EPSS score: exploit prediction scores for every CVE
The Exploit Prediction Scoring System (EPSS), published daily by FIRST.org, estimates the probability that a CVE will be exploited in the wild in the next 30 days. The percentile ranks that score against every other CVE. For example, a CVE with EPSS 0.42 and percentile 0.99 has a 42% chance of exploitation within 30 days and scores higher than 99% of CVEs. Unlike CVSS, which rates how bad a vulnerability would be, EPSS rates how likely an attack is. Patch what is on the CISA KEV catalog first, then work down by EPSS.
FIRST has no EPSS score for CVE-2026-120311. New or rejected CVEs may not be scored yet. Open CVE-2026-120311.
- Scores dated
- 2026-11-01
- CVEs above 10%
- 17,507
- CVEs above 30%
- 7,151
- Newly above 10% today
- 3
Highest EPSS scores
The CVEs most likely to be exploited in the next 30 days, by today's score.
- CVE-2014-0160EPSS 100.0%, 99th percentile
- CVE-2014-3566EPSS 100.0%, 100th percentile
- CVE-2014-6271EPSS 100.0%, 99th percentile
- CVE-2015-1635EPSS 100.0%, 99th percentile
- CVE-2017-5638EPSS 100.0%, 99th percentile
- CVE-2017-9841EPSS 100.0%, 99th percentile
- CVE-2018-13379EPSS 100.0%, 99th percentile
- CVE-2019-0708EPSS 100.0%, 99th percentile
- CVE-2019-11510EPSS 100.0%, 99th percentile
- CVE-2019-19781EPSS 100.0%, 99th percentile
- CVE-2020-5902EPSS 100.0%, 100th percentile
- CVE-2021-1498EPSS 100.0%, 99th percentile
- CVE-2021-21985EPSS 100.0%, 99th percentile
- CVE-2021-22005EPSS 100.0%, 99th percentile
- CVE-2021-26084EPSS 100.0%, 99th percentile
- CVE-2021-26086EPSS 100.0%, 99th percentile
- CVE-2021-34473EPSS 100.0%, 99th percentile
- CVE-2021-35464EPSS 100.0%, 99th percentile
- CVE-2021-40438EPSS 100.0%, 99th percentile
- CVE-2021-44228EPSS 100.0%, 100th percentile
- CVE-2021-45105EPSS 100.0%, 99th percentile
- CVE-2022-26134EPSS 100.0%, 99th percentile
- CVE-2022-29464EPSS 100.0%, 99th percentile
- CVE-2023-0669EPSS 100.0%, 99th percentile
- CVE-2023-1389EPSS 100.0%, 99th percentile
Largest EPSS increases in 24 hours
CVEs whose score rose the most since yesterday's scores, among those now above 10%.
- CVE-2021-3128EPSS 16.2%, 96th percentile (was 2.18%)
- CVE-2025-47269EPSS 56.3%, 99th percentile (was 44.5%)
- CVE-2018-1000006EPSS 88.8%, 99th percentile (was 84.4%)
- CVE-2023-5375EPSS 39.0%, 98th percentile (was 34.7%)
- CVE-2025-9769EPSS 33.0%, 98th percentile (was 29.0%)
- CVE-2021-30560EPSS 20.4%, 97th percentile (was 17.6%)
- CVE-2024-28988EPSS 41.7%, 98th percentile (was 39.1%)
- CVE-2024-55963EPSS 32.9%, 98th percentile (was 30.7%)
- CVE-2025-25231EPSS 25.1%, 97th percentile (was 23.5%)
- CVE-2025-9752EPSS 18.9%, 97th percentile (was 17.4%)
- CVE-2024-32640EPSS 78.4%, 99th percentile (was 77.1%)
- CVE-2025-4009EPSS 72.9%, 99th percentile (was 71.6%)
- CVE-2020-8641EPSS 12.1%, 96th percentile (was 10.8%)
- CVE-2025-32821EPSS 23.5%, 97th percentile (was 22.2%)
- CVE-2025-54261EPSS 26.5%, 98th percentile (was 25.3%)
- CVE-2026-3612EPSS 14.3%, 96th percentile (was 13.2%)
- CVE-2022-34753EPSS 71.6%, 99th percentile (was 70.5%)
- CVE-2015-0286EPSS 19.9%, 97th percentile (was 18.9%)
- CVE-2025-5623EPSS 19.5%, 97th percentile (was 18.5%)
- CVE-2007-0671EPSS 44.1%, 98th percentile (was 43.2%)
- CVE-2023-22884EPSS 11.9%, 96th percentile (was 11.1%)
- CVE-2026-1731EPSS 93.9%, 99th percentile (was 93.1%)
- CVE-2013-10037EPSS 14.1%, 96th percentile (was 13.4%)
- CVE-2012-2576EPSS 60.0%, 99th percentile (was 59.4%)
- CVE-2025-26399EPSS 90.6%, 99th percentile (was 90.1%)
Newly above 10%
CVEs whose EPSS crossed 10% since yesterday.
Newly above 30%
CVEs whose EPSS crossed 30% since yesterday.
EPSS questions.
What is an EPSS score?
The Exploit Prediction Scoring System (EPSS) estimates the probability that a CVE will be exploited in the wild in the next 30 days, from 0 to 100%. FIRST.org publishes a new score for every published CVE each day, using a model trained on observed exploitation activity.
What does the EPSS percentile mean?
The percentile ranks a CVE's score against every other CVE's. A CVE in the 95th percentile scores higher than 95% of all CVEs, even when its probability looks small, because most CVEs score well under 1%.
What is the difference between EPSS and CVSS?
CVSS measures how severe a vulnerability would be if exploited; EPSS measures how likely exploitation is. A CVSS 9.8 bug nobody targets can have an EPSS under 1%, while a CVSS 6.5 bug in a widely scanned product can score above 50%. Use both: CVSS for impact, EPSS for likelihood.
What is a good EPSS threshold?
There is no single cutoff. Many teams prioritize CVEs above 10% (roughly the top 4% of all CVEs) and treat anything above 30% as urgent. cve.now flags a high-severity CVE as critical once its EPSS reaches 10%.
How do EPSS and CISA KEV work together?
KEV lists vulnerabilities already exploited; EPSS predicts which will be. Patch everything on KEV first, then work down by EPSS score, starting with the highest-severity CVEs in your stack.