All guides
← All guides

EPSS & KEV: real-world exploitability

Cross-cutting
On this page

In plain terms

The CVSS base score tells you how bad a vulnerability could be in the abstract. Two signals tell you how likely it is to bite you. Both fill in the real-world dimension of risk that CVSS calls threat (temporal, in CVSS 3.1), as distinct from your environmental context:

  • EPSS (Exploit Prediction Scoring System) is a probability, from 0 to 1, that a given CVE will be exploited in the wild in the next 30 days, produced by a data-driven model from FIRST.
  • KEV (Known Exploited Vulnerabilities) is CISA's authoritative list of vulnerabilities that are being exploited right now.

Why it matters

CVSS has a field for exploitation and nearly nobody fills it in, so an unpopulated score is computed as though the flaw were already under attack. These two feeds are how the industry supplies from outside what the score left empty.

Only a small fraction of all CVEs are ever exploited. Sorting purely by the CVSS base score means spending effort on "critical" vulnerabilities that no attacker has ever bothered with, while a "medium" that's on the KEV list, and so being actively exploited, waits in the backlog. EPSS and KEV re-focus attention on the vulnerabilities that pose real risk today.

The feedWhat it tells you
KEVis binary and high-confidence. If it's on the list it is being exploited, so treat it as urgent, regardless of its CVSS.
EPSSis a dial, where a high score means "attackers are likely to weaponize this soon."
One looks back, the other forward KEV is a record of exploitation somebody has already seen, so a CVE is on the list or it is not. EPSS is a forecast of the chance a CVE is exploited in the next thirty days, so it is a number between zero and one that moves as the world changes. They are used differently because they are different kinds of claim. now KEV something already happened CISA saw it used against real systems. On the list or not. There is no score. EPSS something might A probability for the next thirty days, rescored daily as the world changes. SO THEY ARE USED DIFFERENTLY A KEV hit escalates a finding outright, because the question it answers is settled. A high EPSS nudges it up a band, because a probability is not a verdict.
Neither is a severity. They are claims about the world rather than about the flaw, which is why a scanner reading only your code can produce neither.

Where it fits

These aren't scanners but enrichment. You take the CVEs your SCA and image scans already found, and cross-reference them against KEV and EPSS to sharpen priority.

How it works

KEV

CISA adds a vulnerability to the catalog when three things are true: it has a CVE ID, there is reliable evidence it has been exploited in the wild, and there is a clear remediation, such as a vendor update. Exploitation means an attacker ran code on a system without the owner's permission, and attempted exploitation counts as well as successful. Scanning, security research and a published proof of concept do not count, and neither does how exploitable a flaw looks on paper.

Federal civilian agencies in the US are required to remediate catalog entries within set timeframes, under Binding Operational Directive 26-04. Everybody else is urged to treat the catalog the same way, which is why it works as a shared definition of urgent.

EPSS

FIRST trains a model on observed exploitation activity and runs it against every published CVE once a day. Its inputs are signals that tend to come before an attack:

InputWhat the model reads
Public exploit codewhether a Metasploit module exists, exploit code in public GitHub repositories weighted by how widely those repositories are used, and inclusion in attacker tooling such as Nuclei templates
Discussionchatter about the flaw and how often it is referenced
The flaw's own propertiesevery CVSS metric individually, rather than the score

Observed exploitation trains the model and does not feed the daily score, so a score rises when exploit code appears or discussion spikes, before an attack is recorded. That is also why EPSS and KEV are independent: one forecasts from leading indicators, the other records what happened.

A prioritization step joins your findings' CVE IDs against both feeds. Neither feed can lower a finding, because a CVE missing from KEV or scoring low on EPSS is a statement that nothing was seen yet.

Common pitfalls

The pitfallWhy it bites
EPSS is a probability, not a guaranteeA low score isn't "safe," just "less likely."
A proof of concept is not a KEV entryPublic exploit code raises a CVE's EPSS score. It reaches KEV only once somebody is seen using it.
Feeds go staleEPSS updates daily and KEV grows continuously; use current data.
Neither one knows about your systemEPSS and KEV tell you whether a vulnerability is being exploited somewhere, rather than whether it's reachable or business-critical in your system. Combine this signal with your environmental context, meaning exposure and criticality for the full picture.
How Draugr fits. Draugr fetches both feeds for you with draugr feeds update, and you turn them on once in the descriptor, under config.exploitability. A CVE on KEV becomes critical; a CVE at or above your EPSS threshold is raised one band. Ranking never reaches the network, it reads the cached copy, so the same scan run twice ranks the same way and a gated run stays reproducible. Fetching is something you ask for, which is what keeps a band explainable: it came from a copy with a date on it rather than from whatever a service returned that morning. Each finding that moved says why it moved, ranked as critical, on KEV (2026-08-01), because a priority you can't check is a hint rather than evidence. See using KEV and EPSS in a scan in the docs.

Keep learning