EPSS score explained: what the probability and percentile mean

An EPSS score is the estimated probability, from 0 to 1, that exploitation activity against a specific CVE will be observed in the next 30 days. The EPSS percentile is a ranking, not a second probability: it shows what share of all scored CVEs have the same score or a lower one. Because most CVEs score close to zero, a score that looks small, such as 0.10, ranked at about the 96th percentile on October 28, 2026.

The Exploit Prediction Scoring System is maintained by a special interest group at FIRST, the organization behind CVSS, and Empirical Security generates the free daily scores. This guide reflects FIRST's documentation and API data as of October 2026, when the production model is EPSS v5.

What the EPSS score measures

The score answers one narrow question: how likely are EPSS data partners to record exploitation activity for this CVE within 30 days? According to FIRST's description of the model, that activity comes from endpoint malware telemetry, honeypots, IDS and IPS alerts, and threat intelligence feeds. Attempts count, including ones a security control blocked, so the score tracks attacker activity rather than confirmed breaches.

The output is calibrated, so it can be read as a real probability: among many CVEs scoring around 0.05, FIRST expects exploitation activity for roughly one in twenty within 30 days. Every CVE is rescored daily with the same model, so an overnight jump means new inputs arrived, such as newly published exploit code or a burst of discussion on security sites.

One detail often surprises users: according to the EPSS FAQ, exploitation observed today is used for training but does not directly change tomorrow's score. EPSS is a forecast, not a live attack feed.

EPSS score vs percentile

The percentile is derived from the score. A percentile of 0.90 means the CVE scores at least as high as 90% of all scored CVEs; it does not mean a 90% chance of exploitation.

The two numbers drift far apart because scores are heavily skewed. FIRST puts the share of published CVEs with observed exploitation activity in a 30-day window at roughly 2.5-3%, so a calibrated model has to give most CVEs very low scores. Data from the FIRST EPSS API for October 28, 2026 (396,966 scored CVEs, model v2026.06.15) shows the effect:

• the median score was about 0.006 and the mean about 0.026;
• a score of 0.01 sat at roughly the 63rd percentile;
• 0.05 sat at roughly the 92nd percentile;
• 0.10 sat at roughly the 96th percentile, and only 4.4% of CVEs scored that high or higher;
• 0.50 sat at roughly the 99th percentile.

Use the percentile to rank findings and explain priorities. Use the probability for arithmetic: FIRST's Using EPSS guide notes that, assuming independent CVEs, the sum of scores estimates how many in a set will be exploited, and 1 minus the product of (1 − score) gives the chance that at least one is. For three CVEs scoring 0.20, 0.05 and 0.01, that chance is about 0.25. A percentile can also move while the score stays put, as other CVEs are rescored and new ones added.

EPSS model versions: from v4 to v5

According to FIRST's data page, five model versions have produced scores so far:

• v1: scores available from April 14, 2021;
• v2 (v2022.01.01): from February 4, 2022;
• v3 (v2023.03.01): from March 7, 2023;
• v4 (v2025.03.14): from March 17, 2025;
• v5 (v2026.06.15): from June 15, 2026, the current model as of October 2026.

EPSS v4 is therefore the model that ran from March 2025 until mid-June 2026. The first line of the daily CSV names the model that produced it; the file for October 28, 2026 begins with "#model_version:v2026.06.15".

A version change shifts scores overnight. In the API's historical data, Log4Shell (CVE-2021-44228) scored about 0.944 on June 14, 2026 and 0.99999 a day later under v5, while the number of CVEs scoring 0.10 or higher fell from 23,069 to 17,041. Recheck any threshold set before mid-June 2026.

How the current model works

FIRST describes the model as gradient-boosted trees (XGBoost) trained on a matrix of roughly 120 million rows (one CVE on one day) by about 2,850 columns. Inputs include exploit code and tooling such as Metasploit modules and Nuclei templates, references across security sites and advisories, the individual CVSS metrics (not the CVSS score), vendor and product, and CVE age. It is retrained when its predictions drift from observed outcomes, which FIRST says has happened roughly once a year.

How to choose an EPSS threshold

There is no official cut-off. FIRST's FAQ says 0.10 is often quoted but carries no special authority, and EPSS deliberately does not define bands such as "critical" or "high". FIRST suggests judging any threshold by three measures:

• Coverage: the share of actually exploited CVEs that your threshold caught (recall).
• Effort: the share of all CVEs that your threshold asks you to fix.
• Efficiency: the share of the CVEs you fixed that turned out to be exploited (precision).

Lowering the threshold raises coverage and effort and usually lowers efficiency; raising it does the opposite. FIRST's advice is to pick a threshold whose remediation volume you can sustain and whose coverage matches your risk tolerance.

For teams moving away from CVSS-based rules, FIRST offers rough equivalents. A "fix every CVSS Critical" policy covers a little over 10% of recent CVEs; the same workload under EPSS is about the 90th percentile, or a score of roughly 0.04. A "CVSS High and above" policy maps to a score of around 0.008. Be wary of thresholds that only feel intuitive: a cut-off of 0.5 would have selected about 1.1% of CVEs on October 28, 2026.

EPSS vs CVSS, KEV and SSVC

CVSS describes the technical characteristics and severity of a flaw; our CVSS 4.0 guide explains how that score is built. EPSS estimates how likely exploitation activity is. A critical CVSS score next to a low EPSS score is not a contradiction: the flaw would be serious if exploited, but current signals make exploitation in the next 30 days unlikely. FIRST warns against multiplying the two into a "risk score": the result is no longer a probability and has no clear meaning.

The CISA KEV catalog records confirmed exploitation. FIRST advises treating a KEV entry as actively exploited whatever its EPSS score, and relying on EPSS for the far larger set of CVEs without such evidence.

CISA's SSVC decision tree weighs exploitation status, technical impact, automatability, mission prevalence and public well-being impact, and returns one of four outcomes: Track, Track*, Attend or Act. BOD 26-04, which sets remediation deadlines for US federal civilian agencies, builds them from four decision points: public exposure, KEV status, Automatable and Technical Impact. EPSS is not one of them; our BOD 26-04 guide lists the resulting deadlines.

How to get EPSS scores: API and daily CSV

For one CVE or a small batch, query the FIRST API, for example api.first.org/data/v1/epss?cve=CVE-2021-44228. It returns the score, the percentile as a fraction (0.956 means the 95.6th percentile) and the date. Add date=YYYY-MM-DD for a past score back to April 14, 2021, scope=time-series for the last 30 days, or epss-gt and percentile-gt to list CVEs at or above a value. The "v1" in the URL is the API version, not the model version.

FIRST asks that the API be used for lookups. For bulk work, fetch the daily gzip-compressed CSV with three columns: cve, epss and percentile. Historical score files back to 2021 are kept in the empiricalsec/epss_scores repository on GitHub.

There is no EPSS calculator in the CVSS sense: the training data and scoring pipeline are not public, so scores can be looked up but not recomputed. Many scanners and vulnerability platforms display them next to CVSS; FIRST keeps a list of products that support EPSS, including Amazon Inspector and Cisco Vulnerability Management.

Limits to keep in mind

• No local context. The score does not know whether you run the software, whether it is reachable or what compensating controls you have. FIRST suggests checking presence, reachability and consequence before acting.
• Thin data on new CVEs. On disclosure day there may be no exploit code or discussion yet, so early scores rest on little evidence.
• Partial visibility. The model learns only from exploitation its partners can see.
• CVE IDs only. Vulnerabilities without a published CVE are not scored; FIRST says work on reserved CVE IDs is underway.

For reporting on individual exploited flaws, see the Vulnerabilities section of our Security coverage.

Frequently asked questions

What is a good or high EPSS score?

EPSS has no official bands, so "high" depends on your threshold. For reference, on October 28, 2026 a score of 0.10 sat at about the 96th percentile, and fewer than 2% of CVEs scored 0.30 or more.

Is EPSS better than CVSS?

They answer different questions: CVSS rates how severe a flaw is, while EPSS estimates how likely exploitation activity is in the next 30 days. EPSS ignores impact and CVSS ignores exploitation likelihood, so the two complement each other. FIRST positions EPSS as a way to prioritize by exploitation likelihood, not as a replacement for severity ratings.

How often are EPSS scores updated?

Scores for every CVE are recalculated and published daily. The model itself changes roughly once a year, according to FIRST; the current version, v5, has been in use since June 15, 2026.

What does an EPSS percentile of 0.95 mean?

The CVE's score is equal to or higher than that of 95% of all CVEs EPSS rates that day. It is not a 95% chance of exploitation; the score itself is the probability.

Is EPSS free to use?

Yes. The daily CSV and the API are free and need no registration, and FIRST asks for attribution when EPSS data is used in publications or products.