th percentile
- CVE-2021-1498EPSS 100.0%, 99th percentile
- CVE-2021-21985EPSS 100.0%, 99th percentile
- CVE-2021-22005EPSS 100.0%, 99th percentile
- CVE-2021-26084EPSS 100.0%, 99th percentile
- CVE-2021-26086EPSS 100.0%, 99th percentile
- CVE-2021-34473EPSS 100.0%, 99th percentile
- CVE-2021-35464EPSS 100.0%, 99th percentile
- CVE-2021-40438EPSS 100.0%, 99th percentile
- CVE-2021-44228EPSS 100.0%, 100th percentile
- CVE-2021-45105EPSS 100.0%, 99th percentile
- CVE-2022-26134EPSS 100.0%, 99th percentile
- CVE-2022-29464EPSS 100.0%, 99th percentile
- CVE-2023-0669EPSS 100.0%, 99th percentile
- CVE-2023-1389EPSS 100.0%, 99th percentile
Largest EPSS increases in 24 hours
CVEs whose score rose the most since yesterday's scores, among those now above 10%.
- CVE-2019-6446EPSS 27.3%, 98th percentile (was 17.5%)
- CVE-2008-4824EPSS 21.1%, 97th percentile (was 13.3%)
- CVE-2025-58434EPSS 82.6%, 99th percentile (was 76.4%)
- CVE-2020-5260EPSS 14.9%, 96th percentile (was 9.97%)
- CVE-2023-1718EPSS 28.7%, 98th percentile (was 24.1%)
- CVE-2015-9406EPSS 58.9%, 99th percentile (was 55.0%)
- CVE-2023-20048EPSS 20.0%, 97th percentile (was 16.2%)
- CVE-2023-46695EPSS 53.4%, 98th percentile (was 49.8%)
- CVE-2025-54136EPSS 31.5%, 98th percentile (was 28.5%)
- CVE-2021-28325EPSS 64.1%, 99th percentile (was 62.1%)
- CVE-2025-50154EPSS 31.8%, 98th percentile (was 30.0%)
- CVE-2018-18982EPSS 62.5%, 99th percentile (was 60.8%)
- CVE-2026-3662EPSS 20.3%, 97th percentile (was 18.6%)
- CVE-2026-3661EPSS 19.7%, 97th percentile (was 18.1%)
- CVE-2025-5473EPSS 25.0%, 97th percentile (was 23.5%)
- CVE-2026-30822EPSS 15.0%, 96th percentile (was 13.4%)
- CVE-2026-30821EPSS 16.7%, 97th percentile (was 15.2%)
- CVE-2016-5330EPSS 19.5%, 97th percentile (was 18.0%)
- CVE-2014-9463EPSS 16.0%, 96th percentile (was 14.8%)
- CVE-2021-22719EPSS 41.7%, 98th percentile (was 40.6%)
- CVE-2025-38562EPSS 13.0%, 96th percentile (was 11.9%)
- CVE-2021-22717EPSS 40.0%, 98th percentile (was 38.9%)
- CVE-2016-6483EPSS 12.9%, 96th percentile (was 11.9%)
- CVE-2006-6293EPSS 17.3%, 97th percentile (was 16.4%)
- CVE-2021-22720EPSS 31.5%, 98th percentile (was 30.5%)
Newly above 10%
CVEs whose EPSS crossed 10% since yesterday.
Newly above 30%
CVEs whose EPSS crossed 30% since yesterday.
EPSS questions.
What is an EPSS score?
The Exploit Prediction Scoring System (EPSS) estimates the probability that a CVE will be exploited in the wild in the next 30 days, from 0 to 100%. FIRST.org publishes a new score for every published CVE each day, using a model trained on observed exploitation activity.
What does the EPSS percentile mean?
The percentile ranks a CVE's score against every other CVE's. A CVE in the 95th percentile scores higher than 95% of all CVEs, even when its probability looks small, because most CVEs score well under 1%.
What is the difference between EPSS and CVSS?
CVSS measures how severe a vulnerability would be if exploited; EPSS measures how likely exploitation is. A CVSS 9.8 bug nobody targets can have an EPSS under 1%, while a CVSS 6.5 bug in a widely scanned product can score above 50%. Use both: CVSS for impact, EPSS for likelihood.
What is a good EPSS threshold?
There is no single cutoff. Many teams prioritize CVEs above 10% (roughly the top 4% of all CVEs) and treat anything above 30% as urgent. cve.now flags a high-severity CVE as critical once its EPSS reaches 10%.
How do EPSS and CISA KEV work together?
KEV lists vulnerabilities already exploited; EPSS predicts which will be. Patch everything on KEV first, then work down by EPSS score, starting with the highest-severity CVEs in your stack.